Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge remote-tracking branch 'ni/master'

Browse Source
This commit is contained in:
lassulus 2020-08-06 23:24:29 +02:00
commit e0e91cfd74
17 changed files with 155 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
jeschli/5pkgs/firefox/firefox-with-config.nix
View File

@ -5,7 +5,7 @@
, MPlayerPlugin, ffmpeg, xorg, libpulseaudio, libcanberra-gtk2
, jrePlugin, icedtea_web
, bluejeans, djview4, adobe-reader
, google_talk_plugin, fribid, gnome3/*.gnome-shell*/
, fribid, gnome3/*.gnome-shell*/
, esteidfirefoxplugin ? ""
, browserpass, chrome-gnome-shell, uget-integrator, plasma-browser-integration, bukubrow
, udev
@ -82,7 +82,6 @@ let
++ lib.optional (cfg.enableMPlayer or false) (MPlayerPlugin browser)
++ lib.optional (supportsJDK && jre && jrePlugin ? mozillaPlugin) jrePlugin
++ lib.optional icedtea icedtea_web
++ lib.optional (cfg.enableGoogleTalkPlugin or false) google_talk_plugin
++ lib.optional (cfg.enableFriBIDPlugin or false) fribid
++ lib.optional (cfg.enableGnomeExtensions or false) gnome3.gnome-shell
++ lib.optional (cfg.enableBluejeans or false) bluejeans

9
krebs/3modules/exim-smarthost.nix
View File

@ -26,6 +26,7 @@ let
private_key = mkOption {
type = types.secret-file;
default = {
name = "exim.dkim_private_key/${config.domain}";
path = "/run/krebs.secret/${config.domain}.dkim_private_key";
owner.name = "exim";
source-path = toString <secrets> + "/${config.domain}.dkim.priv";
@ -115,8 +116,12 @@ let
}));
systemd.services = mkIf (cfg.dkim != []) {
exim = {
after = [ "secret.service" ];
requires = [ "secret.service" ];
after = flip map cfg.dkim (dkim:
config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
);
partOf = flip map cfg.dkim (dkim:
config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
);
};
};
krebs.exim = {

2
krebs/3modules/konsens.nix
View File

@ -56,7 +56,7 @@ let
systemd.services = mapAttrs' (name: repo:
nameValuePair "konsens-${name}" {
after = [ "network.target" "secret.service" ];
after = [ "network.target" ];
path = [ pkgs.git ];
restartIfChanged = false;
serviceConfig = {

9
krebs/3modules/repo-sync.nix
View File

@ -124,6 +124,7 @@ let
privateKeyFile = mkOption {
type = types.secret-file;
default = {
name = "repo-sync-key";
path = "${cfg.stateDir}/ssh.priv";
owner = cfg.user;
source-path = toString <secrets> + "/repo-sync.ssh.key";
@ -166,7 +167,13 @@ let
});
in nameValuePair "repo-sync-${name}" {
description = "repo-sync";
after = [ "network.target" "secret.service" ];
after = [
config.krebs.secret.files.repo-sync-key.service
"network.target"
];
partOf = [
config.krebs.secret.files.repo-sync-key.service
];
environment = {
GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i ${cfg.stateDir}/ssh.priv";

68
krebs/3modules/secret.nix
View File

@ -1,4 +1,5 @@
{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
with import <stockholm/lib>;
{ config, lib, pkgs, ... }: let
cfg = config.krebs.secret;
in {
options.krebs.secret = {
@ -8,32 +9,43 @@ in {
};
};
config = lib.mkIf (cfg.files != {}) {
systemd.services.secret = let
# TODO fail if two files have the same path but differ otherwise
files = unique (map (flip removeAttrs ["_module"])
(attrValues cfg.files));
in {
serviceConfig = {
Type = "oneshot";
RemainAfterExit = "yes";
SyslogIdentifier = "secret";
ExecStart = pkgs.writeDash "install-secret-files" ''
exit_code=0
${concatMapStringsSep "\n" (file: ''
${pkgs.coreutils}/bin/install \
-D \
--compare \
--verbose \
--mode=${shell.escape file.mode} \
--owner=${shell.escape file.owner.name} \
--group=${shell.escape file.group-name} \
${shell.escape file.source-path} \
${shell.escape file.path} \
|| exit_code=1
'') files}
exit $exit_code
'';
};
};
systemd.paths =
mapAttrs'
(name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
wantedBy = ["multi-user.target"];
pathConfig.PathChanged = file.source-path;
})
cfg.files;
systemd.services =
mapAttrs'
(name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
wantedBy = ["multi-user.target"];
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}";
};
})
cfg.files
//
mapAttrs'
(name: file: nameValuePair "secret-${systemd.encodeName name}" {
wantedBy = ["multi-user.target"];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = "yes";
ExecStart = toString [
"${pkgs.coreutils}/bin/install"
"-D"
"--compare"
"--verbose"
"--mode=${file.mode}"
"--owner=${file.owner.name}"
"--group=${file.group-name}"
file.source-path
file.path
];
};
})
cfg.files;
};
}

10
krebs/3modules/tinc.nix
View File

@ -158,6 +158,7 @@ let
privkey = mkOption {
type = types.secret-file;
default = {
name = "${tinc.config.netname}.rsa_key.priv";
path = "${tinc.config.user.home}/tinc.rsa_key.priv";
owner = tinc.config.user;
source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
@ -219,9 +220,14 @@ let
iproute = cfg.iproutePackage;
in {
description = "Tinc daemon for ${netname}";
after = [ "network.target" ];
after = [
config.krebs.secret.files."${netname}.rsa_key.priv".service
"network.target"
];
partOf = [
config.krebs.secret.files."${netname}.rsa_key.priv".service
];
wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ];
path = [ tinc iproute ];
serviceConfig = rec {
Restart = "always";

8
lass/2configs/binary-cache/server.nix
View File

@ -9,8 +9,12 @@
};
systemd.services.nix-serve = {
requires = ["secret.service"];
after = ["secret.service"];
after = [
config.krebs.secret.files.nix-serve-key.service
];
partOf = [
config.krebs.secret.files.nix-serve-key.service
];
};
krebs.secret.files.nix-serve-key = {
path = "/run/secret/nix-serve.key";

8
lass/2configs/websites/sqlBackup.nix
View File

@ -14,8 +14,12 @@
};
systemd.services.mysql = {
requires = [ "secret.service" ];
after = [ "secret.service" ];
after = [
config.krebs.secret.files.mysql_rootPassword.service
];
partOf = [
config.krebs.secret.files.mysql_rootPassword.service
];
};
lass.mysqlBackup = {

13
lass/3modules/ejabberd/default.nix
View File

@ -17,6 +17,7 @@ in {
certfile = mkOption {
type = types.secret-file;
default = {
name = "ejabberd-certfile";
path = "${cfg.user.home}/ejabberd.pem";
owner = cfg.user;
source-path = "/var/lib/acme/lassul.us/full.pem";
@ -25,6 +26,7 @@ in {
dhfile = mkOption {
type = types.secret-file;
default = {
name = "ejabberd-dhfile";
path = "${cfg.user.home}/dhparams.pem";
owner = cfg.user;
source-path = "/dev/null";
@ -74,8 +76,15 @@ in {
systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ];
after = [ "network.target" "secret.service" ];
after = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
"network.target"
];
partOf = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
];
serviceConfig = {
ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl foreground";

3
lib/default.nix
View File

@ -8,6 +8,9 @@ let
krebs = import ./krebs lib;
krops = import ../submodules/krops/lib;
shell = import ./shell.nix { inherit lib; };
systemd = {
encodeName = replaceChars ["/"] ["\\x2f"];
};
types = nixpkgs-lib.types // import ./types.nix { inherit lib; };
xml = import ./xml.nix { inherit lib; };

14
lib/types.nix
View File

@ -238,7 +238,7 @@ rec {
secret-file = submodule ({ config, ... }: {
options = {
name = mkOption {
type = filename;
type = pathname;
default = config._module.args.name;
};
path = mkOption {
@ -256,6 +256,10 @@ rec {
type = str;
default = "root";
};
service = mkOption {
type = systemd.unit-name;
default = "secret-${lib.systemd.encodeName config.name}.service";
};
source-path = mkOption {
type = str;
default = toString <secrets> + "/${config.name}";
@ -526,6 +530,14 @@ rec {
merge = mergeOneOption;
};
systemd.unit-name = mkOptionType {
name = "systemd unit name";
check = x:
test "^[0-9A-Za-z:_.\\-]+@?\\.(service|socket|device|mount|automount|swap|target|path|timer|slice|scope)$" x &&
stringLength x <= 256;
merge = mergeOneOption;
};
# RFC952, B. Lexical grammar, <hname>
hostname = mkOptionType {
name = "hostname";

8
makefu/2configs/binary-cache/server.nix
View File

@ -9,8 +9,12 @@
};
systemd.services.nix-serve = {
requires = ["secret.service"];
after = ["secret.service"];
after = [
config.krebs.secret.files.nix-serve-key.service
];
partOf = [
config.krebs.secret.files.nix-serve-key.service
];
};
krebs.secret.files.nix-serve-key = {
path = "/run/secret/nix-serve.key";

8
makefu/3modules/netdata.nix
View File

@ -71,8 +71,12 @@ in
};
config = mkIf cfg.enable {
systemd.services.netdata = {
requires = [ "secret.service" ];
after = [ "secret.service" ];
after = [
config.krebs.secret.files.netdata-stream.service
];
partOf = [
config.krebs.secret.files.netdata-stream.service
];
};
krebs.secret.files.netdata-stream = {
path = "/run/secret/netdata-stream.conf";

8
tv/2configs/binary-cache/default.nix
View File

@ -9,8 +9,12 @@
};
systemd.services.nix-serve = {
requires = ["secret.service"];
after = ["secret.service"];
after = [
config.krebs.secret.files.binary-cache-seckey.service
];
partOf = [
config.krebs.secret.files.binary-cache-seckey.service
];
};
krebs.secret.files.binary-cache-seckey = {

13
tv/3modules/charybdis/default.nix
View File

@ -17,6 +17,7 @@ in {
ssl_dh_params = mkOption {
type = types.secret-file;
default = {
name = "charybdis-ssl_dh_params";
path = "${cfg.user.home}/dh.pem";
owner = cfg.user;
source-path = toString <secrets> + "/charybdis.dh.pem";
@ -25,6 +26,7 @@ in {
ssl_private_key = mkOption {
type = types.secret-file;
default = {
name = "charybdis-ssl_private_key";
path = "${cfg.user.home}/ssl.key.pem";
owner = cfg.user;
source-path = toString <secrets> + "/charybdis.key.pem";
@ -51,8 +53,15 @@ in {
systemd.services.charybdis = {
wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ];
after = [ "network-online.target" "secret.service" ];
after = [
config.krebs.secret.files.charybdis-ssl_dh_params.service
config.krebs.secret.files.charybdis-ssl_private_key.service
"network-online.target"
];
partOf = [
config.krebs.secret.files.charybdis-ssl_dh_params.service
config.krebs.secret.files.charybdis-ssl_private_key.service
];
environment = {
BANDB_DBPATH = "${cfg.user.home}/ban.db";
};

13
tv/3modules/ejabberd/default.nix
View File

@ -18,6 +18,7 @@ in {
certfile = mkOption {
type = types.secret-file;
default = {
name = "ejabberd-certfile";
path = "${cfg.user.home}/ejabberd.pem";
owner = cfg.user;
source-path = toString <secrets> + "/ejabberd.pem";
@ -26,6 +27,7 @@ in {
dhfile = mkOption {
type = types.secret-file;
default = {
name = "ejabberd-dhfile";
path = "${cfg.user.home}/dhparams.pem";
owner = cfg.user;
source-path = "/dev/null";
@ -95,8 +97,15 @@ in {
systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ];
requires = [ "secret.service" ];
after = [ "network.target" "secret.service" ];
after = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
"network.target"
];
partOf = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
];
serviceConfig = {
ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}";
ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground";

13
tv/3modules/x0vncserver.nix
View File

@ -12,6 +12,7 @@ in {
enable = mkEnableOption "tv.x0vncserver";
pwfile = mkOption {
default = {
name = "x0vncserver-pwfile";
owner = cfg.user;
path = "${cfg.user.home}/.vncpasswd";
source-path = toString <secrets> + "/vncpasswd";
@ -36,8 +37,16 @@ in {
x0vncserver-pwfile = cfg.pwfile;
};
systemd.services.x0vncserver = {
after = [ "graphical.target" "secret.service" ];
requires = [ "graphical.target" "secret.service" ];
after = [
config.krebs.secret.files.x0vncserver-pwfile.service
"graphical.target"
];
partOf = [
config.krebs.secret.files.x0vncserver-pwfile.service
];
requires = [
"graphical.target"
];
serviceConfig = {
ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [
"-display ${cfg.display}"