Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge remote-tracking branch 'cd/master'

Browse Source
This commit is contained in:
makefu 2015-07-24 21:04:22 +02:00
commit e1f4ef731f
20 changed files with 182 additions and 138 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
1systems/tv/cd.nix
View File

@ -13,7 +13,7 @@ in
../../2configs/tv/base.nix
../../2configs/tv/consul-server.nix
../../2configs/tv/exim-smarthost.nix
../../2configs/tv/git-public.nix
../../2configs/tv/git.nix
{
imports = [ ../../2configs/tv/charybdis.nix ];
tv.charybdis = {
@ -22,14 +22,12 @@ in
};
}
{
imports = [ ../../3modules/tv/ejabberd.nix ];
tv.ejabberd = {
enable = true;
hosts = [ "jabber.viljetic.de" ];
};
}
{
imports = [ ../../3modules/krebs/github-hosts-sync.nix ];
krebs.github-hosts-sync.enable = true;
tv.iptables.input-internet-accept-new-tcp =
singleton config.krebs.github-hosts-sync.port;
@ -39,7 +37,6 @@ in
tv.identity.self = config.tv.identity.hosts.cd;
}
{
imports = [ ../../3modules/tv/iptables.nix ];
tv.iptables = {
enable = true;
input-internet-accept-new-tcp = [
@ -55,19 +52,11 @@ in
};
}
{
imports = [
../../3modules/tv/iptables.nix
../../3modules/krebs/nginx.nix
];
tv.iptables.input-internet-accept-new-tcp = singleton "http";
krebs.nginx.servers.cgit.server-names = singleton "cgit.cd.viljetic.de";
}
{
# TODO make public_html also available to cd, cd.retiolum (AKA default)
imports = [
../../3modules/tv/iptables.nix
../../3modules/krebs/nginx.nix
];
tv.iptables.input-internet-accept-new-tcp = singleton "http";
krebs.nginx.servers.public_html = {
server-names = singleton "cd.viljetic.de";
@ -86,10 +75,8 @@ in
};
}
{
imports = [ ../../3modules/tv/retiolum.nix ];
tv.retiolum = {
krebs.retiolum = {
enable = true;
hosts = ../../Zhosts;
connectTo = [
"fastpoke"
"pigstarter"

7
1systems/tv/mkdir.nix
View File

@ -9,13 +9,12 @@ with lib;
../../2configs/tv/base.nix
../../2configs/tv/consul-server.nix
../../2configs/tv/exim-smarthost.nix
../../2configs/tv/git-public.nix
../../2configs/tv/git.nix
{
imports = [ ../../2configs/tv/identity.nix ];
tv.identity.self = config.tv.identity.hosts.mkdir;
}
{
imports = [ ../../3modules/tv/iptables.nix ];
tv.iptables = {
enable = true;
input-internet-accept-new-tcp = [
@ -29,10 +28,8 @@ with lib;
};
}
{
imports = [ ../../3modules/tv/retiolum.nix ];
tv.retiolum = {
krebs.retiolum = {
enable = true;
hosts = ../../Zhosts;
connectTo = [
"cd"
"fastpoke"

8
1systems/tv/nomic.nix
View File

@ -8,13 +8,12 @@ with lib;
../../2configs/tv/base.nix
../../2configs/tv/consul-server.nix
../../2configs/tv/exim-retiolum.nix
../../2configs/tv/git-public.nix
../../2configs/tv/git.nix
{
imports = [ ../../2configs/tv/identity.nix ];
tv.identity.self = config.tv.identity.hosts.nomic;
}
{
imports = [ ../../3modules/tv/iptables.nix ];
tv.iptables = {
enable = true;
input-internet-accept-new-tcp = [
@ -26,7 +25,6 @@ with lib;
};
}
{
imports = [ ../../3modules/krebs/nginx.nix ];
krebs.nginx = {
enable = true;
servers.default.locations = [
@ -37,10 +35,8 @@ with lib;
};
}
{
imports = [ ../../3modules/tv/retiolum.nix ];
tv.retiolum = {
krebs.retiolum = {
enable = true;
hosts = ../../Zhosts;
connectTo = [
"gum"
"pigstarter"

7
1systems/tv/rmdir.nix
View File

@ -9,13 +9,12 @@ with lib;
../../2configs/tv/base.nix
../../2configs/tv/consul-server.nix
../../2configs/tv/exim-smarthost.nix
../../2configs/tv/git-public.nix
../../2configs/tv/git.nix
{
imports = [ ../../2configs/tv/identity.nix ];
tv.identity.self = config.tv.identity.hosts.rmdir;
}
{
imports = [ ../../3modules/tv/iptables.nix ];
tv.iptables = {
enable = true;
input-internet-accept-new-tcp = [
@ -29,10 +28,8 @@ with lib;
};
}
{
imports = [ ../../3modules/tv/retiolum.nix ];
tv.retiolum = {
krebs.retiolum = {
enable = true;
hosts = ../../Zhosts;
connectTo = [
"cd"
"mkdir"

12
1systems/tv/wu.nix
View File

@ -12,8 +12,7 @@ in
../../2configs/tv/base.nix
../../2configs/tv/consul-client.nix
../../2configs/tv/exim-retiolum.nix
../../2configs/tv/git-public.nix
# TODO git-private.nix
../../2configs/tv/git.nix
../../2configs/tv/mail-client.nix
../../2configs/tv/xserver.nix
../../2configs/tv/synaptics.nix # TODO w110er if xserver is enabled
@ -24,7 +23,7 @@ in
{
environment.systemPackages = with pkgs; [
# shitment
# stockholm
git
gnumake
parallel
@ -122,7 +121,6 @@ in
];
}
{
imports = [ ../../3modules/tv/iptables.nix ];
tv.iptables = {
enable = true;
input-internet-accept-new-tcp = [
@ -134,7 +132,6 @@ in
};
}
{
imports = [ ../../3modules/krebs/nginx.nix ];
krebs.nginx = {
enable = true;
servers.default.locations = [
@ -145,10 +142,8 @@ in
};
}
{
imports = [ ../../3modules/tv/retiolum.nix ];
tv.retiolum = {
krebs.retiolum = {
enable = true;
hosts = ../../Zhosts;
connectTo = [
"gum"
"pigstarter"
@ -156,7 +151,6 @@ in
};
}
{
imports = [ ../../3modules/krebs/urlwatch.nix ];
krebs.urlwatch = {
enable = true;
mailto = "tv@wu.retiolum"; # TODO

1
2configs/tv/consul-server.nix
View File

@ -1,7 +1,6 @@
{ config, ... }:
{
imports = [ ../../3modules/tv/consul.nix ];
tv.consul = rec {
enable = true;

4
2configs/tv/exim-retiolum.nix
View File

@ -4,9 +4,9 @@
services.exim =
# This configuration makes only sense for retiolum-enabled hosts.
# TODO modular configuration
assert config.tv.retiolum.enable;
assert config.krebs.retiolum.enable;
let
# TODO get the hostname from config.tv.retiolum.
# TODO get the hostname from config.krebs.retiolum.
retiolumHostname = "${config.networking.hostName}.retiolum";
in
{ enable = true;

41
2configs/tv/git-public.nix → 2configs/tv/git.nix
View File

@ -1,18 +1,22 @@
{ config, lib, pkgs, ... }:
with import ../../4lib/tv { inherit lib pkgs; };
let
out = {
imports = [ ../../3modules/krebs/git.nix ];
krebs.git = {
enable = true;
root-title = "public repositories at ${config.tv.identity.self.name}";
root-desc = "keep calm and engage";
inherit repos rules users;
inherit repos rules;
};
};
repos = public-repos;
repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) (
public-repos //
optionalAttrs config.tv.identity.self.secure restricted-repos
);
rules = concatMap make-rules (attrValues repos);
public-repos = mapAttrs make-public-repo {
@ -37,13 +41,14 @@ let
xintmap = {};
};
# TODO move users to separate module
users = mapAttrs make-user {
tv = ../../Zpubkeys/tv_wu.ssh.pub;
lass = ../../Zpubkeys/lass.ssh.pub;
uriel = ../../Zpubkeys/uriel.ssh.pub;
makefu = ../../Zpubkeys/makefu.ssh.pub;
restricted-repos = mapAttrs make-restricted-repo (
{
brain = {
collaborators = with config.krebs.users; [ lass makefu ];
};
} //
import /root/src/secrets/repos.nix { inherit config lib pkgs; }
);
make-public-repo = name: { desc ? null, ... }: {
inherit name desc;
@ -58,8 +63,14 @@ let
};
};
make-restricted-repo = name: { desc ? null, ... }: {
inherit name desc;
public = false;
hooks = {}; # TODO default
};
make-rules =
with git // users;
with git // config.krebs.users;
repo:
singleton {
user = tv;
@ -70,11 +81,11 @@ let
user = [ lass makefu uriel ];
repo = [ repo ];
perm = fetch;
};
make-user = name: pubkey-file: {
inherit name;
pubkey = readFile pubkey-file;
} ++
optional (length (repo.collaborators or []) > 0) {
user = repo.collaborators;
repo = [ repo ];
perm = fetch;
};
in out

3
2configs/tv/identity.nix
View File

@ -1,7 +1,6 @@
{ config, ... }:
{
imports = [ ../../3modules/tv/identity.nix ];
tv.identity = {
enable = true;
search = "retiolum";
@ -99,6 +98,7 @@
'';
};
};
secure = true;
};
rmdir = {
cores = 1;
@ -154,6 +154,7 @@
'';
};
};
secure = true;
};
};
};

43
3modules/krebs/default.nix Normal file
View File

@ -0,0 +1,43 @@
{ config, lib, ... }:
with import ../../4lib/krebs { inherit lib; };
let
cfg = config.krebs;
out = {
imports = [
./github-hosts-sync.nix
./git.nix
./nginx.nix
./retiolum.nix
./urlwatch.nix
];
options.krebs = api;
config = mkIf cfg.enable imp;
};
api = {
users = mkOption {
type = with types; attrsOf user;
default = addNames {
lass = {
pubkey = readFile ../../Zpubkeys/lass.ssh.pub;
};
makefu = {
pubkey = readFile ../../Zpubkeys/makefu.ssh.pub;
};
tv = {
pubkey = readFile ../../Zpubkeys/tv_wu.ssh.pub;
};
uriel = {
pubkey = readFile ../../Zpubkeys/uriel.ssh.pub;
};
};
};
};
imp = {
};
in
out

11
3modules/krebs/git.nix
View File

@ -6,8 +6,7 @@
# TODO when authorized_keys changes, then restart ssh
# (or kill already connected users somehow)
with builtins;
with lib;
with import ../../4lib/krebs { inherit lib; };
let
cfg = config.krebs.git;
@ -127,9 +126,6 @@ let
rules = mkOption {
type = types.unspecified;
};
users = mkOption {
type = types.unspecified;
};
};
git-imp = {
@ -157,7 +153,8 @@ let
name = "git";
shell = "/bin/sh";
openssh.authorizedKeys.keys =
mapAttrsToList (_: makeAuthorizedKey git-ssh-command) cfg.users;
mapAttrsToList (_: makeAuthorizedKey git-ssh-command)
config.krebs.users;
uid = 129318403; # genid git
};
};
@ -263,7 +260,7 @@ let
isPublicRepo = getAttr "public"; # TODO this is also in ./cgit.nix
makeAuthorizedKey = git-ssh-command: user@{ name, pubkey }:
makeAuthorizedKey = git-ssh-command: user@{ name, pubkey, ... }:
# TODO assert name
# TODO assert pubkey
let

30
3modules/krebs/retiolum.nix
View File

@ -57,9 +57,9 @@ let
};
hosts = mkOption {
default = null;
type = with types; either package path;
default = ../../Zhosts;
description = ''
Hosts package or path to use.
If a path is given, then it will be used to generate an ad-hoc package.
'';
};
@ -131,24 +131,20 @@ let
};
tinc = cfg.tincPackage;
hostsType = builtins.typeOf cfg.hosts;
hosts =
if hostsType == "package" then
# use package as is
cfg.hosts
else if hostsType == "path" then
# use path to generate a package
pkgs.stdenv.mkDerivation {
hosts = getAttr (typeOf cfg.hosts) {
package = cfg.hosts;
path = pkgs.stdenv.mkDerivation {
name = "custom-retiolum-hosts";
src = cfg.hosts;
installPhase = ''
mkdir $out
find . -name .git -prune -o -type f -print0 | xargs -0 cp --target-directory $out
find . -name .git -prune -o -type f -print0 \
| xargs -0 cp --target-directory $out
'';
}
else
abort "The option `services.retiolum.hosts' must be set to a package or a path"
;
};
};
iproute = cfg.iproutePackage;
retiolumExtraHosts = import (pkgs.runCommand "retiolum-etc-hosts"
@ -226,5 +222,5 @@ let
chmod +x $out/tinc-up
'';
in
out
in out

1
3modules/tv/consul.nix
View File

@ -10,7 +10,6 @@ let
cfg = config.tv.consul;
out = {
imports = [ ../../3modules/tv/iptables.nix ];
options.tv.consul = api;
config = mkIf cfg.enable (mkMerge [
imp

10
3modules/tv/default.nix Normal file
View File

@ -0,0 +1,10 @@
_:
{
imports = [
./consul.nix
./ejabberd.nix
./identity.nix
./iptables.nix
];
}

29
3modules/tv/retiolum.nix
View File

@ -1,29 +0,0 @@
{ config, lib, ... }:
with lib;
let
cfg = config.tv.retiolum;
out = {
imports = [ ../../3modules/krebs/retiolum.nix ];
options.tv.retiolum = api;
config = mkIf cfg.enable imp;
};
api = {
enable = mkEnableOption "tv.retiolum";
connectTo = mkOption {
type = with types; listOf str;
};
hosts = mkOption {
type = types.path;
};
};
imp = {
krebs.retiolum = cfg;
};
in out

10
4lib/krebs/default.nix
View File

@ -1,6 +1,14 @@
{ lib, ... }:
builtins // lib // {
with builtins;
with lib;
builtins // lib // rec {
addName = name: set:
set // { inherit name; };
addNames = mapAttrs addName;
types = import ./types.nix { inherit lib; };

20
4lib/krebs/types.nix
View File

@ -20,6 +20,15 @@ types // rec {
type = attrsOf net;
apply = x: assert hasAttr "retiolum" x; x;
};
secure = mkOption {
type = bool;
default = false;
description = ''
If true, then the host is capable of keeping secret information.
TODO define minimum requirements for secure hosts
'';
};
};
};
@ -72,6 +81,17 @@ types // rec {
merge = mergeOneOption;
};
user = submodule {
options = {
name = mkOption {
type = str; # TODO
};
pubkey = mkOption {
type = str;
};
};
};
# TODO
addr = str;
addr4 = str;

7
4lib/tv/default.nix
View File

@ -15,16 +15,9 @@ krebs // rec {
inherit pkgs;
};
addName = name: set:
set // { inherit name; };
addNames = mapAttrs addName;
# "7.4.335" -> "74"
majmin = with lib; x : concatStrings (take 2 (splitString "." x));
concat = xs :
if xs == []
then ""

27
Makefile
View File

@ -41,13 +41,14 @@ deploy:;@
"$$src/" "$$deploy_host:$$dst"
)}
prepush /root/src/shitment "$$PWD"
prepush /root/src/stockholm "$$PWD"
prepush /root/src/secrets "$$secrets_dir"
ssh -S none "$$deploy_host" -T env \
nixpkgs_url="$$nixpkgs_url" \
nixpkgs_rev="$$nixpkgs_rev" \
system_name="$$system_name" \
user_name="$$LOGNAME" \
sh -euf \
<<-\EOF
prefetch(){(
@ -77,26 +78,30 @@ deploy:;@
prefetch /root/src/nixpkgs "$$nixpkgs_url" "$$nixpkgs_rev"
echo build system...
NIXOS_CONFIG=/root/src/shitment/1systems/$(LOGNAME)/$$system_name.nix \
NIX_PATH=src \
nix-build -Q -A system '<nixpkgs/nixos>'
NIX_PATH=/root/src \
nix-build \
-Q \
-A system \
'<stockholm>' \
--argstr user-name "$$user_name" \
--argstr system-name "$$system_name"
result/bin/switch-to-configuration switch
EOF
.PHONY: eval
eval:
@nix-instantiate \
@
NIX_PATH=stockholm=$$PWD:$$NIX_PATH \
nix-instantiate \
--json \
--eval \
--strict \
-A "$$get" \
-E '
import <nixpkgs/nixos/lib/eval-config.nix> {
system = builtins.currentSystem;
modules = [ ./1systems/$(LOGNAME)/$(system).nix ];
}
' | jq -r .
'<stockholm>' \
--argstr user-name "$$LOGNAME" \
--argstr system-name "$$system" \
| jq -r .
else
$(error unbound variable: system[s])
endif

20
default.nix Normal file
View File

@ -0,0 +1,20 @@
{ user-name, system-name }:
let
eval = import <nixpkgs/nixos/lib/eval-config.nix> {
system = builtins.currentSystem;
modules = [
(./1systems + "/${user-name}/${system-name}.nix")
(./3modules/krebs)
(./3modules + "/${user-name}")
];
};
in
{
inherit (eval) config options;
system = eval.config.system.build.toplevel;
}