Merge branch 'master' into staging/17.09

.gitignore

@@ -1 +1,2 @@
 /.graveyard
+/TODO

.rsync-filter

@@ -1,3 +1,4 @@
 - /.git
 - /.graveyard
+- /TODO
 P /.version-suffix

krebs/1systems/hotdog/config.nix

@@ -12,6 +12,7 @@
     <stockholm/krebs/2configs/buildbot-all.nix>
     <stockholm/krebs/2configs/gitlab-runner-shackspace.nix>
     <stockholm/krebs/2configs/binary-cache/nixos.nix>
+    <stockholm/krebs/2configs/ircd.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.hotdog;

krebs/1systems/puyak/config.nix

@@ -27,6 +27,11 @@
     initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda3"; } ];
     initrd.luks.cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
     initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
+
+    kernelModules = [ "kvm-intel" ];
+    extraModprobeConfig = ''
+      options thinkpad_acpi fan_control=1
+    '';
   };
 
   fileSystems = {
@@ -65,7 +70,10 @@
   '';
 
   environment.systemPackages = [ pkgs.zsh ];
-  boot.kernelModules = [ "kvm-intel" ];
+
+  system.activationScripts."disengage fancontrol" = ''
+    echo level disengaged > /proc/acpi/ibm/fan
+  '';
   users.users.joerg = {
     openssh.authorizedKeys.keys = [ config.krebs.users.Mic92.pubkey ];
     isNormalUser = true;

krebs/1systems/wolf/config.nix

@@ -1,6 +1,7 @@
 { config, pkgs, ... }:
 let
   shack-ip = config.krebs.build.host.nets.shack.ip4.addr;
+  influx-host = "127.0.0.1";
 in
 {
   imports = [
@@ -23,6 +24,58 @@ in
     <stockholm/krebs/2configs/shack/muell_caller.nix>
     <stockholm/krebs/2configs/shack/radioactive.nix>
     <stockholm/krebs/2configs/shack/share.nix>
+    {
+      systemd.services.telegraf.path = [ pkgs.net_snmp ]; # for snmptranslate
+      #systemd.services.telegraf.environment = {
+      #  "MIBDIRS" : ""; # extra mibs like ADSL
+      #};
+      services.telegraf = {
+        enable = true;
+        extraConfig = {
+          inputs = {
+            snmp = {
+              agents = [ "10.0.1.3:161" ];
+              version = 2;
+              community = "shack";
+              name = "snmp";
+              field = [
+                {
+                  name = "hostname";
+                  oid = "RFC1213-MIB::sysName.0";
+                  is_tag = true;
+                }
+                {
+                  name = "load-percent"; #cisco
+                  oid = ".1.3.6.1.4.1.9.9.109.1.1.1.1.4.9";
+                }
+                {
+                  name = "uptime";
+                  oid = "DISMAN-EVENT-MIB::sysUpTimeInstance";
+                }
+              ];
+              table = [{
+                name = "snmp";
+                inherit_tags = [ "hostname" ];
+                oid = "IF-MIB::ifXTable";
+                field = [{
+                  name = "ifName";
+                  oid = "IF-MIB::ifName";
+                  is_tag = true;
+                }];
+              }];
+            };
+          };
+          outputs = {
+            influxdb = {
+              urls = [ "http://${influx-host}:8086" ];
+              database = "telegraf";
+              write_consistency = "any";
+              timeout = "5s";
+            };
+          };
+        };
+      };
+    }
 
   ];
   # use your own binary cache, fallback use cache.nixos.org (which is used by
@@ -86,6 +139,9 @@ in
   boot.loader.grub.version = 2;
   boot.loader.grub.device = "/dev/vda";
 
+  # without it `/nix/store` is not added grub paths
+  boot.loader.grub.copyKernels = true;
+
   fileSystems."/" = { device = "/dev/disk/by-label/nixos"; fsType = "ext4"; };
 
   swapDevices = [
@@ -100,6 +156,7 @@ in
   users.extraUsers.root.openssh.authorizedKeys.keys = [
     config.krebs.users.ulrich.pubkey
     config.krebs.users.makefu-omo.pubkey
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDb9NPa2Hf51afcG1H13UPbE5E02J8aC9a1sGCRls592wAVlQbmojYR1jWDPA2m32Bsyv0ztqi81zDyndWWZPQVJVBk00VjYBcgk6D5ifqoAuWLzfuHJPWZGOvBf/U74/LNFNUkj1ywjneK7HYTRPXrRBBfBSQNmQzkvue7s599L2vdueZKyjNsMpx2m6nm2SchaMuDskSQut/168JgU1l4M8BeT68Bo4WdelhBYnhSI1a59FGkgdu2SCjyighLQRy2sOH3ksnkHWENPkA+wwQOlKl7R3DsEybrNd4NU9FSwFDyDmdhfv5gJp8UGSFdjAwx43+8zM5t5ruZ25J0LnVb0PuTuRA00UsW83MkLxFpDQLrQV08tlsY6iGrqxP67C3VJ6t4v6oTp7/vaRLhEFc1PhOLh+sZ18o8MLO+e2rGmHGHQnSKfBOLUvDMGa4jb01XBGjdnIXLOkVo79YR5jZn7jJb2gTZ95OD6bWSDADoURSuwuLa7kh4ti1ItAKuhkIvbuky3rRVvQEc92kJ6aNUswIUXJa0K2ibbIY6ycKAA3Ljksl3Mm9KzOn6yc/i/lSF+SOrTGhabPJigKkIoqKIwnV5IU3gkfsxPQJOBMPqHDGAOeYQe3WpWedEPYuhQEczw4exMb9TkNE96F71PzuQPJDl5sPAWyPLeMKpy5XbfRiF2by4nxN3ZIQvjtoyVkjNV+qM0q0yKBzLxuRAEQOZ2yCEaBudZQkQiwHD97H2vu4SRQ/2aOie1XiOnmdbQRDZSO3BsoDK569K1w+gDfSnqY7zVUMj6tw+uKx6Gstck5lbvYMtdWKsfPv/pDM8eyIVFLL93dKTX+ertcQj6xDwLfOiNubE5ayFXhYkjwImV6NgfBuq+3hLK0URP2rPlOZbbZTQ0WlKD6CCRZPMSZCU9oD2zYfqpvRArBUcdkAwGePezORkfJQLE6mYEJp6pdFkJ/IeFLbO6M0lZVlfnpzAC9kjjkMCRofZUETcFSppyTImCbgo3+ok59/PkNU5oavBXyW80ue2tWHr08HX/QALNte3UITmIIlU6SFMCPMWJqadK1eDPWfJ4H4iDXRNn3D5wqN++iMloKvpaj0wieqXLY4+YfvNTNr177OU48GEWW8DnoEkbpwsCbjPxznGDQhdDqdYyMY/fDgRQReKITvKYGHRzesGysw5cKsp9LEfXD0R6WE2TeiiENla5AWzTgXJB0AyZEcOiIfqOgT9Nr9S8q5gc/BdA7P+jhGGJgEHhV3dVlfIZ7pmZc27Yu7UTQ0lbAKWqcMSTOdne+QL6ILzbvLrQwdvax4tQdm5opfU16SrOox1AMwAbkdq84z6uJqYVx3cUXfMJgTyDNrVv3or root@plattenschwein" # for backup
   ];
 
   time.timeZone = "Europe/Berlin";

krebs/2configs/binary-cache/prism.nix

@@ -7,6 +7,7 @@
     ];
     binaryCachePublicKeys = [
       "cache.prism-1:+S+6Lo/n27XEtvdlQKuJIcb1yO5NUqUCE2lolmTgNJU="
+      "cache.prism-2:YwmCm3/s/D+SxrPKN/ETjlpw/219pNUbpnluatp6FKI="
     ];
   };
 }

krebs/2configs/hw/x220.nix

@@ -8,6 +8,8 @@ with import <stockholm/lib>;
 
   hardware.cpu.intel.updateMicrocode = true;
 
+  hardware.opengl.enable = true;
+
   services.tlp.enable = true;
 
   boot = {

krebs/2configs/repo-sync.nix

@@ -15,8 +15,8 @@ let
         post-receive = pkgs.git-hooks.irc-announce {
           nick = config.networking.hostName;
           verbose = false;
-          channel = "#retiolum";
+          channel = "#xxx";
-          server = "ni.r";
+          server = "irc.r";
           branches = [ "master" ];
         };
       });

krebs/2configs/shack/muell_caller.nix

@@ -6,8 +6,8 @@ let
     name = "muell_caller-2017-06-01";
     src = pkgs.fetchgit {
       url = "https://github.com/shackspace/muell_caller/";
-      rev = "bbd4009";
+      rev = "ee4e499";
-      sha256 = "1bfnfl2vdh0p5wzyz5p48qh04vvsg2445avg86fzhzragx25fqv0";
+      sha256 = "0q1v07q633sbqg4wkgf0zya2bnqrikpyjhzp05iwn2vcs8rvsi3k";
     };
     buildInputs = [
       (pkgs.python3.withPackages (pythonPackages: with pythonPackages; [

krebs/3modules/announce-activation.nix

@@ -35,7 +35,7 @@ in {
     irc = {
       # TODO rename channel to target?
       channel = mkOption {
-        default = "#retiolum";
+        default = "#xxx";
         type = types.str; # TODO types.irc-channel
       };
       nick = mkOption {
@@ -47,7 +47,7 @@ in {
         type = types.int;
       };
       server = mkOption {
-        default = "ni.r";
+        default = "irc.r";
         type = types.hostname;
       };
     };

krebs/3modules/ci.nix

@@ -133,8 +133,8 @@ in
       irc = {
         enable = true;
         nick = "build|${hostname}";
-        server = "ni.r";
+        server = "irc.r";
-        channels = [ "retiolum" "noise" ];
+        channels = [ "xxx" "noise" ];
         allowForce = true;
       };
       extraConfig = ''

krebs/3modules/default.nix

@@ -24,6 +24,7 @@ let
       ./go.nix
       ./hidden-ssh.nix
       ./htgen.nix
+      ./iana-etc.nix
       ./iptables.nix
       ./kapacitor.nix
       ./monit.nix

krebs/3modules/iana-etc.nix

@@ -0,0 +1,55 @@
+with import <stockholm/lib>;
+{ config, pkgs, ... }: {
+
+  options.krebs.iana-etc.services = mkOption {
+    default = {};
+    type = types.attrsOf (types.submodule ({ config, ... }: {
+      options = {
+        port = mkOption {
+          default = config._module.args.name;
+          type = types.addCheck types.str (test "[1-9][0-9]*");
+        };
+      } // genAttrs ["tcp" "udp"] (protocol: mkOption {
+        default = null;
+        type = types.nullOr (types.submodule {
+          options = {
+            name = mkOption {
+              type = types.str;
+            };
+          };
+        });
+      });
+    }));
+  };
+
+  config.environment.etc = mkIf (config.krebs.iana-etc.services != {})  {
+    services.source = mkForce (pkgs.runCommand "krebs-iana-etc" {} ''
+      exec < ${pkgs.iana_etc}/etc/services
+      exec > $out
+      awk -F '[ /]+' '
+        BEGIN {
+          port=0
+        }
+        ${concatMapStringsSep "\n" (entry: ''
+          $2 == ${entry.port} {
+            port=$2
+            next
+          }
+          port == ${entry.port} {
+            ${concatMapStringsSep "\n"
+              (proto: let
+                s = "${entry.${proto}.name} ${entry.port}/${proto}";
+              in
+                "print ${toJSON s}")
+              (filter (proto: entry.${proto} != null) ["tcp" "udp"])}
+            port=0
+          }
+        '') (attrValues config.krebs.iana-etc.services)}
+        {
+          print $0
+        }
+      '
+    '');
+  };
+
+}

krebs/3modules/krebs/default.nix

@@ -74,6 +74,7 @@ in {
             "build.r"
             "build.hotdog.r"
             "cgit.hotdog.r"
+            "irc.r"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----

krebs/3modules/lass/default.nix

@@ -83,7 +83,7 @@ with import <stockholm/lib>;
       };
       nets = rec {
         internet = {
-          ip4.addr = "213.239.205.240";
+          ip4.addr = "46.4.114.247";
           aliases = [
             "prism.i"
             "paste.i"
@@ -101,6 +101,47 @@ with import <stockholm/lib>;
             "paste.r"
             "p.r"
           ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIECgKCBAEAtpI0+jz2deUiH18T/+JcRshQi7lq8zlRvaXpvyuxJlYCz+o5cLje
+            fxrKn67JbDb0cTAiDkI88alHBd8xeq2I6+CY90NT6PNVfsQBFx2v5YXafELXJWlo
+            rBvPFrR7nt1VzmG/hzkY8RwgC8hC6jRn7cvWWPCkvm2ZnNtYqAjiYMcUcWv6Vn9Z
+            ytPgkebDF9KpD8bL4vQu9iPZGNZpwncCw/Ix66oyTM6e24j/fTYgp7xn28wVUzUB
+            wWDH0uMQOxyBGFutEvAQ48XZ+QQxZv+2ZGqWJ+MeXreUPNP5wTxFCQOrkR1EXNio
+            /jgdHXtU5wVvqPwziukwwnfGJYUUHw7mjdo6ps5rch/aDxs0lahNc2TMbhr3rqgA
+            BkXVfwDTt8W/PB6Z0Y/djXOlUmQKO39OgZuhsYzqM4Uj17up7CDY77SiQYrV901C
+            9CR5oFsAvV+WIMFUBc7ZZGPotJ9nZ2yyLQh+fT3sXuqFpGlyaI2SAm2edZUXKWQ5
+            Q6AIyQRPkTNRCDuvXxIMdmOE++tBnyCI/Psn/Qet5gFcSsUMPhto8Yaka4SgJfyu
+            3iIojFUzskowLWt6dBOGm5brI/OaKz0gyw5K3Hb4T7Jz+EwoeJfhbdZYA6NIY+qH
+            TGGl+47ffT+8e+1hvcAnO+bN5Br8WPN3+VD4FQD5yTb6pCFdZuL3QEyoKc9eugDb
+            g/+rFOsI8bfVeH5zZrl6B6XJBLGeKEECf3zwE2JObO3IuwxATSkahx1jAEy+hFyZ
+            kPwooGj03tkgVGc2AxgdHbfmNUbSVkO+m+ouBojikSrnFNKRTS/wZ69RVg3tl4qg
+            7F4Vs/aMQ9bSWycvRBZQXITPQ1Y6mCEUj2mSKVHmgy/5rqwz2va/Yc1zhUptcINo
+            7ztGiEzFMPGagkTs/Ntuqh2VbC/MwTao0BKl+gyCNwrACnNW87X4og2gtG3ukduz
+            cnSupO84hdTrclthsSEH/rLUauBsuIch58S/F7KCz9hwK45+Btky7Kz4mf/pE451
+            k88QfDHw/cTSzlESPnEnthrRnhxn0fW7FRwJpieKm2AmyEEjSiiYt8mUdD3teKj0
+            dgYrcGQkCnhmKDawgcw46wstBG/sAKT8qnZPRmlzKpcCS186ffuobQvj42LSmuMu
+            ToANi5pw2yEfzwLxNG/3whozB9rqwbqV/YAR/mthMxD0IXpLDKXlV1IeD7MfpV8i
+            jx6SghnkX/s2F7UTOlwJYe/Gl1biLRB8EPnOZKadHR0BRWFd+Qz6pJDp0B13jT3/
+            AEPNGXLwVjmdhy2TVec3OGL/CukPEdiW1Urw5lfOc9dacTXjTNTXzod7Ub6s7ZOE
+            T7Y4dsVeW4OM7NmE/riqS3cG9obGWO7gIQIDAQAB
+            -----END RSA PUBLIC KEY-----
+          '';
+        };
+      };
+      ssh.privkey.path = <secrets/ssh.id_ed25519>;
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAsANFdMi825qWQXQbWLYuNZ6/fARt3lnh1KStQHQQMD";
+    };
+    archprism = rec {
+      cores = 4;
+      nets = rec {
+        retiolum = {
+          via = internet;
+          ip4.addr = "10.243.0.104";
+          ip6.addr = "42::fa17";
+          aliases = [
+            "archprism.r"
+          ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----
             MIIBCgKCAQEAvzhoBsxUaEwm7ctiw3xvLFP2RoVaiHnF+Sm4J8E4DOerPToXxlyl
@@ -112,6 +153,13 @@ with import <stockholm/lib>;
             -----END RSA PUBLIC KEY-----
           '';
         };
+        internet = {
+          ip4.addr = "213.239.205.240";
+          aliases = [
+            "archprism.i"
+          ];
+          ssh.port = 45621;
+        };
       };
       ssh.privkey.path = <secrets/ssh.id_rsa>;
       ssh.pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChm4sqQ2bUZj+2YnTf6G5HHRTpSe1jTUhJRnwcYPYZKF+CBqBncipRpuGlGXEsptNa+7ZMcQC0ySsz5SUOMt3Ih+NehVe/qt3VtRz0l0MgOWmH2qBwKK9Y4IuxrJQzUmP4UGlOGlFj9DORssSMOyFIG4eZ9k2qMn3xal0NVRfGTShKlouWsiUILZ8I+sDNE00z8DAYesgc1yazvRnjzvLkRxdNdpYiAFBbmXMpPKK95McRJaWsuNSeal9kd5p5PagWcgN4DZ6+ebzz3NKnmzk4j+vuHX0U9lTXBqKMlzzmM2YNLRtDPfrtJNyHqLpZUpFhJKqZCD+4/0zdrzRfC7Th+5czzUCSvHiKPVsqw5eOdiQX6EyzNAF5zpkpRp//QdUNNXC5/Ku6GKCO491+TuA8VCha0fOwBONccTLUI/hGNmCh88mLbukVoeGJrbYNCOA/6kEz7ZLEveU4i+TT7okhDElMsNk+AWCZ8/NdJQNX3/K6+JJ9qAn+/yC8LdjgYYJ2oU/aw5/HyOgiQ0z4n9UfQ7j+nHysY9CQb1b3guX7yjJoc3KpNXCXEztuIRHjFD1EP8NRTSmGjsa/VjLmTLSsqjD+7IE5mT0tO5RJvmagDgdJSr/iR5D9zjW7hx7ttvektrlp9g0v3CiCFVaW4l95hGYT0HaNBLJ5R0YHm0lD+Q==";
@@ -381,6 +429,85 @@ with import <stockholm/lib>;
         };
       };
     };
+    eddie = {
+      ci = false;
+      external = true;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.29.170";
+          ip6.addr = "42:4992:6a6d:700::1";
+          aliases = [ "eddie.r" ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIICCgKCAgEAuRQphRlSIC/aqRTfvStPdJOJCx1ACeFIDEjRdgoxuu32qoBl7i6d
+            j7Voh+Msditf2a5+f0fVsNDaPnjPGfk0NkZBjmn+RZQDRXk0krpTNj2Vb6W5quTm
+            3yrjJMFJR9CU5khfppc47X+ir8bjn7RusWTFNEuDvUswHmRmnJHLS3Y+utOaRbCF
+            2hxpyxCn423gpsaBfORPEK8X90nPbuNpFDugWPnC+R45TpNmIf4qyKvfhd9OKrua
+            KNanGHG30xhBW/DclUwwWi8D44d94xFnIRVcG1O+Uto93WoUWZn90lI1qywSj5Aq
+            iWstBK4tc7VwvAj0UzPlaRYYPfFjOEkPQzj8xC6l/leJcgxkup252uo6m1njMx3t
+            6QWMgevjqosY22OZReZfIwb14aDWFKLTWs30J+zmWK4TjlRITdsOEKxlpODMbJAD
+            kfSoPwuwkWIzFhNOrFiD/NtKaRYmV8bTBCT3a9cvvObshJx13BP+IUFzBS1N1n/u
+            hJWYH5WFsQZn/8rHDwZGkS1zKPEaNoydjqCZNyJpJ5nhggyl6gpuD7wpXM/8tFay
+            pAjRP40+qRQLUWXmswV0hsZTOX1tvZs4f68y3WJ+GwCWw9HvvwmzYes5ayJrPsbJ
+            lyK301Jb42wGEsVWxu3Eo/PLtp8OdD+Wdh6o/ELcc0k/YCUGFMujUM8CAwEAAQ==
+            -----END RSA PUBLIC KEY-----
+          '';
+        };
+      };
+    };
+    borg = {
+      ci = false;
+      external = true;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.29.171";
+          ip6.addr = "42:4992:6a6d:700::2";
+          aliases = [ "borg.r" ];
+          tinc.pubkey = ''
+            -----BEGIN PUBLIC KEY-----
+            MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHZApTM7Hl4qqNakSwq
+            bt7zJoTVK9ePoC3Mue1VmJ1mCKMaxKdzlO31kPeHtkilAzgyIJdgikyKFlApGsQL
+            aIuU9h55X7TbikoDD6ghbSrAe3Pgc+sJ3OZ7wO7Qb8CKgJvEbkk/u68YiJgyTjYD
+            HNjIQzlsGdpoSke9vwC8qWanfgN7c2MMGtakqfXDjYjCgp7O43i+SMupkMSXIXMA
+            5XUFh/vVp6xgPxBofcw0uQIyZ5v4PPFjnGPm4rnMbFzbhubntHjDadwGd5Niyw4O
+            zNNKNchTLfNiuNGqTZeYd0kJ5fNMKykhpSs+ou34MvexvpuyPlFuotnPXN/nOMml
+            3nwiqzthzPuBZRLswxT0WvlA8wlbeTOKJ0wTIR4dDuAF+euDtoNocVEN5PJNc7yN
+            fmwAV6geESoJbZQMSCtAp1NioaBlRPp1pFfoM/GotHywuFrTIxyoIBiYhkpWyQvq
+            WYw5j13IKqkL7jDchhoBmcardmh+AP5bL3uQ84BgaYNwFzHp04qIRrrdpF0eMaHB
+            /8zaqsNLn4/zQJB5ffkelwoIqfvLPQeCMLzHGHgP5xUnWgmZZGiiDLvhuaMeNq4U
+            EpCKoTL178sPOgNfHfd8mEqx0qKYuPrNQEdlpa5xOZqwx56pfYpGWY+KtF2FHLhS
+            iO64GCJqCi1MKBYx/NhaxKMCAwEAAQ==
+            -----END PUBLIC KEY-----
+          '';
+        };
+      };
+    };
+    inspector = {
+      ci = false;
+      external = true;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.29.172";
+          ip6.addr = "42:4992:6a6d:800::1";
+          aliases = [ "inspector.r" ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIICCgKCAgEAr3l/u7qcxmFa2hUICU3oPDhB2ij2R3lKHyjSsVFVLNfl6TpOdppG
+            EDXOapeXL0s+PfBRHdRI3v/dibj4PG9eyKmFxsUJ2gRz4ghb1UE23aQ3pkr3x8sZ
+            7GR+nJYATYf+jolFF9O1x+f0Uo5xaYWkGOMH8wVVzm6+kcsZOYuTEbJAsbTRZywF
+            m1MdRfk54hLiDsj2rjGRZIR+ZfUKVs2MTWOLCpBAHLJK+r3HfUiR2nAgeNkJCFLw
+            WIir1ftDIViT3Ly6b7enaOkVZ695FNYdPWFZCE4AJI0s9wsbMClzUqCl+0mUkumd
+            eRXgWXkmvBsxR4GECnxUhxs6U8Wh3kbQavvemt4vcIKNhkw32+toYc1AFK/n4G03
+            OUJBbRqgJYx9wIvo8PEu4DTTdsPlQZnMwiaKsn+Gi4Ap6JAnG/iLN8sChoQf7Dau
+            ARZA3sf9CkKx5sZ+9dVrLbzGynKE18Z/ysvf1BLd/rVVOps1B/YRBxDwPj8MZJ0x
+            B7b0j+hRVV5palp3RRdcExuWaBrMQQGsXwLUZOFHJJaZUHF9XRdy+5XVJdNOArkG
+            q1+yGhosL1DLTQE/VwCxmBHyYTr3L7yZ2lSaeWdIeYvcRvouDROUjREVFrQjdqwj
+            7vIP1cvDxSSqA07h/xEC4YZKACBYc/PI2mqYK5dvAUG3mGrEsjHktPUCAwEAAQ==
+            -----END RSA PUBLIC KEY-----
+          '';
+        };
+      };
+    };
   };
   users = {
     lass = {
@@ -408,10 +535,14 @@ with import <stockholm/lib>;
     fritz = {
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCz34435NSXgj72YAOL4cIlRq/4yInKEyL9no+gymURoW5x1nkYpP0EK331e7UyQQSOdWOogRo6d7YHcFqNlYWv5xlYcHucIhgJwC4Zda1liVA+v7tSOJz2BjmFvOT3/qlcPS69f3zdLHZooz2C33uHX1FgGRXlxiA8dpqGnSr8o76QLZjuQkuDqr8reOspjO/RHCo2Moq0Xm5q9OgN1WLAZzupqt9A5lx567mRzYsRAr23pUxVN8T/tSCgDlPe4ktEjYX9CXLKfMyh9WuBVi+AuH4GFEWBT+AMpsHeF45w+w956x56mz0F5nYOQNK87gFr+Jr+mh2AF1ot2CxzrfTb fritz@scriptkiddiT540";
     };
-    prism-repo-sync = {
+    archprism-repo-sync = {
       pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINR9oL/OPHjjKjQ+IyRqWpgrXdZrKKAwFKIte8gYml6C";
       mail = "lass@prism.r";
     };
+    prism-repo-sync = {
+      pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhpCKTnSq6VDJPB+0NiHu2ZxSKEIxHN6uPAPnbXYNCe";
+      mail = "lass@prism.r";
+    };
     mors-repo-sync = {
       pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGv6N/UjFnX5vUicT9Sw0+3x4mR0760iaVWZ/JDtdV4h";
       mail = "lass@mors.r";

krebs/3modules/makefu/default.nix

@@ -4,6 +4,31 @@ with import <stockholm/lib>;
 
 {
   hosts = mapAttrs (_: setAttr "owner" config.krebs.users.makefu) {
+    cake = rec {
+      cores = 1;
+      ci = false;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.136.236";
+          ip6.addr  = "42:b3b2:9552:eef0:ee67:f3b3:8d33:eee1";
+          aliases = [
+            "cake.r"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEA0khdelSrOV/ZI9vvbV5aT1wVn2IfUfIdDCQIOnF2mZsrnIcuaedu
+            jRfZnJST1vOfL7JksF1+8pYwSn34CjJCGhyFf25lc6mARXmZe/araNrVpTntCy2+
+            MqG8KZe4mIda/WPTXRYGtFVQZeClM5SCZ7EECtw8sEkwt2QtOv43p/hiMXAkOQsq
+            6xc9/b4Bry7d+IjJs3waKfFQllF+C+GuK8yF0YnCEb6GZw7xkxHIO1QV4KSQ4CH7
+            36kEAdCSQ5rgaygRanUlUl+duQn1MLQ+lRlerAEcFfKrr3MKNz2jmGth8iUURdyP
+            MHjSWe+RkLQ6zzBaVgoKKuI9MbIbhenJWwIDAQAB
+            -----END RSA PUBLIC KEY-----
+            '';
+        };
+      };
+      ssh.privkey.path = <secrets/ssh_host_ed25519_key>;
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGyJlI0YpIh/LiiPMseD2IBHg+uVGrkSy0MPNeD+Jv8Y cake";
+    };
     drop = rec {
       ci = true;
       cores = 1;
@@ -78,6 +103,37 @@ with import <stockholm/lib>;
         };
       };
     };
+    latte = rec {
+      ci = true;
+      cores = 1;
+      ssh.privkey.path = <secrets/ssh_host_ed25519_key>;
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIrkK1mWfPvfZ9ALC1irGLuzOtMefaGAmGY1VD4dj7K1 latte";
+      nets = {
+        internet = {
+          ip4.addr = "185.215.224.160";
+          aliases = [
+            "latte.i"
+          ];
+        };
+        retiolum = {
+          ip4.addr = "10.243.80.249";
+          ip6.addr  = "42:ecb0:376:b37d:cf47:1ecf:f32b:a3b9";
+          aliases = [
+            "latte.r"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEAx70gmNoP4RYeF3ShddEMsbNad9L5ezegwxJTZA7XTfF+/cwr/QwU
+            5BL0QXTwBnKzS0gun5NXmhwPzvOdvfczAxtJLk8/NjVHFeE39CiTHGgIxkZFgnbo
+            r2Rj6jJb89ZPaTr+hl0+0WQQVpl9NI7MTCUimvFBaD6IPmBh5wTySu6mYBs0mqmf
+            43RrvS42ieqQJAvVPkIzxxJeTS/M3NXmjbJ3bdx/2Yzd7INdfPkMhOONHcQhTKS4
+            GSXJRTytLYZEah8lp8F4ONggN6ixlhlcQAotToFP4s8c+KqYfIZrtP+pRj7W72Y6
+            vhnobLDJwBbAsW1RQ6FHcw10TrP2H+haewIDAQAB
+            -----END RSA PUBLIC KEY-----
+          '';
+        };
+      };
+    };
 
     pnp = {
       ci = true;
@@ -460,6 +516,8 @@ with import <stockholm/lib>;
           '';
         };
       };
+      ssh.privkey.path = <secrets/ssh.id_ed25519>;
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN5ZmJSypW3LXIJ67DdbxMxCfLtORFkl5jEuD131S5Tr";
     };
 
     gum = rec {

krebs/3modules/tv/default.nix

@@ -32,52 +32,6 @@ with import <stockholm/lib>;
       ssh.privkey.path = <secrets/ssh.id_rsa>;
       ssh.pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDP9JS2Nyjx4Pn+/4MrFi1EvBBYVKkGm2Q4lhgaAiSuiGLol53OSsL2KIo01mbcSSBWow9QpQpn8KDoRnT2aMLDrdTFqL20ztDLOXmtrSsz3flgCjmW4f6uOaoZF0RNjAybd1coqwSJ7EINugwoqOsg1zzN2qeIGKYFvqFIKibYFAnQ8hcksmkvPdIO5O8CbdIiP9sZSrSDp0ZyLK2T0PML2jensVZOeqSPulQDFqLsbmavpVLkpDjdzzPRwbZWNB4++YeipbYNOkX4GR1EB4wMZ93IbBV7kpJtib2Zb2AnUf7UW37hxWBjILdstj9ClwNOQggn8kD9ub7YxBzH1dz0Xd8a0mPOAWIDJz9MypXgFRc3vdvPB/W1I4Se0CLbgOkORun9CkgijKr9oEY8JNt8HFd6viZcAaQxOyIm6PNHZTnHfdSc7bIBS2n3e3IZBv0fTd77knGLXg402aTuu2bm/kxsKivxsILXIaGbeXe4ceN3Fynr3FzSM2bUkzHb0mAHu1BQ9YaX0xzCwjVueA5nzGls7ODSFkXsiBfg2FvMN/sTLFca6tnwyqcnD6nujoiS5+BxjDWPgnZYqCaW3B/IkpTsRMsX6QrfhOFcsP8qlJ2Cp82orWoDK/D0vZ9pdzAc6PFGga0RofuJKY2yiq+SRZ7/e9E6VncIVCYZ1OfN0Q==";
     };
-    cd = {
-      ci = true;
-      cores = 2;
-      extraZones = {
-        # TODO generate krebsco.de zone from nets and don't use extraZones at all
-        "krebsco.de" = ''
-          cd          60 IN A ${config.krebs.hosts.cd.nets.internet.ip4.addr}
-        '';
-      };
-      nets = {
-        internet = {
-          ip4.addr = "45.62.237.203";
-          aliases = [
-            "cd.i"
-            "cd.krebsco.de"
-          ];
-          ssh.port = 11423;
-        };
-        retiolum = {
-          via = config.krebs.hosts.cd.nets.internet;
-          ip4.addr = "10.243.113.222";
-          ip6.addr = "42:4522:25f8:36bb:8ccb:150:231a:2af3";
-          aliases = [
-            "cd.r"
-            "cgit.cd.r"
-          ];
-          tinc.pubkey = ''
-            -----BEGIN RSA PUBLIC KEY-----
-            MIICCgKCAgEAvmCBVNKT/Su4v9nl/Nm3STPo5QxWPg7xEkzIs3Oh39BS8+r6/7UQ
-            rebib7mczb+ebZd+Rg2yFoGrWO8cmM0VcLy5bYRMK7in8XroLEjWecNNM4TRfNR4
-            e53+LhcPdkxo0A3/D+yiut+A2Mkqe+4VXDm/JhAiAYkZTn7jUtj00Atrc7CWW1gN
-            sP3jIgv4+CGftdSYOB4dm699B7OD9XDLci2kOaFqFl4cjDYUok03G0AduUlRx10v
-            CKbKOTIdm8C36A902/3ms+Hyzkruu+VagGIZuPSwqXHJPCu7Ju+jarKQstMmpQi0
-            PubweWDL0o/Dfz2qT3DuL4xDecIvGE6kv3m41hHJYiK+2/azTSehyPFbsVbL7w0V
-            LgKN3usnZNcpTsBWxRGT7nMFSnX2FLDu7d9OfCuaXYxHVFLZaNrpccOq8NF/7Hbk
-            DDW81W7CvLyJDlp0WLnAawSOGTUTPoYv/2wAapJ89i8QGCueGvEc6o2EcnBVMFEW
-            ejWTQzyD816f4RsplnrRqLVlIMbr9Q/n5TvlgjjhX7IMEfMy4+7qLGRQkNbFzgwK
-            jxNG2fFSCjOEQitm0gAtx7QRIyvYr6c7/xiHz4AwxYzBmvQsL/OK57NO4+Krwgj5
-            Vk8TQ2jGO7J4bB38zaxK+Lrtfl8i1AK1171JqFMhOc34JSJ7T4LWDMECAwEAAQ==
-            -----END RSA PUBLIC KEY-----
-          '';
-        };
-      };
-      ssh.privkey.path = <secrets/ssh.id_ed25519>;
-      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOd/HqZIO9Trn3eycl23GZAz21HQCISaVNfNyaLSQvJ6";
-    };
     ju = {
       external = true;
       nets = {

krebs/5pkgs/simple/git-preview.nix

@@ -0,0 +1,17 @@
+{ coreutils, git, writeDashBin }:
+
+writeDashBin "git-preview" ''
+  set -efu
+  head_commit=$(${git}/bin/git log -1 --format=%H)
+  merge_commit=$1; shift
+  merge_message='Merge for git-preview'
+  preview_dir=$(${coreutils}/bin/mktemp --tmpdir -d git-preview.XXXXXXXX)
+  preview_branch=$(${coreutils}/bin/basename "$preview_dir")
+  ${git}/bin/git worktree add -b "$preview_branch" "$preview_dir" >/dev/null
+  ${git}/bin/git -C "$preview_dir" checkout "$head_commit"
+  ${git}/bin/git -C "$preview_dir" merge -m "$merge_message" "$merge_commit"
+  ${git}/bin/git -C "$preview_dir" diff "$head_commit.." "$@" &
+  ${git}/bin/git branch -fd "$preview_branch"
+  ${coreutils}/bin/rm -fR "$preview_dir"
+  wait
+''

krebs/5pkgs/simple/git-preview/default.nix

@@ -0,0 +1,15 @@
+{ coreutils, git, stdenv, writeDashBin }:
+
+writeDashBin "git-preview" ''
+  PATH=${stdenv.lib.makeBinPath [
+    coreutils
+    git
+  ]}''${PATH+:$PATH}
+  hashes=$(git log --format=%h "..$1")
+  end=$(echo "$hashes" | head -1)
+  start=$(echo "$hashes" | tail -1)
+  # exit if no diff was found
+  test -z "$start" && exit 0
+  shift
+  git diff "$start^..$end" "$@"
+''

krebs/5pkgs/simple/weechat/default.nix

@@ -1,80 +0,0 @@
-{ stdenv, fetchurl, ncurses, openssl, aspell, gnutls
-, zlib, curl , pkgconfig, libgcrypt
-, cmake, makeWrapper, libiconv
-, asciidoctor # manpages
-, guileSupport ? true, guile
-, luaSupport ? true, lua5
-, perlSupport ? true, perl
-, pythonPackages
-, rubySupport ? true, ruby
-, tclSupport ? true, tcl
-, extraBuildInputs ? [] }:
-
-assert guileSupport -> guile != null;
-assert luaSupport -> lua5 != null;
-assert perlSupport -> perl != null;
-assert rubySupport -> ruby != null;
-assert tclSupport -> tcl != null;
-
-let
-  inherit (pythonPackages) python pycrypto pync;
-in
-
-stdenv.mkDerivation rec {
-  version = "1.8";
-  name = "weechat-${version}";
-
-  src = fetchurl {
-    url = "http://weechat.org/files/src/weechat-${version}.tar.bz2";
-    sha256 = "10km0437lg9ms6f16h20s89l2w9f9g597rykybxb16s95ql48z08";
-  };
-
-  outputs = [ "out" "doc" ];
-
-  enableParallelBuilding = true;
-  cmakeFlags = with stdenv.lib; [
-    "-DENABLE_MAN=ON"
-    "-DENABLE_DOC=ON"
-  ]
-    ++ optionals stdenv.isDarwin ["-DICONV_LIBRARY=${libiconv}/lib/libiconv.dylib" "-DCMAKE_FIND_FRAMEWORK=LAST"]
-    ++ optional (!guileSupport) "-DENABLE_GUILE=OFF"
-    ++ optional (!luaSupport)   "-DENABLE_LUA=OFF"
-    ++ optional (!perlSupport)  "-DENABLE_PERL=OFF"
-    ++ optional (!rubySupport)  "-DENABLE_RUBY=OFF"
-    ++ optional (!tclSupport)   "-DENABLE_TCL=OFF"
-    ;
-
-  buildInputs = with stdenv.lib; [
-      ncurses python openssl aspell gnutls zlib curl pkgconfig
-      libgcrypt pycrypto makeWrapper
-      cmake
-      asciidoctor
-      ]
-    ++ optional  guileSupport    guile
-    ++ optional  luaSupport      lua5
-    ++ optional  perlSupport     perl
-    ++ optional  rubySupport     ruby
-    ++ optional  tclSupport      tcl
-    ++ extraBuildInputs;
-
-  NIX_CFLAGS_COMPILE = "-I${python}/include/${python.libPrefix}"
-    # Fix '_res_9_init: undefined symbol' error
-    + (stdenv.lib.optionalString stdenv.isDarwin "-DBIND_8_COMPAT=1 -lresolv");
-
-  postInstall = with stdenv.lib; ''
-    NIX_PYTHONPATH="$out/lib/${python.libPrefix}/site-packages"
-    wrapProgram "$out/bin/weechat" \
-      ${optionalString perlSupport "--prefix PATH : ${perl}/bin"} \
-      --prefix PATH : ${pythonPackages.python}/bin \
-      --prefix PYTHONPATH : "$PYTHONPATH" \
-      --prefix PYTHONPATH : "$NIX_PYTHONPATH"
-  '';
-
-  meta = {
-    homepage = http://www.weechat.org/;
-    description = "A fast, light and extensible chat client";
-    license = stdenv.lib.licenses.gpl3;
-    maintainers = with stdenv.lib.maintainers; [ lovek323 garbas the-kenny ];
-    platforms = stdenv.lib.platforms.unix;
-  };
-}

krebs/5pkgs/simple/withGetopt.nix

@@ -0,0 +1,118 @@
+with import <stockholm/lib>;
+{ utillinux, writeDash }:
+
+opt-spec: cmd-spec: let
+
+  cmd = cmd-spec opts;
+
+  cmd-script =
+    if typeOf cmd == "set"
+      then "exec ${cmd}"
+      else cmd;
+
+  opts = mapAttrs (name: value: value // rec {
+    long = value.long or (replaceStrings ["_"] ["-"] name);
+    ref = value.ref or "\"\$${varname}\"";
+    short = value.short or null;
+    switch = value.switch or false;
+    varname = value.varname or (replaceStrings ["-"] ["_"] name);
+  }) opt-spec;
+
+  # true if b requires a to define its default value
+  opts-before = a: b:
+    test ".*[$]${stringAsChars (c: "[${c}]") a.varname}\\>.*" (b.default or "");
+
+  opts-list = let
+    sort-out = toposort opts-before (attrValues opts);
+  in
+    if sort-out ? result
+      then sort-out.result
+      else throw "toposort output: ${toJSON sort-out}";
+
+  wrapper-name =
+    if typeOf cmd == "set" && cmd ? name
+      then "${cmd.name}-getopt"
+      else "getopt-wrapper";
+
+in writeDash wrapper-name ''
+  set -efu
+
+  wrapper_name=${shell.escape wrapper-name}
+
+  ${concatStringsSep "\n" (mapAttrsToList (name: opt: /* sh */ ''
+    unset ${opt.varname}
+  '') opts)}
+
+  args=$(${utillinux}/bin/getopt \
+      -l ${shell.escape
+            (concatMapStringsSep ","
+              (opt: opt.long + optionalString (!opt.switch) ":")
+              (filter (opt: opt.long != null)
+                      (attrValues opts)))} \
+      -n "$wrapper_name" \
+      -o ${shell.escape
+            (concatMapStringsSep ""
+              (opt: opt.short + optionalString (!opt.switch) ":")
+              (filter (opt: opt.short != null)
+                      (attrValues opts)))} \
+      -s sh \
+      -- "$@")
+  if \test $? != 0; then exit 1; fi
+  eval set -- "$args"
+
+  while :; do
+    case $1 in
+    ${concatStringsSep "\n" (mapAttrsToList (name: opt: /* sh */ ''
+      (${concatMapStringsSep "|" shell.escape (filter (x: x != "") [
+        (optionalString (opt.long != null) "--${opt.long}")
+        (optionalString (opt.short != null) "-${opt.short}")
+      ])})
+        ${if opt.switch then /* sh */ ''
+          ${opt.varname}=true
+          shift
+        '' else /* sh */ ''
+          ${opt.varname}=$2
+          shift 2
+        ''}
+      ;;
+    '') (filterAttrs
+          (_: opt: opt.long != null || opt.short != null)
+          opts))}
+    --)
+      shift
+      break
+    esac
+  done
+
+  ${concatMapStringsSep "\n"
+    (opt: /* sh */ ''
+      if \test "''${${opt.varname}+1}" != 1; then
+        printf '%s: missing mandatory option '--%s'\n' \
+            "$wrapper_name" \
+            ${shell.escape opt.long}
+        error=1
+      fi
+    '')
+    (filter
+      (x: ! hasAttr "default" x)
+      (attrValues opts))}
+  if test "''${error+1}" = 1; then
+    exit 1
+  fi
+
+  ${concatMapStringsSep "\n"
+    (opt: /* sh */ ''
+      if \test "''${${opt.varname}+1}" != 1; then
+        ${opt.varname}=${opt.default}
+      fi
+    '')
+    (filter
+      (hasAttr "default")
+      opts-list)}
+
+  ${concatStringsSep "\n" (mapAttrsToList (name: opt: /* sh */ ''
+    export ${opt.varname}
+  '') opts)}
+
+  ${cmd-script} "$@"
+''

lass/1systems/archprism/config.nix

@@ -0,0 +1,333 @@
+{ config, lib, pkgs, ... }:
+with import <stockholm/lib>;
+
+let
+  ip = config.krebs.build.host.nets.internet.ip4.addr;
+
+in {
+  imports = [
+    <stockholm/lass>
+    {
+      networking.interfaces.et0.ip4 = [
+        {
+          address = ip;
+          prefixLength = 24;
+        }
+      ];
+      networking.defaultGateway = "213.239.205.225";
+      networking.nameservers = [
+        "8.8.8.8"
+      ];
+      services.udev.extraRules = ''
+        SUBSYSTEM=="net", ATTR{address}=="54:04:a6:7e:f4:06", NAME="et0"
+      '';
+    }
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/exim-smarthost.nix>
+    #<stockholm/lass/2configs/downloading.nix>
+    <stockholm/lass/2configs/ts3.nix>
+    <stockholm/lass/2configs/bitlbee.nix>
+    <stockholm/lass/2configs/weechat.nix>
+    <stockholm/lass/2configs/privoxy-retiolum.nix>
+    <stockholm/lass/2configs/radio.nix>
+    <stockholm/lass/2configs/repo-sync.nix>
+    <stockholm/lass/2configs/binary-cache/server.nix>
+    <stockholm/lass/2configs/iodined.nix>
+    <stockholm/lass/2configs/libvirt.nix>
+    <stockholm/lass/2configs/hfos.nix>
+    <stockholm/lass/2configs/monitoring/server.nix>
+    <stockholm/lass/2configs/monitoring/monit-alarms.nix>
+    <stockholm/lass/2configs/paste.nix>
+    <stockholm/lass/2configs/syncthing.nix>
+    #<stockholm/lass/2configs/reaktor-coders.nix>
+    <stockholm/lass/2configs/ciko.nix>
+    <stockholm/lass/2configs/container-networking.nix>
+    #<stockholm/lass/2configs/reaktor-krebs.nix>
+    #{
+    #  lass.pyload.enable = true;
+    #}
+    {
+      imports = [
+        <stockholm/lass/2configs/bepasty.nix>
+      ];
+      krebs.bepasty.servers."paste.r".nginx.extraConfig = ''
+        if ( $server_addr = "${config.krebs.build.host.nets.internet.ip4.addr}" ) {
+          return 403;
+        }
+      '';
+    }
+    {
+      users.extraGroups = {
+        # ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories
+        #    Loaded: loaded (/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/example/systemd/system/systemd-tmpfiles-setup.service)
+        #    Active: failed (Result: exit-code) since Mon 2015-03-16 10:29:18 UTC; 4s ago
+        #      Docs: man:tmpfiles.d(5)
+        #            man:systemd-tmpfiles(8)
+        #   Process: 19272 ExecStart=/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev (code=exited, status=1/FAILURE)
+        #  Main PID: 19272 (code=exited, status=1/FAILURE)
+        #
+        # Mar 16 10:29:17 cd systemd-tmpfiles[19272]: [/usr/lib/tmpfiles.d/legacy.conf:26] Unknown group 'lock'.
+        # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal configured, ignoring.
+        # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal/7b35116927d74ea58785e00b47ac0f0d configured, ignoring.
+        # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service: main process exited, code=exited, status=1/FAILURE
+        # Mar 16 10:29:18 cd systemd[1]: Failed to start Create Volatile Files and Directories.
+        # Mar 16 10:29:18 cd systemd[1]: Unit systemd-tmpfiles-setup.service entered failed state.
+        # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service failed.
+        # warning: error(s) occured while switching to the new configuration
+        lock.gid = 10001;
+      };
+    }
+    {
+      boot.loader.grub = {
+        devices = [
+          "/dev/sda"
+          "/dev/sdb"
+        ];
+        splashImage = null;
+      };
+
+      boot.initrd.availableKernelModules = [
+        "ata_piix"
+        "vmw_pvscsi"
+      ];
+
+      fileSystems."/" = {
+        device = "/dev/pool/nix";
+        fsType = "ext4";
+      };
+
+      fileSystems."/boot" = {
+        device = "/dev/disk/by-uuid/7ca12d8c-606d-41ce-b10d-62b654e50e36";
+      };
+
+      fileSystems."/var/download" = {
+        device = "/dev/pool/download";
+      };
+
+      fileSystems."/srv/http" = {
+        device = "/dev/pool/http";
+      };
+
+      fileSystems."/srv/o.ubikmedia.de-data" = {
+        device = "/dev/pool/owncloud-ubik-data";
+      };
+
+      fileSystems."/bku" = {
+        device = "/dev/pool/bku";
+      };
+
+      fileSystems."/tmp" = {
+        device = "tmpfs";
+        fsType = "tmpfs";
+        options = ["nosuid" "nodev" "noatime"];
+      };
+
+    }
+    {
+      sound.enable = false;
+    }
+    {
+      nixpkgs.config.allowUnfree = true;
+    }
+    {
+      #stuff for juhulian
+      users.extraUsers.juhulian = {
+        name = "juhulian";
+        uid = 1339;
+        home = "/home/juhulian";
+        group = "users";
+        createHome = true;
+        useDefaultShell = true;
+        extraGroups = [
+        ];
+        openssh.authorizedKeys.keys = [
+          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBQhLGvfv4hyQ/nqJGy1YgHXPSVl6igeWTroJSvAhUFgoh+rG+zvqY0EahKXNb3sq0/OYDCTJVuucc0hgCg7T2KqTqMtTb9EEkRmCFbD7F7DWZojCrh/an6sHneqT5eFvzAPZ8E5hup7oVQnj5P5M3I9keRHBWt1rq6q0IcOEhsFvne4qJc73aLASTJkxzlo5U8ju3JQOl6474ECuSn0lb1fTrQ/SR1NgF7jV11eBldkS8SHEB+2GXjn4Yrn+QUKOnDp+B85vZmVlJSI+7XR1/U/xIbtAjGTEmNwB6cTbBv9NCG9jloDDOZG4ZvzzHYrlBXjaigtQh2/4mrHoKa5eV juhulian@juhulian"
+        ];
+      };
+      krebs.iptables.tables.filter.INPUT.rules = [
+        { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT";}
+      ];
+    }
+    {
+      environment.systemPackages = [
+        pkgs.perlPackages.Plack
+      ];
+      krebs.iptables.tables.filter.INPUT.rules = [
+        { predicate = "-p tcp --dport 8080"; target = "ACCEPT";}
+      ];
+    }
+    {
+      users.users.chat.openssh.authorizedKeys.keys = [
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDjesiOnhpT9XgWZqw/64M5lVQg3q0k22BtMyCv+33sGX8VmfTyD11GuwSjNGf5WiswKLqFvYBQsHfDDtS3k0ZNTDncGw3Pbilm6QoCuHEyDPaQYin0P+JmkocrL/6QF5uhZVFnsXCH5wntwOa00VFGwpMgQYSfRlReRx42Pu9Jk+iJduZMRBbOMvJI68Z7iJ4DgW/1U9J4MQdCsk7QlFgUstQQfV1zk4VfVfXuxDP3hjx6Q05nDChjpmzJbFunzb7aiy/1/Sl0QhROTpvxrQLksg7yYLw4BRs9ptjehX45A2Sxi8WKOb/g5u3xJNy0X07rE+N+o5v2hS7wF0DLQdK5+4TGtO+Y+ABUCqqA+T1ynAjNBWvsgY5uD4PZjuPgCMSw0JBmIy/P0THi3v5/8Cohvfnspl7Jpf80qENMu3unvvE9EePzgSRZY1PvDjPQfkWy0yBX1yQMhHuVGke9QgaletitwuahRujml37waeUuOl8Rpz+2iV+6OIS4tfO368uLFHKWbobXTbTDXODBgxZ/IyvO7vxM2uDX/kIWaeYKrip3nSyWBYnixwrcS4vm6ZQcoejwp2KCfGQwIE4MnGYRlwcOEYjvyjLkZHDiZEivUQ0rThMYBzec8bQ08QW8oxF+NXkFKG3awt3f7TKTRkYqQcOMpFKmV24KDiwgwm0miQ== JuiceSSH"
+      ];
+    }
+    {
+      time.timeZone = "Europe/Berlin";
+    }
+    {
+      imports = [
+        <stockholm/lass/2configs/websites/domsen.nix>
+        <stockholm/lass/2configs/websites/lassulus.nix>
+      ];
+      krebs.iptables.tables.filter.INPUT.rules = [
+         { predicate = "-p tcp --dport http"; target = "ACCEPT"; }
+         { predicate = "-p tcp --dport https"; target = "ACCEPT"; }
+      ];
+    }
+    {
+      services.tor = {
+        enable = true;
+      };
+    }
+    {
+      lass.ejabberd = {
+        enable = true;
+        hosts = [ "lassul.us" ];
+      };
+      krebs.iptables.tables.filter.INPUT.rules = [
+        { predicate = "-p tcp --dport xmpp-client"; target = "ACCEPT"; }
+        { predicate = "-p tcp --dport xmpp-server"; target = "ACCEPT"; }
+      ];
+    }
+    {
+      imports = [
+        <stockholm/lass/2configs/realwallpaper.nix>
+      ];
+      services.nginx.virtualHosts."lassul.us".locations."/wallpaper.png".extraConfig = ''
+        alias /var/realwallpaper/realwallpaper.png;
+      '';
+    }
+    {
+      environment.systemPackages = with pkgs; [
+        mk_sql_pair
+      ];
+    }
+    {
+      users.users.tv = {
+        uid = genid "tv";
+        inherit (config.krebs.users.tv) home;
+        group = "users";
+        createHome = true;
+        useDefaultShell = true;
+        openssh.authorizedKeys.keys = [
+          config.krebs.users.tv.pubkey
+        ];
+      };
+      users.users.makefu = {
+        uid = genid "makefu";
+        isNormalUser = true;
+        openssh.authorizedKeys.keys = [
+          config.krebs.users.makefu.pubkey
+        ];
+      };
+      users.users.nin = {
+        uid = genid "nin";
+        inherit (config.krebs.users.nin) home;
+        group = "users";
+        createHome = true;
+        useDefaultShell = true;
+        openssh.authorizedKeys.keys = [
+          config.krebs.users.nin.pubkey
+        ];
+        extraGroups = [
+          "libvirtd"
+        ];
+      };
+    }
+    {
+      krebs.repo-sync.timerConfig = {
+        OnBootSec = "15min";
+        OnUnitInactiveSec = "90min";
+        RandomizedDelaySec = "30min";
+      };
+      krebs.repo-sync.repos.stockholm.timerConfig = {
+        OnBootSec = "5min";
+        OnUnitInactiveSec = "2min";
+        RandomizedDelaySec = "2min";
+      };
+    }
+    {
+      lass.usershadow = {
+        enable = true;
+      };
+    }
+    #{
+    #  krebs.Reaktor.prism = {
+    #    nickname = "Reaktor|lass";
+    #    channels = [ "#retiolum" ];
+    #    extraEnviron = {
+    #      REAKTOR_HOST = "ni.r";
+    #    };
+    #    plugins = with pkgs.ReaktorPlugins; [
+    #      sed-plugin
+    #    ];
+    #  };
+    #}
+    {
+      #stuff for dritter
+      users.extraUsers.dritter = {
+        name = "dritter";
+        uid = genid "dritter";
+        home = "/home/dritter";
+        group = "users";
+        createHome = true;
+        useDefaultShell = true;
+        extraGroups = [
+          "download"
+        ];
+        openssh.authorizedKeys.keys = [
+          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnqOWDDk7QkSAvrSLkEoz7dY22+xPyv5JDn2zlfUndfavmTMfZvPx9REMjgULbcCSM4m3Ncf40yUjciDpVleGoEz82+p/ObHAkVWPQyXRS3ZRM2IJJultBHEFc61+61Pi8k3p5pBhPPaig6VncJ4uUuuNqen9jqLesSTVXNtdntU2IvnC8B8k1Kq6fu9q1T2yEOMxkD31D5hVHlqAly0LdRiYvtsRIoCSmRvlpGl70uvPprhQxhtoiEUeDqmIL7BG9x7gU0Swdl7R0/HtFXlFuOwSlNYDmOf/Zrb1jhOpj4AlCliGUkM0iKIJhgH0tnJna6kfkGKHDwuzITGIh6SpZ dritter@Janeway"
+        ];
+      };
+    }
+    {
+      #hotdog
+      containers.hotdog = {
+        config = { ... }: {
+          services.openssh.enable = true;
+          users.users.root.openssh.authorizedKeys.keys = [
+            config.krebs.users.lass.pubkey
+          ];
+        };
+        enableTun = true;
+        privateNetwork = true;
+        hostAddress = "10.233.2.1";
+        localAddress = "10.233.2.2";
+      };
+    }
+    {
+      #kaepsele
+      containers.kaepsele = {
+        config = { ... }: {
+          services.openssh.enable = true;
+          users.users.root.openssh.authorizedKeys.keys = with config.krebs.users; [
+            lass.pubkey
+            tv.pubkey
+          ];
+        };
+        enableTun = true;
+        privateNetwork = true;
+        hostAddress = "10.233.2.3";
+        localAddress = "10.233.2.4";
+      };
+    }
+    {
+      #onondaga
+      containers.onondaga = {
+        config = { ... }: {
+          services.openssh.enable = true;
+          users.users.root.openssh.authorizedKeys.keys = [
+            config.krebs.users.lass.pubkey
+            config.krebs.users.nin.pubkey
+          ];
+        };
+        enableTun = true;
+        privateNetwork = true;
+        hostAddress = "10.233.2.4";
+        localAddress = "10.233.2.5";
+      };
+    }
+  ];
+
+  krebs.build.host = config.krebs.hosts.archprism;
+}

lass/1systems/archprism/source.nix

@@ -0,0 +1,3 @@
+import <stockholm/lass/source.nix> {
+  name = "archprism";
+}

lass/1systems/helios/config.nix

@@ -11,7 +11,6 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/retiolum.nix>
     <stockholm/lass/2configs/otp-ssh.nix>
     <stockholm/lass/2configs/git.nix>
-    <stockholm/lass/2configs/fetchWallpaper.nix>
     { # automatic hardware detection
       boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
       boot.kernelModules = [ "kvm-intel" ];
@@ -47,6 +46,16 @@ with import <stockholm/lib>;
       fonts.fontconfig.dpi = 200;
       lass.myFont = "-schumacher-clean-*-*-*-*-25-*-*-*-*-*-iso10646-1";
     }
+    { #TAPIR, AGATIS, sentral, a3 - foo
+      services.redis.enable = true;
+    }
+    {
+      krebs.fetchWallpaper = {
+        enable = true;
+        url = "http://i.imgur.com/0ktqxSg.png";
+        maxTime = 9001;
+      };
+    }
   ];
   krebs.build.host = config.krebs.hosts.helios;
 
@@ -66,6 +75,7 @@ with import <stockholm/lib>;
   hardware.enableRedistributableFirmware = true;
 
   environment.systemPackages = with pkgs; [
+    ag
     vim
     rxvt_unicode
     git

lass/1systems/prism/config.nix

@@ -11,73 +11,20 @@ in {
       networking.interfaces.et0.ip4 = [
         {
           address = ip;
-          prefixLength = 24;
+          prefixLength = 27;
         }
       ];
-      networking.defaultGateway = "213.239.205.225";
+      networking.defaultGateway = "46.4.114.225";
       networking.nameservers = [
         "8.8.8.8"
       ];
       services.udev.extraRules = ''
-        SUBSYSTEM=="net", ATTR{address}=="54:04:a6:7e:f4:06", NAME="et0"
+        SUBSYSTEM=="net", ATTR{address}=="08:60:6e:e7:87:04", NAME="et0"
-      '';
-    }
-    <stockholm/lass/2configs/retiolum.nix>
-    <stockholm/lass/2configs/exim-smarthost.nix>
-    <stockholm/lass/2configs/downloading.nix>
-    <stockholm/lass/2configs/ts3.nix>
-    <stockholm/lass/2configs/bitlbee.nix>
-    <stockholm/lass/2configs/weechat.nix>
-    <stockholm/lass/2configs/privoxy-retiolum.nix>
-    <stockholm/lass/2configs/radio.nix>
-    <stockholm/lass/2configs/repo-sync.nix>
-    <stockholm/lass/2configs/binary-cache/server.nix>
-    <stockholm/lass/2configs/iodined.nix>
-    <stockholm/lass/2configs/libvirt.nix>
-    <stockholm/lass/2configs/hfos.nix>
-    <stockholm/lass/2configs/monitoring/server.nix>
-    <stockholm/lass/2configs/monitoring/monit-alarms.nix>
-    <stockholm/lass/2configs/paste.nix>
-    <stockholm/lass/2configs/syncthing.nix>
-    <stockholm/lass/2configs/reaktor-coders.nix>
-    <stockholm/lass/2configs/ciko.nix>
-    <stockholm/lass/2configs/container-networking.nix>
-    <stockholm/lass/2configs/reaktor-krebs.nix>
-    {
-      lass.pyload.enable = true;
-    }
-    {
-      imports = [
-        <stockholm/lass/2configs/bepasty.nix>
-      ];
-      krebs.bepasty.servers."paste.r".nginx.extraConfig = ''
-        if ( $server_addr = "${config.krebs.build.host.nets.internet.ip4.addr}" ) {
-          return 403;
-        }
       '';
     }
     {
-      users.extraGroups = {
+      imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
-        # ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories
+
-        #    Loaded: loaded (/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/example/systemd/system/systemd-tmpfiles-setup.service)
-        #    Active: failed (Result: exit-code) since Mon 2015-03-16 10:29:18 UTC; 4s ago
-        #      Docs: man:tmpfiles.d(5)
-        #            man:systemd-tmpfiles(8)
-        #   Process: 19272 ExecStart=/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev (code=exited, status=1/FAILURE)
-        #  Main PID: 19272 (code=exited, status=1/FAILURE)
-        #
-        # Mar 16 10:29:17 cd systemd-tmpfiles[19272]: [/usr/lib/tmpfiles.d/legacy.conf:26] Unknown group 'lock'.
-        # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal configured, ignoring.
-        # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal/7b35116927d74ea58785e00b47ac0f0d configured, ignoring.
-        # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service: main process exited, code=exited, status=1/FAILURE
-        # Mar 16 10:29:18 cd systemd[1]: Failed to start Create Volatile Files and Directories.
-        # Mar 16 10:29:18 cd systemd[1]: Unit systemd-tmpfiles-setup.service entered failed state.
-        # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service failed.
-        # warning: error(s) occured while switching to the new configuration
-        lock.gid = 10001;
-      };
-    }
-    {
       boot.loader.grub = {
         devices = [
           "/dev/sda"
@@ -89,126 +36,98 @@ in {
       boot.initrd.availableKernelModules = [
         "ata_piix"
         "vmw_pvscsi"
+        "ahci" "sd_mod"
       ];
 
+      boot.kernelModules = [ "kvm-intel" ];
+
       fileSystems."/" = {
-        device = "/dev/pool/nix";
+        device = "/dev/pool/nix_root";
         fsType = "ext4";
       };
 
-      fileSystems."/boot" = {
-        device = "/dev/disk/by-uuid/7ca12d8c-606d-41ce-b10d-62b654e50e36";
-      };
-
-      fileSystems."/var/download" = {
-        device = "/dev/pool/download";
-      };
-
-      fileSystems."/srv/http" = {
-        device = "/dev/pool/http";
-      };
-
-      fileSystems."/srv/o.ubikmedia.de-data" = {
-        device = "/dev/pool/owncloud-ubik-data";
-      };
-
-      fileSystems."/bku" = {
-        device = "/dev/pool/bku";
-      };
-
       fileSystems."/tmp" = {
         device = "tmpfs";
         fsType = "tmpfs";
         options = ["nosuid" "nodev" "noatime"];
       };
 
-    }
+      fileSystems."/var/download" = {
-    {
+        device = "/dev/pool/download";
-      sound.enable = false;
+        fsType = "ext4";
-    }
-    {
-      nixpkgs.config.allowUnfree = true;
-    }
-    {
-      #stuff for juhulian
-      users.extraUsers.juhulian = {
-        name = "juhulian";
-        uid = 1339;
-        home = "/home/juhulian";
-        group = "users";
-        createHome = true;
-        useDefaultShell = true;
-        extraGroups = [
-        ];
-        openssh.authorizedKeys.keys = [
-          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBQhLGvfv4hyQ/nqJGy1YgHXPSVl6igeWTroJSvAhUFgoh+rG+zvqY0EahKXNb3sq0/OYDCTJVuucc0hgCg7T2KqTqMtTb9EEkRmCFbD7F7DWZojCrh/an6sHneqT5eFvzAPZ8E5hup7oVQnj5P5M3I9keRHBWt1rq6q0IcOEhsFvne4qJc73aLASTJkxzlo5U8ju3JQOl6474ECuSn0lb1fTrQ/SR1NgF7jV11eBldkS8SHEB+2GXjn4Yrn+QUKOnDp+B85vZmVlJSI+7XR1/U/xIbtAjGTEmNwB6cTbBv9NCG9jloDDOZG4ZvzzHYrlBXjaigtQh2/4mrHoKa5eV juhulian@juhulian"
-        ];
       };
-      krebs.iptables.tables.filter.INPUT.rules = [
+
-        { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT";}
+      fileSystems."/srv/http" = {
+        device = "/dev/pool/http";
+        fsType = "ext4";
+      };
+
+      fileSystems."/home" = {
+        device = "/dev/pool/home";
+        fsType = "ext4";
+      };
+
+      swapDevices = [
+        { label = "swap1"; }
+        { label = "swap2"; }
       ];
-    }
+
-    {
+      sound.enable = false;
-      environment.systemPackages = [
+      nixpkgs.config.allowUnfree = true;
-        pkgs.perlPackages.Plack
-      ];
-      krebs.iptables.tables.filter.INPUT.rules = [
-        { predicate = "-p tcp --dport 8080"; target = "ACCEPT";}
-      ];
-    }
-    {
-      users.users.chat.openssh.authorizedKeys.keys = [
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDjesiOnhpT9XgWZqw/64M5lVQg3q0k22BtMyCv+33sGX8VmfTyD11GuwSjNGf5WiswKLqFvYBQsHfDDtS3k0ZNTDncGw3Pbilm6QoCuHEyDPaQYin0P+JmkocrL/6QF5uhZVFnsXCH5wntwOa00VFGwpMgQYSfRlReRx42Pu9Jk+iJduZMRBbOMvJI68Z7iJ4DgW/1U9J4MQdCsk7QlFgUstQQfV1zk4VfVfXuxDP3hjx6Q05nDChjpmzJbFunzb7aiy/1/Sl0QhROTpvxrQLksg7yYLw4BRs9ptjehX45A2Sxi8WKOb/g5u3xJNy0X07rE+N+o5v2hS7wF0DLQdK5+4TGtO+Y+ABUCqqA+T1ynAjNBWvsgY5uD4PZjuPgCMSw0JBmIy/P0THi3v5/8Cohvfnspl7Jpf80qENMu3unvvE9EePzgSRZY1PvDjPQfkWy0yBX1yQMhHuVGke9QgaletitwuahRujml37waeUuOl8Rpz+2iV+6OIS4tfO368uLFHKWbobXTbTDXODBgxZ/IyvO7vxM2uDX/kIWaeYKrip3nSyWBYnixwrcS4vm6ZQcoejwp2KCfGQwIE4MnGYRlwcOEYjvyjLkZHDiZEivUQ0rThMYBzec8bQ08QW8oxF+NXkFKG3awt3f7TKTRkYqQcOMpFKmV24KDiwgwm0miQ== JuiceSSH"
-      ];
-    }
-    {
       time.timeZone = "Europe/Berlin";
     }
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/libvirt.nix>
     {
+      services.nginx.enable = true;
       imports = [
         <stockholm/lass/2configs/websites/domsen.nix>
         <stockholm/lass/2configs/websites/lassulus.nix>
       ];
+      # needed by domsen.nix ^^
+      lass.usershadow = {
+        enable = true;
+      };
+
       krebs.iptables.tables.filter.INPUT.rules = [
          { predicate = "-p tcp --dport http"; target = "ACCEPT"; }
          { predicate = "-p tcp --dport https"; target = "ACCEPT"; }
       ];
     }
-    {
+    { # TODO make new hfos.nix out of this vv
-      services.tor = {
+      users.users.riot = {
-        enable = true;
+        uid = genid "riot";
-      };
+        isNormalUser = true;
-    }
+        extraGroups = [ "libvirtd" ];
-    {
+        openssh.authorizedKeys.keys = [
-      lass.ejabberd = {
+          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
-        enable = true;
-        hosts = [ "lassul.us" ];
-      };
-      krebs.iptables.tables.filter.INPUT.rules = [
-        { predicate = "-p tcp --dport xmpp-client"; target = "ACCEPT"; }
-        { predicate = "-p tcp --dport xmpp-server"; target = "ACCEPT"; }
         ];
-    }
+      };
-    {
+
-      imports = [
+      # TODO write function for proxy_pass (ssl/nonssl)
-        <stockholm/lass/2configs/realwallpaper.nix>
+      services.nginx.virtualHosts."hackerfleet.de" = {
+        serverAliases = [
+          "*.hackerfleet.de"
         ];
-      services.nginx.virtualHosts."lassul.us".locations."/wallpaper.png".extraConfig = ''
+        locations."/".extraConfig = ''
-        alias /var/realwallpaper/realwallpaper.png;
+          proxy_pass http://192.168.122.92:80;
         '';
-    }
+      };
-    {
+      services.nginx.virtualHosts."hackerfleet.de-s" = {
-      environment.systemPackages = with pkgs; [
+        serverName = "hackerfleet.de";
-        mk_sql_pair
+        port = 443;
+        serverAliases = [
+          "*.hackerfleet.de"
         ];
+        locations."/".extraConfig = ''
+          proxy_pass http://192.168.122.92:443;
+        '';
+      };
     }
     {
       users.users.tv = {
         uid = genid "tv";
-        inherit (config.krebs.users.tv) home;
+        isNormalUser = true;
-        group = "users";
-        createHome = true;
-        useDefaultShell = true;
         openssh.authorizedKeys.keys = [
           config.krebs.users.tv.pubkey
         ];
@@ -222,56 +141,14 @@ in {
       };
       users.users.nin = {
         uid = genid "nin";
-        inherit (config.krebs.users.nin) home;
+        isNormalUser = true;
-        group = "users";
-        createHome = true;
-        useDefaultShell = true;
         openssh.authorizedKeys.keys = [
           config.krebs.users.nin.pubkey
         ];
-        extraGroups = [
-          "libvirtd"
-        ];
       };
-    }
-    {
-      krebs.repo-sync.timerConfig = {
-        OnBootSec = "15min";
-        OnUnitInactiveSec = "90min";
-        RandomizedDelaySec = "30min";
-      };
-      krebs.repo-sync.repos.stockholm.timerConfig = {
-        OnBootSec = "5min";
-        OnUnitInactiveSec = "2min";
-        RandomizedDelaySec = "2min";
-      };
-    }
-    {
-      lass.usershadow = {
-        enable = true;
-      };
-    }
-    {
-      krebs.Reaktor.prism = {
-        nickname = "Reaktor|lass";
-        channels = [ "#retiolum" ];
-        extraEnviron = {
-          REAKTOR_HOST = "ni.r";
-        };
-        plugins = with pkgs.ReaktorPlugins; [
-          sed-plugin
-        ];
-      };
-    }
-    {
-      #stuff for dritter
       users.extraUsers.dritter = {
-        name = "dritter";
         uid = genid "dritter";
-        home = "/home/dritter";
+        isNormalUser = true;
-        group = "users";
-        createHome = true;
-        useDefaultShell = true;
         extraGroups = [
           "download"
         ];
@@ -279,6 +156,13 @@ in {
           "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnqOWDDk7QkSAvrSLkEoz7dY22+xPyv5JDn2zlfUndfavmTMfZvPx9REMjgULbcCSM4m3Ncf40yUjciDpVleGoEz82+p/ObHAkVWPQyXRS3ZRM2IJJultBHEFc61+61Pi8k3p5pBhPPaig6VncJ4uUuuNqen9jqLesSTVXNtdntU2IvnC8B8k1Kq6fu9q1T2yEOMxkD31D5hVHlqAly0LdRiYvtsRIoCSmRvlpGl70uvPprhQxhtoiEUeDqmIL7BG9x7gU0Swdl7R0/HtFXlFuOwSlNYDmOf/Zrb1jhOpj4AlCliGUkM0iKIJhgH0tnJna6kfkGKHDwuzITGIh6SpZ dritter@Janeway"
         ];
       };
+      users.extraUsers.juhulian = {
+        uid = 1339;
+        isNormalUser = true;
+        openssh.authorizedKeys.keys = [
+          "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBQhLGvfv4hyQ/nqJGy1YgHXPSVl6igeWTroJSvAhUFgoh+rG+zvqY0EahKXNb3sq0/OYDCTJVuucc0hgCg7T2KqTqMtTb9EEkRmCFbD7F7DWZojCrh/an6sHneqT5eFvzAPZ8E5hup7oVQnj5P5M3I9keRHBWt1rq6q0IcOEhsFvne4qJc73aLASTJkxzlo5U8ju3JQOl6474ECuSn0lb1fTrQ/SR1NgF7jV11eBldkS8SHEB+2GXjn4Yrn+QUKOnDp+B85vZmVlJSI+7XR1/U/xIbtAjGTEmNwB6cTbBv9NCG9jloDDOZG4ZvzzHYrlBXjaigtQh2/4mrHoKa5eV juhulian@juhulian"
+        ];
+      };
     }
     {
       #hotdog
@@ -327,7 +211,60 @@ in {
         localAddress = "10.233.2.5";
       };
     }
+    <stockholm/lass/2configs/exim-smarthost.nix>
+    <stockholm/lass/2configs/ts3.nix>
+    <stockholm/lass/2configs/bitlbee.nix>
+    <stockholm/lass/2configs/weechat.nix>
+    <stockholm/lass/2configs/privoxy-retiolum.nix>
+    <stockholm/lass/2configs/radio.nix>
+    <stockholm/lass/2configs/repo-sync.nix>
+    <stockholm/lass/2configs/binary-cache/server.nix>
+    <stockholm/lass/2configs/iodined.nix>
+    <stockholm/lass/2configs/monitoring/server.nix>
+    <stockholm/lass/2configs/monitoring/monit-alarms.nix>
+    <stockholm/lass/2configs/paste.nix>
+    <stockholm/lass/2configs/syncthing.nix>
+    <stockholm/lass/2configs/reaktor-coders.nix>
+    <stockholm/lass/2configs/reaktor-krebs.nix>
+    <stockholm/lass/2configs/reaktor-retiolum.nix>
+    <stockholm/lass/2configs/ciko.nix>
+    <stockholm/lass/2configs/container-networking.nix>
+    { # quasi bepasty.nix
+      imports = [
+        <stockholm/lass/2configs/bepasty.nix>
+      ];
+      krebs.bepasty.servers."paste.r".nginx.extraConfig = ''
+        if ( $server_addr = "${config.krebs.build.host.nets.internet.ip4.addr}" ) {
+          return 403;
+        }
+      '';
+    }
+    {
+      services.tor = {
+        enable = true;
+      };
+    }
+    {
+      lass.ejabberd = {
+        enable = true;
+        hosts = [ "lassul.us" ];
+      };
+      krebs.iptables.tables.filter.INPUT.rules = [
+        { predicate = "-p tcp --dport xmpp-client"; target = "ACCEPT"; }
+        { predicate = "-p tcp --dport xmpp-server"; target = "ACCEPT"; }
+      ];
+    }
+    {
+      imports = [
+        <stockholm/lass/2configs/realwallpaper.nix>
+      ];
+      services.nginx.virtualHosts."lassul.us".locations."/wallpaper.png".extraConfig = ''
+        alias /var/realwallpaper/realwallpaper.png;
+      '';
+    }
   ];
 
   krebs.build.host = config.krebs.hosts.prism;
+  # workaround because grub store paths are broken
+  boot.copyKernels = true;
 }

lass/1systems/prism/source.nix

@@ -1,3 +1,4 @@
+with import <stockholm/lib>;
 import <stockholm/lass/source.nix> {
   name = "prism";
 }

lass/2configs/baseX.nix

@@ -79,6 +79,7 @@ in {
     youtube-tools
 
     rxvt_unicode
+    termite
   ];
 
   fonts.fonts = [

lass/2configs/binary-cache/client.nix

@@ -8,6 +8,7 @@
     ];
     binaryCachePublicKeys = [
       "cache.prism-1:+S+6Lo/n27XEtvdlQKuJIcb1yO5NUqUCE2lolmTgNJU="
+      "cache.prism-2:YwmCm3/s/D+SxrPKN/ETjlpw/219pNUbpnluatp6FKI="
       "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs="
     ];
   };

lass/2configs/exim-smarthost.nix

@@ -43,6 +43,8 @@ with import <stockholm/lib>;
       { from = "radio@lassul.us"; to = lass.mail; }
       { from = "btce@lassul.us"; to = lass.mail; }
       { from = "raf@lassul.us"; to = lass.mail; }
+      { from = "apple@lassul.us"; to = lass.mail; }
+      { from = "coinbase@lassul.us"; to = lass.mail; }
     ];
     system-aliases = [
       { from = "mailer-daemon"; to = "postmaster"; }

lass/2configs/git.nix

@@ -53,6 +53,10 @@ let
       cgit.desc = "Good Music collection + tools";
       cgit.section  = "art";
     };
+    nix-user-chroot = {
+      cgit.desc = "Fork of nix-user-chroot my lethalman";
+      cgit.section = "software";
+    };
   } // mapAttrs make-public-repo-silent {
   };
 
@@ -73,8 +77,8 @@ let
       post-receive = pkgs.git-hooks.irc-announce {
         # TODO make nick = config.krebs.build.host.name the default
         nick = config.krebs.build.host.name;
-        channel = "#retiolum";
+        channel = "#xxx";
-        server = "ni.r";
+        server = "irc.r";
         verbose = config.krebs.build.host.name == "prism";
         # TODO define branches in some kind of option per repo
         branches = [ "master" "staging*" ];
@@ -94,8 +98,8 @@ let
       post-receive = pkgs.git-hooks.irc-announce {
         # TODO make nick = config.krebs.build.host.name the default
         nick = config.krebs.build.host.name;
-        channel = "#retiolum";
+        channel = "#xxx";
-        server = "ni.r";
+        server = "irc.r";
         verbose = true;
         # TODO define branches in some kind of option per repo
         branches = [ "master" "staging*" ];

lass/2configs/monitoring/monit-alarms.nix

@@ -6,7 +6,7 @@ let
       set -euf
       export LOGNAME=prism-alarm
       ${pkgs.irc-announce}/bin/irc-announce \
-        ni.r 6667 ${config.networking.hostName}-alarm \#noise "${msg}" >/dev/null
+        irc.r 6667 ${config.networking.hostName}-alarm \#noise "${msg}" >/dev/null
     '';
 
 in {

lass/2configs/monitoring/server.nix

@@ -29,7 +29,7 @@ with import <stockholm/lib>;
         data="$(${pkgs.jq}/bin/jq -r .message)"
         export LOGNAME=prism-alarm
         ${pkgs.irc-announce}/bin/irc-announce \
-          ni.r 6667 prism-alarm \#noise "$data" >/dev/null
+          irc.r 6667 prism-alarm \#noise "$data" >/dev/null
       '';
     in {
       enable = true;

lass/2configs/reaktor-retiolum.nix

@@ -0,0 +1,15 @@
+{ config, lib, pkgs, ... }:
+with import <stockholm/lib>;
+
+{
+  krebs.Reaktor.retiolum = {
+    nickname = "Reaktor|lass";
+    channels = [ "#xxx" ];
+    extraEnviron = {
+      REAKTOR_HOST = "irc.r";
+    };
+    plugins = with pkgs.ReaktorPlugins; [
+      sed-plugin
+    ];
+  };
+}

lass/2configs/repo-sync.nix

@@ -15,8 +15,8 @@ let
         post-receive = pkgs.git-hooks.irc-announce {
           nick = config.networking.hostName;
           verbose = false;
-          channel = "#retiolum";
+          channel = "#xxx";
-          server = "ni.r";
+          server = "irc.r";
           branches = [ "newest" ];
         };
       });

lass/2configs/vim.nix

@@ -5,7 +5,7 @@ let
   out = {
     environment.systemPackages = [
       (hiPrio vim)
-      pkgs.pythonPackages.flake8
+      pkgs.python35Packages.flake8
     ];
 
     environment.etc.vimrc.source = vimrc;
@@ -104,6 +104,7 @@ let
     pkgs.vimPlugins.Gundo
     pkgs.vimPlugins.Syntastic
     pkgs.vimPlugins.undotree
+    pkgs.vimPlugins.vim-go
     (pkgs.vimUtils.buildVimPlugin {
       name = "file-line-1.0";
       src = pkgs.fetchFromGitHub {

lass/5pkgs/acronym/default.nix

@@ -6,7 +6,7 @@ pkgs.writeScriptBin "acronym" ''
 
   acro=$1
 
-  curl -s http://www.acronymfinder.com/$acro.html \
+  curl -L -s http://www.acronymfinder.com/$acro.html \
     | grep 'class="result-list__body__rank"' \
     | sed '
       s/.*title="\([^"]*\)".*/\1/

lass/5pkgs/xmonad-lass.nix

@@ -115,6 +115,7 @@ myKeyMap =
     , ("M4-<Esc>", toggleWS)
     , ("M4-S-<Enter>", spawn urxvtcPath)
     , ("M4-x", floatNext True >> spawn urxvtcPath)
+    , ("M4-c", floatNext True >> spawn "${pkgs.termite}/bin/termite")
     , ("M4-f", floatNext True)
     , ("M4-b", sendMessage ToggleStruts)
 

lib/shell.nix

@@ -7,10 +7,13 @@ rec {
     let
       isSafeChar = testString "[-+./0-9:=A-Z_a-z]";
     in
-    stringAsChars (c:
+      x:
+        if x == "" then "''"
+        else stringAsChars (c:
           if isSafeChar c then c
           else if c == "\n" then "'\n'"
-      else "\\${c}");
+          else "\\${c}"
+        ) x;
 
   #
   # shell script generators

makefu/1systems/cake/config.nix

@@ -0,0 +1,20 @@
+{ config, pkgs, ... }:
+{
+    imports = [
+        <stockholm/makefu>
+        # configure your hw:
+        # <stockholm/makefu/2configs/hw/CAC.nix>
+        # <stockholm/makefu/2configs/fs/CAC-CentOS-7-64bit.nix>
+        # <stockholm/makefu/2configs/save-diskspace.nix
+    ];
+    krebs = {
+        enable = true;
+        tinc.retiolum.enable = true;
+        build.host = config.krebs.hosts.cake;
+    };
+    # You want to change these :)
+    boot.loader.grub.device = "/dev/sda";
+    fileSystems."/" = {
+        device = "/dev/sda1";
+    };
+}

makefu/1systems/cake/source.nix

@@ -0,0 +1,3 @@
+import <stockholm/makefu/source.nix> {
+  name="cake";
+}

makefu/1systems/gum/config.nix

@@ -44,6 +44,7 @@ in {
       <stockholm/makefu/2configs/iodined.nix>
       <stockholm/makefu/2configs/vpn/openvpn-server.nix>
       <stockholm/makefu/2configs/dnscrypt/server.nix>
+      <stockholm/makefu/2configs/remote-build/slave.nix>
 
       ## Web
       <stockholm/makefu/2configs/nginx/share-download.nix>
@@ -74,6 +75,9 @@ in {
       <stockholm/makefu/2configs/stats/client.nix>
       # <stockholm/makefu/2configs/logging/client.nix>
 
+      # Temporary:
+      <stockholm/makefu/2configs/temp/rst-issue.nix>
+
   ];
   makefu.dl-dir = "/var/download";
 
@@ -143,6 +147,8 @@ in {
           53589
           # temp vnc
           18001
+          # temp reverseshell
+          31337
         ];
         allowedUDPPorts = [
           # tinc

makefu/1systems/latte/config.nix

@@ -0,0 +1,53 @@
+{ config, pkgs, ... }:
+let
+
+  # external-ip = config.krebs.build.host.nets.internet.ip4.addr;
+  # internal-ip = config.krebs.build.host.nets.retiolum.ip4.addr;
+  # default-gw = "185.215.224.1";
+  # prefixLength = 24;
+  # external-mac = "46:5b:fc:f4:44:c9";
+  # ext-if = "et0";
+in {
+
+  imports = [
+    <stockholm/makefu>
+    # configure your hw:
+    <stockholm/makefu/2configs/hw/CAC.nix>
+    <stockholm/makefu/2configs/tinc/retiolum.nix>
+    <stockholm/makefu/2configs/save-diskspace.nix>
+
+    # Security
+    <stockholm/makefu/2configs/sshd-totp.nix>
+    <stockholm/makefu/2configs/stats/client.nix>
+
+    # Tools
+    <stockholm/makefu/2configs/tools/core.nix>
+    <stockholm/makefu/2configs/vim.nix>
+    <stockholm/makefu/2configs/zsh-user.nix>
+    # Services
+    <stockholm/makefu/2configs/remote-build/slave.nix>
+
+  ];
+  krebs = {
+    enable = true;
+    build.host = config.krebs.hosts.latte;
+  };
+  boot.initrd.availableKernelModules = [ "ata_piix" "ehci_pci" "virtio_pci" "virtio_blk" "virtio_net" "virtio_scsi" ];
+
+  boot.loader.grub.device = "/dev/vda";
+  boot.loader.grub.copyKernels = true;
+  fileSystems."/" = {
+    device = "/dev/vda1";
+    fsType = "ext4";
+  };
+  networking = {
+    firewall = {
+      allowPing = true;
+      logRefusedConnections = false;
+      allowedTCPPorts = [ ];
+      allowedUDPPorts = [ 655 ];
+    };
+    # network interface receives dhcp address
+    nameservers = [ "8.8.8.8" ];
+  };
+}

makefu/1systems/latte/source.nix

@@ -0,0 +1,3 @@
+import <stockholm/makefu/source.nix> {
+  name="latte";
+}

makefu/1systems/omo/config.nix

@@ -60,10 +60,13 @@ in {
       <stockholm/makefu/2configs/stats/nodisk-client.nix>
       # logs to influx
       <stockholm/makefu/2configs/stats/external/aralast.nix>
+      <stockholm/makefu/2configs/stats/telegraf>
 
       # services
       <stockholm/makefu/2configs/syncthing.nix>
       <stockholm/makefu/2configs/mqtt.nix>
+      <stockholm/makefu/2configs/remote-build/slave.nix>
+
 
       # security
       <stockholm/makefu/2configs/sshd-totp.nix>
@@ -77,6 +80,9 @@ in {
 
       ## as long as pyload is not in nixpkgs:
       # docker run -d -v /var/lib/pyload:/opt/pyload/pyload-config -v /media/crypt0/pyload:/opt/pyload/Downloads --name pyload --restart=always -p 8112:8000 -P writl/pyload
+
+      # Temporary:
+      <stockholm/makefu/2configs/temp/rst-issue.nix>
     ];
   makefu.full-populate = true;
   makefu.server.primary-itf = primaryInterface;

makefu/1systems/pnp/config.nix

@@ -34,10 +34,11 @@
   krebs.Reaktor.debug = {
     debug = true;
     extraEnviron = {
-      REAKTOR_HOST = "ni.r";
+      # TODO: remove hard-coded server
+      REAKTOR_HOST = "irc.r";
     };
     plugins = with pkgs.ReaktorPlugins; [ stockholm-issue nixos-version sed-plugin ];
-    channels = [ "#retiolum" ];
+    channels = [ "#xxx" ];
   };
 
   krebs.build.host = config.krebs.hosts.pnp;

makefu/1systems/wbob/config.nix

@@ -25,6 +25,8 @@ in {
       # <stockholm/makefu/2configs/audio/realtime-audio.nix>
       # <stockholm/makefu/2configs/vncserver.nix>
       <stockholm/makefu/2configs/temp/rst-issue.nix>
+      # Services
+      <stockholm/makefu/2configs/remote-build/slave.nix>
   ];
 
   krebs = {
@@ -33,10 +35,48 @@ in {
   };
 
   swapDevices = [ { device = "/var/swap"; } ];
+  services.collectd.extraConfig = lib.mkAfter ''
 
+    #LoadPlugin ping
+    # does not work because it requires privileges
+    #<Plugin "ping">
+    #  Host "google.de"
+    #  Host "heise.de"
+    #</Plugin>
+
+    LoadPlugin curl
+    <Plugin curl>
+      TotalTime true
+      NamelookupTime true
+      ConnectTime true
+
+      <Page "google">
+        MeasureResponseTime true
+        MeasureResponseCode true
+        URL "https://google.de"
+      </Page>
+
+      <Page "webde">
+        MeasureResponseTime true
+        MeasureResponseCode true
+        URL "http://web.de"
+      </Page>
+
+    </Plugin>
+    #LoadPlugin netlink
+    #<Plugin "netlink">
+    #  Interface "enp0s25"
+    #  Interface "wlp2s0"
+    #  IgnoreSelected false
+    #</Plugin>
+  '';
 
   networking.firewall.allowedUDPPorts = [ 655 ];
-  networking.firewall.allowedTCPPorts = [ 655 49152 ];
+  networking.firewall.allowedTCPPorts = [
+    655
+    8081 #smokeping
+    49152
+  ];
   networking.firewall.trustedInterfaces = [ "enp0s25" ];
   #services.tinc.networks.siem = {
   #  name = "display";
@@ -90,4 +130,66 @@ in {
       serverAddress = "x.r";
     };
   };
+  security.wrappers.fping = {
+    source = "${pkgs.fping}/bin/fping";
+    setuid = true;
+  };
+  services.smokeping = {
+    enable = true;
+    targetConfig = ''
+      probe = FPing
+      menu = Top
+      title = Network Latency Grapher
+      remark = Welcome to this SmokePing website.
+
+      + network
+      menu = Net latency
+      title = Network latency (ICMP pings)
+
+      ++ google
+      probe = FPing
+      host = google.de
+      ++ webde
+      probe = FPing
+      host = web.de
+
+      + services
+      menu = Service latency
+      title = Service latency (DNS, HTTP)
+
+      ++ HTTP
+      menu = HTTP latency
+      title = Service latency (HTTP)
+
+      +++ webdeping
+      probe = EchoPingHttp
+      host = web.de
+
+      +++ googwebping
+      probe = EchoPingHttp
+      host = google.de
+
+      #+++ webwww
+      #probe = Curl
+      #host = web.de
+
+      #+++ googwebwww
+      #probe = Curl
+      #host = google.de
+    '';
+    probeConfig = ''
+       + FPing
+       binary = /run/wrappers/bin/fping
+       + EchoPingHttp
+       pings = 5
+       url = /
+
+       #+ Curl
+       ## probe-specific variables
+       #binary = ${pkgs.curl}/bin/curl
+       #step = 60
+       ## a default for this target-specific variable
+       #urlformat = http://%host%/
+    '';
+  };
 }

makefu/1systems/x/config.nix

@@ -56,8 +56,8 @@ with import <stockholm/lib>;
       <stockholm/makefu/2configs/git/brain-retiolum.nix>
       <stockholm/makefu/2configs/tor.nix>
       <stockholm/makefu/2configs/vpn/vpngate.nix>
-      <stockholm/makefu/2configs/steam.nix>
       # <stockholm/makefu/2configs/buildbot-standalone.nix>
+      <stockholm/makefu/2configs/remote-build/master.nix>
 
       # Hardware
       <stockholm/makefu/2configs/hw/tp-x230.nix>

makefu/2configs/deployment/led-fader.nix

@@ -29,11 +29,11 @@ in {
     environment = {
       NIX_PATH = "/var/src";
     };
-    # after = [ (lib.optional config.services.mosqitto.enable "mosquitto.service") ];
+    after = [ "network-online.target"  ] ++ (lib.optional config.services.mosquitto.enable "mosquitto.service");
     wantedBy = [ "multi-user.target"  ];
-    after = [ "network-online.target"  ];
     serviceConfig = {
       # User = "nobody"; # need a user with permissions to run nix-shell
+      ExecStartPre = pkgs.writeDash "sleep.sh" "sleep 2";
       ExecStart = "${pkg}/bin/ampel 4 ${pkg}/share/times.json";
       PrivateTmp = true;
     };

makefu/2configs/git/brain-retiolum.nix

@@ -19,9 +19,9 @@ let
       post-receive = pkgs.git-hooks.irc-announce {
         nick = config.networking.hostName;
         verbose = true;
-        channel = "#retiolum";
+        channel = "#xxx";
         # TODO remove the hardcoded hostname
-        server = "ni.r";
+        server = "irc.r";
       };
     };
   };

makefu/2configs/git/cgit-retiolum.nix

@@ -24,6 +24,7 @@ let
     cac-api = { };
     euer_blog = { };
     ampel = { };
+    europastats = { };
     init-stockholm = {
       cgit.desc = "Init stuff for stockholm";
     };
@@ -56,9 +57,9 @@ let
       post-receive = pkgs.git-hooks.irc-announce {
         nick = config.networking.hostName;
         verbose = config.krebs.build.host.name == "gum";
-        channel = "#retiolum";
+        channel = "#xxx";
         # TODO remove the hardcoded hostname
-        server = "ni.r";
+        server = "irc.r";
       };
     };
   };

makefu/2configs/gui/base.nix

@@ -58,7 +58,7 @@ in
 
   hardware.pulseaudio = {
      enable = true;
-     systemWide = true;
+     # systemWide = true;
   };
   services.xserver.displayManager.sessionCommands = let
     xdefaultsfile = pkgs.writeText "Xdefaults"  ''

makefu/2configs/printer.nix

@@ -14,17 +14,20 @@ in {
 
   # scanners are printers just in reverse anyway
   services.saned.enable = true;
-  users.users."${mainUser}".extraGroups = [ "scanner" ];
+  users.users."${mainUser}".extraGroups = [ "scanner" "lp" ];
 
   hardware.sane = {
     enable = true;
-    extraBackends = [ pkgs.samsungUnifiedLinuxDriver ];
+    extraBackends = [ ];
 
     # $ scanimage -p --format=jpg --mode=Gray --source="Automatic Document Feeder" -v --batch="lol%d.jpg" --resolution=150
 
     # requires 'sane-extra', scan via:
-    extraConfig."magicolor" = ''
+    #extraConfig."magicolor" = ''
-      net 10.42.20.30 0x2098
+    #  net 10.42.20.30 0x2098
-    ''; # 10.42.20.30: uhrenkind.shack magicolor 1690mf
+    #''; # 10.42.20.30: uhrenkind.shack magicolor 1690mf
+    extraConfig."xerox_mfp" = ''
+      tcp 192.168.1.5
+    ''; #home printer SCX-3205W
   };
 }

makefu/2configs/remote-build/master.nix

@@ -0,0 +1,14 @@
+{ pkgs, ...}:
+let
+  sshKey = (toString <secrets>) + "/id_nixBuild";
+in {
+  nix.distributedBuilds = true;
+  # TODO: iterate over krebs.hosts
+  nix.buildMachines = map ( hostName:
+  {   inherit hostName sshKey;
+      sshUser = "nixBuild";
+      system = "x86_64-linux";
+      maxJobs = 1;
+  }) [ "omo.r"  "gum.r" "latte.r" ];
+  # puyak.r "wbob.r"
+}

makefu/2configs/remote-build/slave.nix

@@ -0,0 +1,11 @@
+{
+  nix.trustedUsers = [ "nixBuild" ];
+  users.users.nixBuild = {
+      name = "nixBuild";
+      useDefaultShell = true;
+      # TODO: put this somewhere else
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPlhb0TIBW9RN9T8Is4YRIc1RjOg+cxbZCaDjbM4zxrX nixBuild"
+      ];
+    };
+}

makefu/2configs/stats/server.nix

@@ -2,6 +2,8 @@
 
 with import <stockholm/lib>;
 let
+  irc-server = "rc.r";
+  irc-nick = "m-alarm";
   collectd-port = 25826;
   influx-port = 8086;
   grafana-port = 3000; # TODO nginx forward
@@ -37,9 +39,9 @@ in {
       echoToIrc = pkgs.writeDash "echo_irc" ''
         set -euf
         data="$(${pkgs.jq}/bin/jq -r .message)"
-        export LOGNAME=malarm
+        export LOGNAME=${irc-nick}
         ${pkgs.irc-announce}/bin/irc-announce \
-          irc.freenode.org 6667 malarm \#krebs-bots "$data" >/dev/null
+          ${irc-server} 6667 ${irc-nick} \#noise "$data" >/dev/null
       '';
   in {
     enable = true;

makefu/2configs/stats/telegraf/default.nix

@@ -0,0 +1,20 @@
+{...}:
+let
+  url = "http://localhost:8086";
+in {
+  imports = [
+    ./europastats.nix
+  ];
+  services.telegraf = {
+    enable = true;
+    extraConfig = {
+      agent.debug = true;
+      outputs = {
+        influxdb = [{
+          urls = [ url ];
+          database = "telegraf";
+        }];
+      };
+    };
+  };
+}

makefu/2configs/stats/telegraf/europastats.nix

@@ -0,0 +1,43 @@
+{ pkgs, ...}:
+let
+  pkg = with pkgs.python3Packages;buildPythonPackage rec {
+    rev = "be31da7";
+    name = "europastats-${rev}";
+    propagatedBuildInputs = [
+      requests2
+      docopt
+    ];
+    src = pkgs.fetchgit {
+      url = "http://cgit.euer.krebsco.de/europastats";
+      inherit rev;
+      sha256 = "0qj18vgj9nm6aisyqhk3iz3rf8xp7mn5jc6sfylcaw588a9sjfvc";
+    };
+  };
+in {
+  services.telegraf.extraConfig.inputs.exec = [
+    {
+      commands = [ "${pkg}/bin/europa-attractions"];
+      timeout = "1m";
+      data_format = "json";
+      name_override = "europawaiting";
+      interval = "1m";
+      tag_keys = [
+        "status"
+        "type"
+        "name"
+      ];
+    }
+    {
+      commands = [ "${pkg}/bin/europa-weather"];
+      timeout = "20s";
+      data_format = "json";
+      name_override = "europaweather";
+      interval = "10m";
+      tag_keys = [
+        "type"
+        "name"
+        "offset"
+      ];
+    }
+  ];
+}

makefu/2configs/tools/all.nix

@@ -7,6 +7,7 @@
     ./extra-gui.nix
     ./games.nix
     ./media.nix
+    ./scanner-tools.nix
     ./sec.nix
     ./sec-gui.nix
     ./studio.nix

makefu/2configs/tools/core-gui.nix

@@ -13,7 +13,6 @@
     keepassx
     pcmanfm
     evince
-    skype
     mirage
     tightvnc
     gnome3.dconf

makefu/2configs/tools/extra-gui.nix

@@ -6,7 +6,7 @@
     gimp
     inkscape
     libreoffice
-    skype
+    # skype
     synergy
     tdesktop
     virtmanager

makefu/2configs/tools/games.nix

@@ -1,8 +1,10 @@
 { pkgs, ... }:
 
 {
-  krebs.per-user.makefu.packages = with pkgs; [
+  imports = [
-    steam
+    ./steam.nix
+  ];
+  users.users.makefu.packages = with pkgs; [
     games-user-env
   ];
 }

makefu/2configs/tools/scanner-tools.nix

@@ -0,0 +1,7 @@
+{
+  # ln -s /run/current-system/sw/bin/xsane ~/.gimp-2.8/plug-ins/xsane
+  nixpkgs.config.packageOverrides = pkgs: {
+    xsaneGimp = pkgs.xsane.override { gimpSupport = true; };
+  };
+}
+

makefu/2configs/tools/steam.nix

@@ -1,6 +1,10 @@
 {pkgs, ...}:
 {
-  environment.systemPackages = [ pkgs.steam ];
+  users.users.makefu.packages = [
+    (pkgs.steam.override {
+      newStdcpp = true;
+    })
+  ];
   hardware.opengl.driSupport32Bit = true;
   hardware.pulseaudio.support32Bit = true;
 }

makefu/2configs/urlwatch/default.nix

@@ -24,8 +24,12 @@ in {
 
       # pypi
       https://pypi.python.org/simple/bepasty/
-      https://pypi.python.org/simple/xstatic/
       https://pypi.python.org/simple/devpi-client/
+      https://pypi.python.org/simple/oslo.config/
+      https://pypi.python.org/simple/sqlalchemy_migrate/
+      https://pypi.python.org/simple/xstatic/
+      https://pypi.python.org/simple/pyserial/
+      https://pypi.python.org/simple/semantic_version/
       # weird shit
       http://guest:derpi@cvs2svn.tigris.org/svn/cvs2svn/tags/
       http://ftp.debian.org/debian/pool/main/a/apt-cacher-ng/

makefu/2configs/vim.nix

@@ -127,6 +127,7 @@ in {
         { names = [ "undotree"
           # "YouCompleteMe"
           "vim-better-whitespace" ]; }
+        # vim-nix handles indentation better but does not perform sanity
         { names = [ "vim-addon-nix" ]; ft_regex = "^nix\$"; }
       ];
 

makefu/2configs/virtualisation/docker.nix

@@ -1,8 +1,9 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 {
   virtualisation.docker.enable = true;
   environment.systemPackages = with pkgs;[
     docker
     docker_compose
   ];
+  users.extraUsers.${config.krebs.build.user.name}.extraGroups = [ "docker" ];
 }

makefu/3modules/default.nix

@@ -15,7 +15,6 @@ _:
     ./torrent.nix
     ./udpt.nix
     ./umts.nix
-    ./wvdial.nix
   ];
 }
 

makefu/3modules/wvdial.nix

@@ -1,70 +0,0 @@
-{ config, lib, pkgs, ... }:
-# from 17.03/nixos/modules/programs/wvdial.nix
-
-with lib;
-
-let
-
-  configFile = ''
-    [Dialer Defaults]
-    PPPD PATH = ${pkgs.ppp}/sbin/pppd
-    ${config.environment.wvdial.dialerDefaults}
-  '';
-
-  cfg = config.environment.wvdial;
-
-in
-{
-  ###### interface
-
-  options = {
-
-    environment.wvdial = {
-
-      dialerDefaults = mkOption {
-        default = "";
-        type = types.str;
-        example = ''Init1 = AT+CGDCONT=1,"IP","internet.t-mobile"'';
-        description = ''
-          Contents of the "Dialer Defaults" section of
-          <filename>/etc/wvdial.conf</filename>.
-        '';
-      };
-
-      pppDefaults = mkOption {
-        default = ''
-          noipdefault
-          usepeerdns
-          defaultroute
-          persist
-          noauth
-        '';
-        type = types.str;
-        description = "Default ppp settings for wvdial.";
-      };
-
-    };
-
-  };
-
-  ###### implementation
-
-  config = mkIf (cfg.dialerDefaults != "") {
-
-    environment = {
-
-      etc =
-      [
-        { source = pkgs.writeText "wvdial.conf" configFile;
-          target = "wvdial.conf";
-        }
-        { source = pkgs.writeText "wvdial" cfg.pppDefaults;
-          target = "ppp/peers/wvdial";
-        }
-      ];
-
-    };
-
-  };
-
-}

makefu/5pkgs/beef/Gemfile

@@ -0,0 +1,97 @@
+# BeEF's Gemfile
+
+#
+# Copyright (c) 2006-2017 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+
+gem 'eventmachine'
+gem 'thin'
+gem 'sinatra'
+gem 'rack', '~> 1.6.5'
+gem 'em-websocket' # WebSocket support
+gem 'uglifier'
+gem 'mime-types'
+gem 'execjs'
+gem 'ansi'
+gem 'term-ansicolor', :require => 'term/ansicolor'
+gem 'dm-core'
+gem 'json'
+gem 'data_objects'
+gem 'rubyzip', '>= 1.2.1'
+gem 'espeak-ruby', '>= 1.0.4' # Text-to-Voice
+gem 'nokogiri', '>= 1.7'
+
+gem 'therubyracer'
+
+# SQLite support
+group :sqlite do
+  gem 'dm-sqlite-adapter'
+end
+
+# PostgreSQL support
+group :postgres do
+  #gem dm-postgres-adapter
+end
+
+# MySQL support
+group :mysql do
+  #gem dm-mysql-adapter
+end
+
+# Geolocation support
+group :geoip do
+  gem 'geoip'
+end
+
+gem 'parseconfig'
+gem 'erubis'
+gem 'dm-migrations'
+
+# Metasploit Integration extension
+group :ext_msf do
+  gem 'msfrpc-client'
+end
+
+# Twitter Notifications extension
+group :ext_twitter do
+  #gem 'twitter', '>= 5.0.0'
+end
+
+# DNS extension
+group :ext_dns do
+  gem 'rubydns', '~> 0.7.3'
+end
+
+# network extension
+group :ext_network do
+  gem 'dm-serializer'
+end
+
+# QRcode extension
+group :ext_qrcode do
+  gem 'qr4r'
+end
+
+# For running unit tests
+group :test do
+if ENV['BEEF_TEST']
+  gem 'rake'
+  gem 'test-unit'
+  gem 'test-unit-full'
+  gem 'curb'
+  gem 'selenium'
+  gem 'selenium-webdriver'
+  gem 'rspec'
+  gem 'bundler-audit'
+  # nokogirl is needed by capybara which may require one of the below commands
+  # sudo apt-get install libxslt-dev libxml2-dev
+  # sudo port install libxml2 libxslt
+  gem 'capybara'
+  # RESTful API tests/generic command module tests
+  gem 'rest-client', '>= 2.0.1'
+end
+end
+
+source 'https://rubygems.org'

makefu/5pkgs/beef/Gemfile.lock

@@ -0,0 +1,139 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.5.2)
+      public_suffix (>= 2.0.2, < 4.0)
+    ansi (1.5.0)
+    chunky_png (1.3.8)
+    daemons (1.2.4)
+    data_objects (0.10.17)
+      addressable (~> 2.1)
+    dm-core (1.2.1)
+      addressable (~> 2.3)
+    dm-do-adapter (1.2.0)
+      data_objects (~> 0.10.6)
+      dm-core (~> 1.2.0)
+    dm-migrations (1.2.0)
+      dm-core (~> 1.2.0)
+    dm-serializer (1.2.2)
+      dm-core (~> 1.2.0)
+      fastercsv (~> 1.5)
+      json (~> 1.6)
+      json_pure (~> 1.6)
+      multi_json (~> 1.0)
+    dm-sqlite-adapter (1.2.0)
+      dm-do-adapter (~> 1.2.0)
+      do_sqlite3 (~> 0.10.6)
+    do_sqlite3 (0.10.17)
+      data_objects (= 0.10.17)
+    em-websocket (0.5.1)
+      eventmachine (>= 0.12.9)
+      http_parser.rb (~> 0.6.0)
+    erubis (2.7.0)
+    espeak-ruby (1.0.4)
+    eventmachine (1.0.9.1)
+    execjs (2.7.0)
+    fastercsv (1.5.5)
+    filesize (0.1.1)
+    geoip (1.6.3)
+    http_parser.rb (0.6.0)
+    jsobfu (0.4.2)
+      rkelly-remix
+    json (1.8.6)
+    json_pure (1.8.6)
+    libv8 (3.16.14.19)
+    metasm (1.0.3)
+    mime-types (3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0521)
+    mini_portile2 (2.3.0)
+    mojo_magick (0.5.6)
+    msfrpc-client (1.1.1)
+      msgpack (~> 1)
+      rex (~> 2)
+    msgpack (1.1.0)
+    multi_json (1.12.2)
+    nokogiri (1.8.1)
+      mini_portile2 (~> 2.3.0)
+    parseconfig (1.0.8)
+    public_suffix (3.0.0)
+    qr4r (0.4.1)
+      mojo_magick
+      rqrcode
+    rack (1.6.8)
+    rack-protection (1.5.3)
+      rack
+    rainbow (2.2.2)
+      rake
+    rake (12.1.0)
+    rb-readline (0.5.5)
+    ref (2.0.0)
+    rex (2.0.11)
+      filesize
+      jsobfu (~> 0.4.1)
+      json
+      metasm (~> 1.0.2)
+      nokogiri
+      rb-readline
+      robots
+    rexec (1.6.3)
+      rainbow
+    rkelly-remix (0.0.7)
+    robots (0.10.1)
+    rqrcode (0.10.1)
+      chunky_png (~> 1.0)
+    rubydns (0.7.3)
+      eventmachine (~> 1.0.0)
+      rexec (~> 1.6.2)
+    rubyzip (1.2.1)
+    sinatra (1.4.8)
+      rack (~> 1.5)
+      rack-protection (~> 1.4)
+      tilt (>= 1.3, < 3)
+    term-ansicolor (1.6.0)
+      tins (~> 1.0)
+    therubyracer (0.12.3)
+      libv8 (~> 3.16.14.15)
+      ref
+    thin (1.7.2)
+      daemons (~> 1.0, >= 1.0.9)
+      eventmachine (~> 1.0, >= 1.0.4)
+      rack (>= 1, < 3)
+    tilt (2.0.8)
+    tins (1.15.0)
+    uglifier (3.2.0)
+      execjs (>= 0.3.0, < 3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  ansi
+  data_objects
+  dm-core
+  dm-migrations
+  dm-serializer
+  dm-sqlite-adapter
+  em-websocket
+  erubis
+  espeak-ruby (>= 1.0.4)
+  eventmachine
+  execjs
+  geoip
+  json
+  mime-types
+  msfrpc-client
+  nokogiri (>= 1.7)
+  parseconfig
+  qr4r
+  rack (~> 1.6.5)
+  rubydns (~> 0.7.3)
+  rubyzip (>= 1.2.1)
+  sinatra
+  term-ansicolor
+  therubyracer
+  thin
+  uglifier
+
+BUNDLED WITH
+   1.15.4

makefu/5pkgs/beef/default.nix

@@ -0,0 +1,37 @@
+{ stdenv, bundlerEnv, ruby, fetchFromGitHub }:
+# nix-shell --command "bundler install && bundix" in the clone, copy gemset.nix, Gemfile and Gemfile.lock
+let
+  gems = bundlerEnv {
+    name = "beef-env";
+    inherit ruby;
+    gemdir  = ./.;
+  };
+in stdenv.mkDerivation {
+  name = "beef-2017-09-21";
+  src = fetchFromGitHub {
+    owner = "beefproject";
+    repo = "beef";
+    rev = "69aa2a3";
+    sha256 = "1rky61i0wzpwcq3kqfa0m5hf6wyz8q8jgzs7dpfh04w9qh32ic4p";
+  };
+  buildInputs = [gems ruby];
+  installPhase = ''
+    mkdir -p $out/{bin,share/beef}
+
+    cp -r * $out/share/beef
+    # set the default db path, unfortunately setting to /tmp does not seem to work
+    # sed -i 's#db_file: .*#db_file: "/tmp/beef.db"#' $out/share/beef/config.yaml
+
+    bin=$out/bin/beef
+    cat > $bin <<EOF
+#!/bin/sh -e
+exec ${gems}/bin/bundle exec ${ruby}/bin/ruby $out/share/beef/beef "\$@"
+EOF
+    chmod +x $bin
+  '';
+
+  # crashes with segfault
+  # also, db cannot be set
+  meta.broken = true;
+
+}

makefu/5pkgs/beef/gemset.nix

@@ -0,0 +1,475 @@
+{
+  addressable = {
+    dependencies = ["public_suffix"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0viqszpkggqi8hq87pqp0xykhvz60g99nwmkwsb0v45kc2liwxvk";
+      type = "gem";
+    };
+    version = "2.5.2";
+  };
+  ansi = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "14ims9zfal4gs2wpx2m5rd8zsrl2k794d359shkrsgg3fhr2a22l";
+      type = "gem";
+    };
+    version = "1.5.0";
+  };
+  chunky_png = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0j0dngz6s0j3s3zaf9vrimjz65s9k7ad1c3xmmldr1vmz8sbd843";
+      type = "gem";
+    };
+    version = "1.3.8";
+  };
+  daemons = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1bmb4qrd95b5gl3ym5j3q6mf090209f4vkczggn49n56w6s6zldz";
+      type = "gem";
+    };
+    version = "1.2.4";
+  };
+  data_objects = {
+    dependencies = ["addressable"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19fw1ckqc5f1wc4r72qrymy2k6cmd8azbxpn61ksbsjqhzc2bgqd";
+      type = "gem";
+    };
+    version = "0.10.17";
+  };
+  dm-core = {
+    dependencies = ["addressable"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09x67ka6f1lxh4iwrg87iama0haq0d0z35gavvnvzpx9kn9pfbnw";
+      type = "gem";
+    };
+    version = "1.2.1";
+  };
+  dm-do-adapter = {
+    dependencies = ["data_objects" "dm-core"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1v84lsmsq8kawl8k4qz2h87xqc1sr10c08wwasrxbcgrkvp7qk4q";
+      type = "gem";
+    };
+    version = "1.2.0";
+  };
+  dm-migrations = {
+    dependencies = ["dm-core"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "04hr8qgm4j1z5fg0cfpr8r6apvk5xykad0d0xqfg48rjv5rdwc0i";
+      type = "gem";
+    };
+    version = "1.2.0";
+  };
+  dm-serializer = {
+    dependencies = ["dm-core" "fastercsv" "json" "json_pure" "multi_json"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0mvpb2d4cniysw45d3c9xidjpdb3wmfl7x5lgvnsfm69wq24v5y4";
+      type = "gem";
+    };
+    version = "1.2.2";
+  };
+  dm-sqlite-adapter = {
+    dependencies = ["dm-do-adapter" "do_sqlite3"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0mq9xrw4jwb753sy8902rq9sfv62mzss2n3875g51i9acqy475hc";
+      type = "gem";
+    };
+    version = "1.2.0";
+  };
+  do_sqlite3 = {
+    dependencies = ["data_objects"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0gxz54qjgwg6a2mkqpai28m0i5swbyxpr4qmh9x1nwf20lysrgcf";
+      type = "gem";
+    };
+    version = "0.10.17";
+  };
+  em-websocket = {
+    dependencies = ["eventmachine" "http_parser.rb"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1bsw8vjz0z267j40nhbmrvfz7dvacq4p0pagvyp17jif6mj6v7n3";
+      type = "gem";
+    };
+    version = "0.5.1";
+  };
+  erubis = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1fj827xqjs91yqsydf0zmfyw9p4l2jz5yikg3mppz6d7fi8kyrb3";
+      type = "gem";
+    };
+    version = "2.7.0";
+  };
+  espeak-ruby = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0d658zr53jibyrs5qnic7bfl6h69k5987s8asncsbnxwbzzilj6y";
+      type = "gem";
+    };
+    version = "1.0.4";
+  };
+  eventmachine = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "17jr1caa3ggg696dd02g2zqzdjqj9x9q2nl7va82l36f7c5v6k4z";
+      type = "gem";
+    };
+    version = "1.0.9.1";
+  };
+  execjs = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1yz55sf2nd3l666ms6xr18sm2aggcvmb8qr3v53lr4rir32y1yp1";
+      type = "gem";
+    };
+    version = "2.7.0";
+  };
+  fastercsv = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1df3vfgw5wg0s405z0pj0rfcvnl9q6wak7ka8gn0xqg4cag1k66h";
+      type = "gem";
+    };
+    version = "1.5.5";
+  };
+  filesize = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "061qmg82mm9xnmnq3b7gbi24g28xk62w0b0nw86gybd07m1jn989";
+      type = "gem";
+    };
+    version = "0.1.1";
+  };
+  geoip = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "099hxng7h8i3pwibnassivj58iw1x7ygwq06qj6rx7j16iyz6rzx";
+      type = "gem";
+    };
+    version = "1.6.3";
+  };
+  "http_parser.rb" = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15nidriy0v5yqfjsgsra51wmknxci2n2grliz78sf9pga3n0l7gi";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  jsobfu = {
+    dependencies = ["rkelly-remix"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1hchns89cfj0gggm2zbr7ghb630imxm2x2d21ffx2jlasn9xbkyk";
+      type = "gem";
+    };
+    version = "0.4.2";
+  };
+  json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qmj7fypgb9vag723w1a49qihxrcf5shzars106ynw2zk352gbv5";
+      type = "gem";
+    };
+    version = "1.8.6";
+  };
+  json_pure = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1vllrpm2hpsy5w1r7000mna2mhd7yfrmd8hi713lk0n9mv27bmam";
+      type = "gem";
+    };
+    version = "1.8.6";
+  };
+  libv8 = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0271i5sfma05gvhmrmxqb0jj667bl6m54yd49ay6yrdbh1g4wpl1";
+      type = "gem";
+    };
+    version = "3.16.14.19";
+  };
+  metasm = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0gss57q4lv6l0jkih77zffrpjjzgkdcsy7b9nvvawyzknis9w4s5";
+      type = "gem";
+    };
+    version = "1.0.3";
+  };
+  mime-types = {
+    dependencies = ["mime-types-data"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0087z9kbnlqhci7fxh9f6il63hj1k02icq2rs0c6cppmqchr753m";
+      type = "gem";
+    };
+    version = "3.1";
+  };
+  mime-types-data = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "04my3746hwa4yvbx1ranhfaqkgf6vavi1kyijjnw8w3dy37vqhkm";
+      type = "gem";
+    };
+    version = "3.2016.0521";
+  };
+  mini_portile2 = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13d32jjadpjj6d2wdhkfpsmy68zjx90p49bgf8f7nkpz86r1fr11";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+  mojo_magick = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1n4hzdyvaggzasxb55iqjd8sg6g84yc2dbaip0zzy7nwr5j5h8sm";
+      type = "gem";
+    };
+    version = "0.5.6";
+  };
+  msfrpc-client = {
+    dependencies = ["msgpack" "rex"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0q1x0xy857qm3sdxynp5p8kk7f6j25qjw1p28jh0y2qivc5ksik8";
+      type = "gem";
+    };
+    version = "1.1.1";
+  };
+  msgpack = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ck7w17d6b4jbb8inh1q57bghi9cjkiaxql1d3glmj1yavbpmlh7";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  multi_json = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1raim9ddjh672m32psaa9niw67ywzjbxbdb8iijx3wv9k5b0pk2x";
+      type = "gem";
+    };
+    version = "1.12.2";
+  };
+  nokogiri = {
+    dependencies = ["mini_portile2"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "105xh2zkr8nsyfaj2izaisarpnkrrl9000y3nyflg9cbzrfxv021";
+      type = "gem";
+    };
+    version = "1.8.1";
+  };
+  parseconfig = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0br2g9k6zc4ygah52aa8cwvpnnkszia29bnvnr8bhpk3rdzi2vmq";
+      type = "gem";
+    };
+    version = "1.0.8";
+  };
+  public_suffix = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0snaj1gxfib4ja1mvy3dzmi7am73i0mkqr0zkz045qv6509dhj5f";
+      type = "gem";
+    };
+    version = "3.0.0";
+  };
+  qr4r = {
+    dependencies = ["mojo_magick" "rqrcode"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ya71fxhmx2zfsmflmqh6xm9jwgjxamsj9d3h1kjp21w4vca0s30";
+      type = "gem";
+    };
+    version = "0.4.1";
+  };
+  rack = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19m7aixb2ri7p1n0iqaqx8ldi97xdhvbxijbyrrcdcl6fv5prqza";
+      type = "gem";
+    };
+    version = "1.6.8";
+  };
+  rack-protection = {
+    dependencies = ["rack"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0cvb21zz7p9wy23wdav63z5qzfn4nialik22yqp6gihkgfqqrh5r";
+      type = "gem";
+    };
+    version = "1.5.3";
+  };
+  rainbow = {
+    dependencies = ["rake"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "08w2ghc5nv0kcq5b257h7dwjzjz1pqcavajfdx2xjyxqsvh2y34w";
+      type = "gem";
+    };
+    version = "2.2.2";
+  };
+  rake = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0mfqgpp3m69s5v1rd51lfh5qpjwyia5p4rg337pw8c8wzm6pgfsw";
+      type = "gem";
+    };
+    version = "12.1.0";
+  };
+  rb-readline = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "14w79a121czmvk1s953qfzww30mqjb2zc0k9qhi0ivxxk3hxg6wy";
+      type = "gem";
+    };
+    version = "0.5.5";
+  };
+  ref = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "04p4pq4sikly7pvn30dc7v5x2m7fqbfwijci4z1y6a1ilwxzrjii";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  rex = {
+    dependencies = ["filesize" "jsobfu" "json" "metasm" "nokogiri" "rb-readline" "robots"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0kxacxq4l1gcqbw1izg2qqvdhxl6b5779a2qa2jk24f6x96bpi68";
+      type = "gem";
+    };
+    version = "2.0.11";
+  };
+  rexec = {
+    dependencies = ["rainbow"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1ihc0a6gj4i3287fjm86cn2ax4hlznyk5aqxrhjxkf4y9kabc3in";
+      type = "gem";
+    };
+    version = "1.6.3";
+  };
+  rkelly-remix = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1g7hjl9nx7f953y7lncmfgp0xgxfxvgfm367q6da9niik6rp1y3j";
+      type = "gem";
+    };
+    version = "0.0.7";
+  };
+  robots = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "141gvihcr2c0dpzl3dqyh8kqc9121prfdql2iamaaw0mf9qs3njs";
+      type = "gem";
+    };
+    version = "0.10.1";
+  };
+  rqrcode = {
+    dependencies = ["chunky_png"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0h1pnnydgs032psakvg3l779w3ghbn08ajhhhw19hpmnfhrs8k0a";
+      type = "gem";
+    };
+    version = "0.10.1";
+  };
+  rubydns = {
+    dependencies = ["eventmachine" "rexec"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1mav6589kpqh37wlipkh1nww6ipbw4kzja2crz216v25wwjrbpx2";
+      type = "gem";
+    };
+    version = "0.7.3";
+  };
+  rubyzip = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "06js4gznzgh8ac2ldvmjcmg9v1vg9llm357yckkpylaj6z456zqz";
+      type = "gem";
+    };
+    version = "1.2.1";
+  };
+  sinatra = {
+    dependencies = ["rack" "rack-protection" "tilt"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0byxzl7rx3ki0xd7aiv1x8mbah7hzd8f81l65nq8857kmgzj1jqq";
+      type = "gem";
+    };
+    version = "1.4.8";
+  };
+  term-ansicolor = {
+    dependencies = ["tins"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1b1wq9ljh7v3qyxkk8vik2fqx2qzwh5lval5f92llmldkw7r7k7b";
+      type = "gem";
+    };
+    version = "1.6.0";
+  };
+  therubyracer = {
+    dependencies = ["libv8" "ref"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1g95bzs2axjglyjyj6xvsywqgr80bnzlkw7mddxx1fdrak5wni2q";
+      type = "gem";
+    };
+    version = "0.12.3";
+  };
+  thin = {
+    dependencies = ["daemons" "eventmachine" "rack"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nagbf9pwy1vg09k6j4xqhbjjzrg5dwzvkn4ffvlj76fsn6vv61f";
+      type = "gem";
+    };
+    version = "1.7.2";
+  };
+  tilt = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0020mrgdf11q23hm1ddd6fv691l51vi10af00f137ilcdb2ycfra";
+      type = "gem";
+    };
+    version = "2.0.8";
+  };
+  tins = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09whix5a7ics6787zrkwjmp16kqyh6560p9f317syks785805f7s";
+      type = "gem";
+    };
+    version = "1.15.0";
+  };
+  uglifier = {
+    dependencies = ["execjs"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0wmqvn4xncw6h3d5gp2a44170zwxfyj3iq4rsjp16zarvzbdmgnz";
+      type = "gem";
+    };
+    version = "3.2.0";
+  };
+}

makefu/5pkgs/beef/shell.nix

@@ -0,0 +1,16 @@
+# Env to update Gemfile.lock / gemset.nix
+with import <nixpkgs> {};
+stdenv.mkDerivation {
+  name = "env";
+  buildInputs = [
+    ruby.devEnv
+    git
+    sqlite
+    libpcap
+    postgresql
+    libxml2
+    libxslt
+    pkgconfig
+    bundix
+  ];
+}

makefu/5pkgs/drozer/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, fetchFromGitHub, pythonPackages, jre7, jdk7, ... }:
+{ pkgs, lib, fetchFromGitHub, pythonPackages, jre7, jdk7 }:
 
 pythonPackages.buildPythonApplication rec {
   name = "drozer-${version}";

makefu/5pkgs/esptool/default.nix

@@ -1,32 +0,0 @@
-{ pkgs, fetchFromGitHub, ... }:
-with pkgs.python2Packages;
-let
-  pyaes = buildPythonPackage rec {
-      name = "pyaes-${version}";
-      version = "1.6.0";
-      src = fetchFromGitHub {
-        owner = "ricmoo";
-        repo = "pyaes";
-        rev = "v${version}";
-        sha256 = "04934a9zgwc8g3qhfrkcfv0bs557paigllnkrnfhp9m1azr3bfqb";
-      };
-      doCheck = false;
-  };
-in
-buildPythonPackage rec {
-    name = "esptool-${version}";
-    version = "2.0beta2";
-    propagatedBuildInputs = [
-      pyserial
-      flake8
-      ecdsa
-      pyaes
-    ];
-    src = fetchFromGitHub {
-      owner = "themadinventor";
-      repo = "esptool";
-      rev = "v${version}";
-      sha256 = "0n96pyi1k4qlyfqk5k7xpgq8726wz74qvd3gqjg0bpsl3wr7l94i";
-    };
-    doCheck = false;
-}

makefu/5pkgs/logstash-input-rss/default.nix

@@ -0,0 +1,31 @@
+{ pkgs, stdenv, lib, fetchFromGitHub }:
+
+
+stdenv.mkDerivation rec {
+  name = "logstash-input-rss-${version}";
+  version = "3.0.3";
+
+  src = fetchFromGitHub {
+    owner = "logstash-plugins";
+    repo = "logstash-input-rss";
+    rev = "v${version}";
+    sha256 = "026902g256385dx3qkbknz10vsp9dm2ymjdx6s6rkh3krs67w09l";
+  };
+
+  dontBuild    = true;
+  dontPatchELF = true;
+  dontStrip    = true;
+  dontPatchShebangs = true;
+  installPhase = ''
+    mkdir -p $out/logstash
+    cp -r lib/* $out/
+  '';
+
+  meta = with lib; {
+    description = "logstash output plugin";
+    homepage    = https://github.com/logstash-plugins/logstash-input-rss;
+    license     = stdenv.lib.licenses.asl20;
+    platforms   = stdenv.lib.platforms.unix;
+    maintainers = with maintainers; [ makefu ];
+  };
+}

makefu/5pkgs/udpt/default.nix

@@ -1,29 +0,0 @@
-{ stdenv, boost, sqlite, fetchFromGitHub }:
-
-stdenv.mkDerivation rec {
-  proj = "udpt";
-  name = "udpt-${rev}";
-  rev = "0790558";
-
-  enableParallelBuilding = true;
-
-  src = fetchFromGitHub {
-    owner = "naim94a";
-    repo = "udpt";
-    inherit rev;
-    sha256 = "0rgkjwvnqwbnqy7pm3dk176d3plb5lypaf12533yr0yfzcp6gnzk";
-  };
-  buildInputs = [ boost sqlite ];
-  installPhase = ''
-    mkdir -p $out/bin $out/etc/
-    cp udpt $out/bin
-    cp udpt.conf $out/etc/
-  '';
-  meta = {
-    description = "udp tracker";
-    homepage = https://github.com/naim94a/udpt;
-    license = stdenv.lib.licenses.gpl3;
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = with stdenv.lib.maintainers; [ makefu ];
-  };
-}

makefu/source.nix

@@ -11,10 +11,13 @@ let
               then "buildbot"
               else "makefu";
   _file = <stockholm> + "/makefu/1systems/${name}/source.nix";
-  ref = "c91346e"; # unstable @ 2017-09-04
+  ref = "46cfb36"; # unstable @ 2017-09-04
-                   # + graceful requests2 (a772c3aa)
+                   # + graceful requests2 (a772c3a)
-                   # + mitmproxy fix      (eee2d174)
+                   # + mitmproxy fix      (eee2d17)
                    # + tpm-tools fix      (5cb9987)
+                   # + dnscrypt-wrapper   (25703c3)
+                   # + lass wvstream fix  (76f4910,37cc2bc,0d48837)
+                   # + ruby stuff (2f0b17e4be9,55a952be5b5)
 
 in
   evalSource (toString _file) [

mv/source.nix

@@ -10,7 +10,7 @@ in
       nixos-config.symlink = "stockholm/mv/1systems/${name}/config.nix";
       nixpkgs.git = {
         # nixos-17.03
-        ref = mkDefault "56da88a298a6f549701a10bb12072804a1ebfbd5";
+        ref = mkDefault "3d04a557b72aa0987d9bf079e1445280b6bfd907";
         url = https://github.com/NixOS/nixpkgs;
       };
       secrets.file = getAttr builder {

shell.nix

@@ -6,43 +6,43 @@ let
   # high level commands
   #
 
-  # usage: deploy
+  cmds.deploy = pkgs.withGetopt {
-  #         [--force-populate]
+    force-populate = { default = /* sh */ "false"; switch = true; };
-  #         [--quiet]
+    quiet = { default = /* sh */ "false"; switch = true; };
-  #         [--source=PATH]
+    source_file = {
-  #         --system=SYSTEM
+      default = /* sh */ "$user/1systems/$system/source.nix";
-  #         [--target=TARGET]
+      long = "source";
-  #         [--user=USER]
+    };
-  cmds.deploy = pkgs.writeDash "cmds.deploy" ''
+    system = {};
+    target.default = /* sh */ "$system";
+    user.default = /* sh */ "$LOGNAME";
+  } (opts: pkgs.writeDash "cmds.deploy" ''
     set -efu
 
-    command=deploy
-    . ${init.args}
-    \test -n "''${quiet-}" || quiet=false
-    \test -n "''${target-}" || target=$system
-    \test -n "''${user-}" || user=$LOGNAME
-    \test -n "''${source_file}" || source_file=$user/1systems/$system/source.nix
     . ${init.env}
-    . ${init.proxy}
+    . ${init.proxy opts}
 
-    exec ${utils.deploy}
+    # Use system's nixos-rebuild, which is not self-contained
-  '';
+    export PATH=/run/current-system/sw/bin
+    exec ${utils.with-whatsupnix} \
+    nixos-rebuild switch \
+        --show-trace \
+        -I "$target_path"
+  '');
 
-  # usage: install
+  cmds.install = pkgs.withGetopt {
-  #         [--force-populate]
+    force-populate = { default = /* sh */ "false"; switch = true; };
-  #         [--quiet]
+    quiet = { default = /* sh */ "false"; switch = true; };
-  #         [--source=PATH]
+    source_file = {
-  #         --system=SYSTEM
+      default = /* sh */ "$user/1systems/$system/source.nix";
-  #         --target=TARGET
+      long = "source";
-  #         [--user=USER]
+    };
-  cmds.install = pkgs.writeBash "cmds.install" ''
+    system = {};
+    target = {};
+    user.default = /* sh */ "$LOGNAME";
+  } (opts: pkgs.writeBash "cmds.install" ''
     set -efu
 
-    command=install
-    . ${init.args}
-    \test -n "''${quiet-}" || quiet=false
-    \test -n "''${user-}" || user=$LOGNAME
-    \test -n "''${source_file}" || source_file=$user/1systems/$system/source.nix
     . ${init.env}
 
     if \test "''${using_proxy-}" != true; then
@@ -55,7 +55,7 @@ let
               # TODO inline prepare.sh?
     fi
 
-    . ${init.proxy}
+    . ${init.proxy opts}
 
     # Reset PATH because we need access to nixos-install.
     # TODO provide nixos-install instead of relying on prepare.sh
@@ -75,30 +75,28 @@ let
 
     cd
     exec nixos-install
-  '';
+  '');
 
-  # usage: test
+  cmds.test = pkgs.withGetopt {
-  #         [--force-populate]
+    force-populate = { default = /* sh */ "false"; switch = true; };
-  #         [--quiet]
+    quiet = { default = /* sh */ "false"; switch = true; };
-  #         [--source=PATH]
+    source_file = {
-  #         --system=SYSTEM
+      default = /* sh */ "$user/1systems/$system/source.nix";
-  #         --target=TARGET
+      long = "source";
-  #         [--user=USER]
+    };
-  cmds.test = pkgs.writeDash "cmds.test" /* sh */ ''
+    system = {};
+    target = {};
+    user.default = /* sh */ "$LOGNAME";
+  } (opts: pkgs.writeDash "cmds.test" /* sh */ ''
     set -efu
 
     export dummy_secrets=true
 
-    command=test
-    . ${init.args}
-    \test -n "''${quiet-}" || quiet=false
-    \test -n "''${user-}" || user=$LOGNAME
-    \test -n "''${source_file}" || source_file=$user/1systems/$system/source.nix
     . ${init.env}
-    . ${init.proxy}
+    . ${init.proxy opts}
 
     exec ${utils.build} config.system.build.toplevel
-  '';
+  '');
 
   #
   # low level commands
@@ -118,19 +116,13 @@ let
 
   # usage: parse-target [--default=TARGET] TARGET
   # TARGET = [USER@]HOST[:PORT][/PATH]
-  cmds.parse-target = pkgs.writeDash "cmds.parse-target" ''
+  cmds.parse-target = pkgs.withGetopt {
+    default_target = {
+      long = "default";
+      short = "d";
+    };
+  } (opts: pkgs.writeDash "cmds.parse-target" ''
     set -efu
-    args=$(${pkgs.utillinux}/bin/getopt -n "$0" -s sh \
-        -o d: \
-        -l default: \
-        -- "$@")
-    if \test $? != 0; then exit 1; fi
-    eval set -- "$args"
-    default_target=
-    while :; do case $1 in
-      -d|--default) default_target=$2; shift 2;;
-      --) shift; break;;
-    esac; done
     target=$1; shift
     for arg; do echo "$0: bad argument: $arg" >&2; done
     if \test $# != 0; then exit 2; fi
@@ -149,7 +141,7 @@ let
           ($default_target | parse) + ($target | parse | sanitize) |
           . + { local: (.user == env.LOGNAME and .host == env.HOSTNAME) }
         ''}
-  '';
+  '');
 
   # usage: quote [ARGS...]
   cmds.quote = pkgs.writeDash "cmds.quote" ''
@@ -163,28 +155,6 @@ let
     echo
   '';
 
-  init.args = pkgs.writeText "init.args" /* sh */ ''
-    args=$(${pkgs.utillinux}/bin/getopt -n "$command" -s sh \
-        -o Qs:t:u: \
-        -l force-populate,quiet,source:,system:,target:,user: \
-        -- "$@")
-    if \test $? != 0; then exit 1; fi
-    eval set -- "$args"
-    force_populate=false
-    source_file=
-    while :; do case $1 in
-         --force-populate) force_populate=true; shift;;
-      -Q|--quiet) quiet=true; shift;;
-         --source) source_file=$2; shift 2;;
-      -s|--system) system=$2; shift 2;;
-      -t|--target) target=$2; shift 2;;
-      -u|--user) user=$2; shift 2;;
-      --) shift; break;;
-    esac; done
-    for arg; do echo "$command: bad argument: $arg" >&2; done
-    if \test $# != 0; then exit 2; fi
-  '';
-
   init.env = pkgs.writeText "init.env" /* sh */ ''
     export quiet
     export system
@@ -201,7 +171,7 @@ let
     export target_local="$(echo $target_object | ${pkgs.jq}/bin/jq -r .local)"
   '';
 
-  init.proxy = pkgs.writeText "init.proxy" /* sh */ ''
+  init.proxy = opts: pkgs.writeText "init.proxy" /* sh */ ''
     if \test "''${using_proxy-}" != true; then
 
       source=$(get-source "$source_file")
@@ -219,11 +189,12 @@ let
             NIX_PATH=$(quote "$target_path") \
             STOCKHOLM_VERSION=$(quote "$STOCKHOLM_VERSION") \
             nix-shell --run "$(quote "
-              quiet=$(quote "$quiet") \
+              ${lib.concatStringsSep " " (lib.mapAttrsToList
-              system=$(quote "$system") \
+                (name: opt: /* sh */ "${opt.varname}=\$(quote ${opt.ref})")
-              target=$(quote "$target") \
+                opts
+              )} \
               using_proxy=true \
-              $(quote "$command" "$@")
+              $(quote "$0" "$@")
             ")"
       fi
     fi
@@ -239,16 +210,6 @@ let
         -I "$target_path" \
   '';
 
-  utils.deploy = pkgs.writeDash "utils.deploy" ''
-    set -efu
-    # Use system's nixos-rebuild, which is not self-contained
-    export PATH=/run/current-system/sw/bin
-    ${utils.with-whatsupnix} \
-    nixos-rebuild switch \
-        --show-trace \
-        -I "$target_path"
-  '';
-
   utils.with-whatsupnix = pkgs.writeDash "utils.with-whatsupnix" ''
     set -efu
     if \test "$quiet" = true; then

tv/1systems/cd/config.nix

@@ -1,35 +0,0 @@
-with import <stockholm/lib>;
-{ config, pkgs, ... }: let
-
-  bestGuessGateway = addr: elemAt (match "(.*)(\.[^.])" addr) 0 + ".1";
-
-in {
-  krebs.build.host = config.krebs.hosts.cd;
-
-  imports = [
-    <stockholm/tv>
-    <stockholm/tv/2configs/hw/CAC-Developer-2.nix>
-    <stockholm/tv/2configs/fs/CAC-CentOS-7-64bit.nix>
-    <stockholm/tv/2configs/exim-smarthost.nix>
-    <stockholm/tv/2configs/retiolum.nix>
-  ];
-
-  networking = let
-    address = config.krebs.build.host.nets.internet.ip4.addr;
-  in {
-    defaultGateway = bestGuessGateway address;
-    interfaces.enp2s1.ip4 = singleton {
-      inherit address;
-      prefixLength = 24;
-    };
-    nameservers = ["8.8.8.8"];
-  };
-
-  environment.systemPackages = with pkgs; [
-    iftop
-    iotop
-    iptables
-    nethogs
-    tcpdump
-  ];
-}

tv/1systems/cd/source.nix

@@ -1,3 +0,0 @@
-import <stockholm/tv/source.nix> {
-  name = "cd";
-}

tv/1systems/wu/config.nix

@@ -8,7 +8,6 @@ with import <stockholm/lib>;
     <stockholm/tv/2configs/hw/w110er.nix>
     <stockholm/tv/2configs/exim-retiolum.nix>
     <stockholm/tv/2configs/gitrepos.nix>
-    <stockholm/tv/2configs/im.nix>
     <stockholm/tv/2configs/mail-client.nix>
     <stockholm/tv/2configs/man.nix>
     <stockholm/tv/2configs/nginx/public_html.nix>

tv/1systems/xu/config.nix

@@ -16,6 +16,7 @@ with import <stockholm/lib>;
     <stockholm/tv/2configs/pulse.nix>
     <stockholm/tv/2configs/retiolum.nix>
     <stockholm/tv/2configs/binary-cache>
+    <stockholm/tv/2configs/br.nix>
     <stockholm/tv/2configs/xserver>
     {
       environment.systemPackages = with pkgs; [
@@ -155,5 +156,10 @@ with import <stockholm/lib>;
   # The NixOS release to be compatible with for stateful data such as databases.
   system.stateVersion = "15.09";
 
+  tv.nixpkgs-overlays = {
+    krebs = "/home/tv/stockholm/krebs/5pkgs";
+    tv = "/home/tv/stockholm/tv/5pkgs";
+  };
+
   virtualisation.virtualbox.host.enable = true;
 }

tv/2configs/backup.nix

@@ -52,12 +52,6 @@ with import <stockholm/lib>;
       dst = { host = config.krebs.hosts.zu; path = "/bku/xu-home"; };
       startAt = "06:20";
     };
-    xu-pull-cd-home = {
-      method = "pull";
-      src = { host = config.krebs.hosts.cd; path = "/home"; };
-      dst = { host = config.krebs.hosts.xu; path = "/bku/cd-home"; };
-      startAt = "07:00";
-    };
     xu-pull-ni-ejabberd = {
       method = "pull";
       src = { host = config.krebs.hosts.ni; path = "/var/ejabberd"; };
@@ -76,12 +70,6 @@ with import <stockholm/lib>;
       dst = { host = config.krebs.hosts.xu; path = "/bku/zu-home"; };
       startAt = "05:00";
     };
-    zu-pull-cd-home = {
-      method = "pull";
-      src = { host = config.krebs.hosts.cd; path = "/home"; };
-      dst = { host = config.krebs.hosts.zu; path = "/bku/cd-home"; };
-      startAt = "06:30";
-    };
     zu-pull-ni-ejabberd = {
       method = "pull";
       src = { host = config.krebs.hosts.ni; path = "/var/ejabberd"; };

tv/2configs/br.nix

@@ -0,0 +1,49 @@
+with import <stockholm/lib>;
+{ config, pkgs, ... }: {
+
+  imports = [
+    <nixpkgs/nixos/modules/services/hardware/sane_extra_backends/brscan4.nix>
+  ];
+
+  krebs.nixpkgs.allowUnfreePredicate = pkg: any (flip hasPrefix pkg.name) [
+    "brother-udev-rule-type1-"
+    "brscan4-"
+    "mfcl2700dnlpr-"
+  ];
+
+  hardware.sane = {
+    enable = true;
+    brscan4 = {
+      enable = true;
+      netDevices = {
+        bra = {
+          model = "MFCL2700DN";
+          ip = "10.23.1.214";
+        };
+      };
+    };
+  };
+
+  services.saned.enable = true;
+
+  # usage: scanimage -d "$(find-scanner bra)" --batch --format=tiff --resolution 150  -x 211 -y 298
+  environment.systemPackages = [
+    (pkgs.writeDashBin "find-scanner" ''
+      set -efu
+      name=$1
+      ${pkgs.sane-backends}/bin/scanimage -f '%m %d
+      ' \
+      | ${pkgs.gawk}/bin/awk -v dev="*$name" '$1 == dev { print $2; exit }' \
+      | ${pkgs.gnugrep}/bin/grep .
+    '')
+  ];
+
+  services.printing = {
+    enable = true;
+    drivers = [
+      pkgs.mfcl2700dncupswrapper
+    ];
+  };
+
+  systemd.services.cups.serviceConfig.PrivateTmp = true;
+}

tv/2configs/default.nix

@@ -90,11 +90,7 @@ with import <stockholm/lib>;
       environment.variables = {
         NIX_PATH = mkForce (concatStringsSep ":" [
           "secrets=/var/src/stockholm/null"
-          "nixpkgs-overlays=${pkgs.runCommand "nixpkgs-overlays" {} ''
+          "nixpkgs-overlays=${config.tv.nixpkgs-overlays}"
-            mkdir $out
-            ln -s /home/tv/stockholm/krebs/5pkgs $out/krebs
-            ln -s /home/tv/stockholm/tv/5pkgs $out/tv
-          ''}"
           "/var/src"
         ]);
       };

tv/2configs/gitrepos.nix

@@ -100,10 +100,10 @@ let {
   );
 
   irc-announce = args: pkgs.git-hooks.irc-announce (recursiveUpdate {
-    channel = "#retiolum";
+    channel = "#krebs";
     # TODO make nick = config.krebs.build.host.name the default
     nick = config.krebs.build.host.name;
-    server = "ni.r";
+    server = "irc.r";
     verbose = true;
   } args);
 

tv/3modules/charybdis/default.nix

@@ -52,7 +52,7 @@ in {
     systemd.services.charybdis = {
       wantedBy = [ "multi-user.target" ];
       requires = [ "secret.service" ];
-      after = [ "network.target" "secret.service" ];
+      after = [ "network-online.target" "secret.service" ];
       environment = {
         BANDB_DBPATH = "${cfg.user.home}/ban.db";
       };

tv/3modules/default.nix

@@ -1,11 +1,10 @@
-_:
-
 {
   imports = [
     ./charybdis
     ./ejabberd
     ./hosts.nix
     ./iptables.nix
+    ./nixpkgs-overlays.nix
     ./x0vncserver.nix
   ];
 }

tv/3modules/nixpkgs-overlays.nix

@@ -0,0 +1,23 @@
+with import <stockholm/lib>;
+{ config, pkgs, ... }: {
+
+  options.tv.nixpkgs-overlays = mkOption {
+    apply = src:
+      pkgs.runCommand "nixpkgs-overlays" {} ''
+        mkdir $out
+        ${concatStringsSep "\n" (mapAttrsToList (name: path:
+          "ln -s ${shell.escape path} $out/${shell.escape name}"
+        ) src)}
+      '' // {
+        inherit src;
+      };
+    type = types.attrsOf types.absolute-pathname;
+  };
+
+  config = {
+    tv.nixpkgs-overlays = {
+      krebs = mkDefault "/var/src/stockholm/krebs/5pkgs";
+      tv = mkDefault "/var/src/stockholm/tv/5pkgs";
+    };
+  };
+}

tv/5pkgs/default.nix

@@ -24,6 +24,10 @@ foldl' mergeAttrs {}
         "$@"
   '';
 
+  gitAndTools = super.gitAndTools // {
+    inherit (self) diff-so-fancy;
+  };
+
   ff = self.writeDashBin "ff" ''
     exec ${self.firefoxWrapper}/bin/firefox "$@"
   '';

tv/5pkgs/simple/diff-so-fancy.nix

@@ -0,0 +1,48 @@
+{stdenv, git, perl, ncurses, coreutils, fetchFromGitHub, makeWrapper, ...}:
+
+stdenv.mkDerivation rec {
+  name = "diff-so-fancy-${version}";
+  version = "ed8cf17";
+
+  src = fetchFromGitHub {
+    owner = "so-fancy";
+    repo = "diff-so-fancy";
+    rev = "ed8cf1763d38bdd79ceb55a73b9ce7e30f1e184d";
+    sha256 = "176qn0w2rn6mr5ymvkblyiznqq7yyibfsnnjfivcyhz69w6yr9r9";
+  };
+
+  # Perl is needed here for patchShebangs
+  nativeBuildInputs = [ perl makeWrapper ];
+
+  buildPhase = null;
+
+  installPhase = ''
+    mkdir -p $out/bin $out/lib/diff-so-fancy
+
+    # diff-so-fancy executable searches for it's library relative to
+    # itself, so we are copying executable to lib, and only symlink it
+    # from bin/
+    cp diff-so-fancy $out/lib/diff-so-fancy
+    cp -r lib $out/lib/diff-so-fancy
+    ln -s $out/lib/diff-so-fancy/diff-so-fancy $out/bin
+
+    # ncurses is needed for `tput`
+    wrapProgram $out/lib/diff-so-fancy/diff-so-fancy \
+      --prefix PATH : "${git}/share/git/contrib/diff-highlight" \
+      --prefix PATH : "${git}/bin" \
+      --prefix PATH : "${coreutils}/bin" \
+      --prefix PATH : "${ncurses.out}/bin"
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/so-fancy/diff-so-fancy;
+    description = "Good-looking diffs filter for git";
+    license = licenses.mit;
+    platforms = platforms.all;
+    longDescription = ''
+      diff-so-fancy builds on the good-lookin' output of git contrib's
+      diff-highlight to upgrade your diffs' appearances.
+    '';
+    maintainers = with maintainers; [ fpletz ];
+  };
+}

tv/5pkgs/simple/mfcl2700dncupswrapper/default.nix

@@ -0,0 +1,45 @@
+{ coreutils, dpkg, fetchurl, gnugrep, gnused, makeWrapper, mfcl2700dnlpr,
+perl, stdenv }:
+
+stdenv.mkDerivation rec {
+  name = "mfcl2700dncupswrapper-${meta.version}";
+
+  src = fetchurl {
+    url = "http://download.brother.com/welcome/dlf102086/${name}.i386.deb";
+    sha256 = "07w48mah0xbv4h8vsh1qd5cd4b463bx8y6gc5x9pfgsxsy6h6da1";
+  };
+
+  nativeBuildInputs = [ dpkg makeWrapper ];
+
+  phases = [ "installPhase" ];
+
+  installPhase = ''
+    dpkg-deb -x $src $out
+
+    basedir=${mfcl2700dnlpr}/opt/brother/Printers/MFCL2700DN
+    dir=$out/opt/brother/Printers/MFCL2700DN
+
+    substituteInPlace $dir/cupswrapper/brother_lpdwrapper_MFCL2700DN \
+      --replace /usr/bin/perl ${perl}/bin/perl \
+      --replace "basedir =~" "basedir = \"$basedir\"; #" \
+      --replace "PRINTER =~" "PRINTER = \"MFCL2700DN\"; #"
+
+    wrapProgram $dir/cupswrapper/brother_lpdwrapper_MFCL2700DN \
+      --prefix PATH : ${stdenv.lib.makeBinPath [ coreutils gnugrep gnused ]}
+
+    mkdir -p $out/lib/cups/filter
+    mkdir -p $out/share/cups/model
+
+    ln $dir/cupswrapper/brother_lpdwrapper_MFCL2700DN $out/lib/cups/filter
+    ln $dir/cupswrapper/brother-MFCL2700DN-cups-en.ppd $out/share/cups/model
+  '';
+
+  meta = {
+    description = "Brother MFC-L2700DN CUPS wrapper driver";
+    homepage = "http://www.brother.com/";
+    license = stdenv.lib.licenses.gpl2Plus;
+    maintainers = [ stdenv.lib.maintainers.tv ];
+    platforms = stdenv.lib.platforms.linux;
+    version = "3.2.0-1";
+  };
+}

tv/5pkgs/simple/mfcl2700dnlpr/default.nix

@@ -0,0 +1,44 @@
+{ coreutils, dpkg, fetchurl, ghostscript, gnugrep, gnused, pkgsi686Linux, makeWrapper, perl, stdenv, which }:
+
+stdenv.mkDerivation rec {
+  name = "mfcl2700dnlpr-${meta.version}";
+
+  src = fetchurl {
+    url = "http://download.brother.com/welcome/dlf102085/${name}.i386.deb";
+    sha256 = "170qdzxlqikzvv2wphvfb37m19mn13az4aj88md87ka3rl5knk4m";
+  };
+
+  nativeBuildInputs = [ dpkg makeWrapper ];
+
+  phases = [ "installPhase" ];
+
+  installPhase = ''
+    dpkg-deb -x $src $out
+
+    dir=$out/opt/brother/Printers/MFCL2700DN
+
+    substituteInPlace $dir/lpd/filter_MFCL2700DN \
+      --replace /usr/bin/perl ${perl}/bin/perl \
+      --replace "BR_PRT_PATH =~" "BR_PRT_PATH = \"$dir\"; #" \
+      --replace "PRINTER =~" "PRINTER = \"MFCL2700DN\"; #"
+
+    wrapProgram $dir/lpd/filter_MFCL2700DN \
+      --prefix PATH : ${stdenv.lib.makeBinPath [
+        coreutils ghostscript gnugrep gnused which
+      ]}
+
+    interpreter=${pkgsi686Linux.stdenv.cc.libc.out}/lib/ld-linux.so.2
+    patchelf --set-interpreter "$interpreter" $dir/inf/braddprinter
+    patchelf --set-interpreter "$interpreter" $dir/lpd/brprintconflsr3
+    patchelf --set-interpreter "$interpreter" $dir/lpd/rawtobr3
+  '';
+
+  meta = {
+    description = "Brother MFC-L2700DN LPR driver";
+    homepage = "http://www.brother.com/";
+    license = stdenv.lib.licenses.unfree;
+    maintainers = [ stdenv.lib.maintainers.tv ];
+    platforms = stdenv.lib.platforms.linux;
+    version = "3.2.0-1";
+  };
+}

tv/5pkgs/simple/q/default.nix

@@ -262,7 +262,7 @@ let
   '';
 
   q-todo = ''
-    TODO_file=$HOME/TODO
+    TODO_file=$PWD/TODO
     if test -e "$TODO_file"; then
       ${pkgs.coreutils}/bin/cat "$TODO_file" \
         | ${pkgs.gawk}/bin/gawk -v now=$(${pkgs.coreutils}/bin/date +%s) '
@@ -294,13 +294,7 @@ in
 pkgs.writeBashBin "q" ''
   set -eu
   export PATH=/var/empty
-  (${q-todo}) || :
-  if [ "$PWD" != "$HOME" ]; then
-    (HOME=$PWD; ${q-todo}) || :
-  fi
-  echo
   ${q-cal}
-  echo
   ${q-isodate}
   ${q-sgtdate}
   (${q-gitdir}) &
@@ -311,4 +305,14 @@ pkgs.writeBashBin "q" ''
   (${q-online}) &
   (${q-thermal_zone}) &
   wait
+  if test "$PWD" != "$HOME" && test -e "$HOME/TODO"; then
+    TODO_home_entries=$(cd; (${q-todo}) | ${pkgs.coreutils}/bin/wc -l)
+    if test "$TODO_home_entries" = 1; then
+      TODO_format='There is %d entry in ~/TODO'
+    else
+      TODO_format='There are %d entries in ~/TODO'
+    fi
+    printf "\x1b[38;5;238m$TODO_format\x1b[m\n" "$TODO_home_entries"
+  fi
+  (${q-todo}) || :
 ''