lass: migrate away

6 files changed, 0 insertions, 560 deletions

diff --git a/lass/2configs/green-hosts/cryfs.nix b/lass/2configs/green-hosts/cryfs.nix
deleted file mode 100644
index d60dc5951..000000000
--- a/lass/2configs/green-hosts/cryfs.nix
+++ /dev/null
@@ -1,95 +0,0 @@
-# seems to work, very slow though
-
-{ config, lib, pkgs, ... }:
-with import <stockholm/lib>;
-
-let
-
-  cname = "green-cryfs";
-
-in {
-  imports = [
-    <stockholm/lass/2configs/container-networking.nix>
-    <stockholm/lass/2configs/syncthing.nix>
-  ];
-
-  programs.fuse.userAllowOther = true;
-
-  services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/cryfs" = {
-    devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
-    ignorePerms = false;
-  };
-
-  lass.bindfs."/var/lib/sync-containers/${cname}/cryfs" = {
-    source = "/var/lib/sync-containers/${cname}/cryfs";
-    options = [
-      "-M ${toString config.users.users.syncthing.uid} -u root -g root"
-    ];
-  };
-
-
-  systemd.services."container@${cname}".reloadIfChanged = mkForce false;
-  containers.${cname} = {
-    config = { ... }: {
-      environment.systemPackages = [
-        pkgs.git
-        pkgs.rxvt-unicode-unwrapped.terminfo
-      ];
-      services.openssh.enable = true;
-      users.users.root.openssh.authorizedKeys.keys = [
-        config.krebs.users.lass.pubkey
-      ];
-      system.activationScripts.fuse = {
-        text = ''
-          ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
-        '';
-        deps = [];
-      };
-    };
-    allowedDevices = [
-      { modifier = "rwm"; node = "/dev/fuse"; }
-    ];
-    autoStart = false;
-    enableTun = true;
-    privateNetwork = true;
-    hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
-    localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
-  };
-
-  environment.systemPackages = [
-    (pkgs.writeDashBin "init-${cname}" ''
-      set -euf
-      set -x
-
-      mkdir -p /var/lib/sync-containers/${cname}/cryfs
-    '')
-    (pkgs.writeDashBin "start-${cname}" ''
-      set -euf
-      set -x
-
-      mkdir -p /var/lib/containers/${cname}/var/state
-
-      STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
-      if [ "$STATE" = 'down' ]; then
-        ${pkgs.nixos-container}/bin/nixos-container start ${cname}
-      fi
-
-      ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
-        set -x
-
-        mkdir -p /var/state/var_src
-        ln -sfTr /var/state/var_src /var/src
-        touch /etc/NIXOS
-      ''}
-
-      if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
-        ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
-      fi
-    '')
-    (pkgs.writeDashBin "stop-${cname}" ''
-      set -euf
-
-      ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
-    '')
-  ];
-}
diff --git a/lass/2configs/green-hosts/ecryptfs.nix b/lass/2configs/green-hosts/ecryptfs.nix
deleted file mode 100644
index 2c335f6f2..000000000
--- a/lass/2configs/green-hosts/ecryptfs.nix
+++ /dev/null
@@ -1,99 +0,0 @@
-
-{ config, lib, pkgs, ... }:
-with import <stockholm/lib>;
-
-let
-
-  cname = "green";
-
-in {
-  imports = [
-    <stockholm/lass/2configs/container-networking.nix>
-    <stockholm/lass/2configs/syncthing.nix>
-  ];
-
-  programs.fuse.userAllowOther = true;
-
-  services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/ecryptfs" = {
-    devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
-    ignorePerms = false;
-  };
-
-  krebs.permown."/var/lib/sync-containers/${cname}/ecryptfs" = {
-    file-mode = "u+rw";
-    directory-mode = "u+rwx";
-    owner = "syncthing";
-    keepGoing = false;
-  };
-
-  systemd.services."container@${cname}".reloadIfChanged = mkForce false;
-  containers.${cname} = {
-    config = { ... }: {
-      environment.systemPackages = [
-        pkgs.git
-        pkgs.rxvt-unicode-unwrapped.terminfo
-      ];
-      services.openssh.enable = true;
-      users.users.root.openssh.authorizedKeys.keys = [
-        config.krebs.users.lass.pubkey
-      ];
-      system.activationScripts.fuse = {
-        text = ''
-          ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
-        '';
-        deps = [];
-      };
-    };
-    allowedDevices = [
-      { modifier = "rwm"; node = "/dev/fuse"; }
-    ];
-    autoStart = false;
-    enableTun = true;
-    privateNetwork = true;
-    hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
-    localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
-  };
-
-  environment.systemPackages = [
-    pkgs.ecryptfs
-    pkgs.keyutils
-    (pkgs.writeDashBin "start-${cname}" ''
-      set -euf
-      set -x
-
-      mkdir -p /var/lib/containers/${cname}/var/state
-
-      if ! mount | grep -q '/var/lib/sync-containers/${cname}/ecryptfs on /var/lib/containers/${cname}/var/state type ecryptfs'; then
-        if [ -e /var/lib/sync-containers/${cname}/ecryptfs/.cfg.json ]; then
-          ${pkgs.ecrypt}/bin/ecrypt mount /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
-        else
-          ${pkgs.ecrypt}/bin/ecrypt init /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
-        fi
-      fi
-
-      STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
-      if [ "$STATE" = 'down' ]; then
-        ${pkgs.nixos-container}/bin/nixos-container start ${cname}
-      fi
-
-      ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
-        set -x
-
-        mkdir -p /var/state/var_src
-        ln -sfTr /var/state/var_src /var/src
-        touch /etc/NIXOS
-      ''}
-
-      if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
-        ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
-      fi
-    '')
-    (pkgs.writeDashBin "stop-${cname}" ''
-      set -euf
-
-      ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
-      ${pkgs.ecrypt}/bin/ecrypt unmount /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
-    '')
-  ];
-}
-
diff --git a/lass/2configs/green-hosts/plain-bindfs.nix b/lass/2configs/green-hosts/plain-bindfs.nix
deleted file mode 100644
index 81d8f20c2..000000000
--- a/lass/2configs/green-hosts/plain-bindfs.nix
+++ /dev/null
@@ -1,90 +0,0 @@
-# this seems to work, sadly there are no inotify events on the state directory because bindfs hides them,
-
-{ config, lib, pkgs, ... }:
-with import <stockholm/lib>;
-
-let
-
-  cname = "green-plain";
-
-in {
-  imports = [
-    <stockholm/lass/2configs/container-networking.nix>
-    <stockholm/lass/2configs/syncthing.nix>
-  ];
-
-  programs.fuse.userAllowOther = true;
-
-  services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
-    devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
-    ignorePerms = false;
-  };
-
-  lass.bindfs."/var/lib/containers/${cname}/var/state" = {
-    source = "/var/lib/containers/${cname}/var/state";
-    options = [
-      "-M ${toString config.users.users.syncthing.uid} -u root -g root"
-    ];
-  };
-
-
-  systemd.services."container@${cname}".reloadIfChanged = mkForce false;
-  containers.${cname} = {
-    config = { ... }: {
-      environment.systemPackages = [
-        pkgs.git
-        pkgs.rxvt-unicode-unwrapped.terminfo
-      ];
-      services.openssh.enable = true;
-      users.users.root.openssh.authorizedKeys.keys = [
-        config.krebs.users.lass.pubkey
-      ];
-      system.activationScripts.fuse = {
-        text = ''
-          ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
-        '';
-        deps = [];
-      };
-    };
-    allowedDevices = [
-      { modifier = "rwm"; node = "/dev/fuse"; }
-    ];
-    autoStart = false;
-    enableTun = true;
-    privateNetwork = true;
-    hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
-    localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
-  };
-
-  environment.systemPackages = [
-    (pkgs.writeDashBin "start-${cname}" ''
-      set -euf
-      set -x
-
-      mkdir -p /var/lib/containers/${cname}/var/state
-
-      STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
-      if [ "$STATE" = 'down' ]; then
-        ${pkgs.nixos-container}/bin/nixos-container start ${cname}
-      fi
-
-      ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
-        set -x
-
-        mkdir -p /var/state/var_src
-        ln -sfTr /var/state/var_src /var/src
-        touch /etc/NIXOS
-      ''}
-
-      if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
-        ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
-      fi
-    '')
-    (pkgs.writeDashBin "stop-${cname}" ''
-      set -euf
-
-      ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
-    '')
-  ];
-}
-
diff --git a/lass/2configs/green-hosts/plain-permown.nix b/lass/2configs/green-hosts/plain-permown.nix
deleted file mode 100644
index 21a7d0085..000000000
--- a/lass/2configs/green-hosts/plain-permown.nix
+++ /dev/null
@@ -1,88 +0,0 @@
-# this seems to work fine, downsides are, all state is owned by syncthing and could be read by the guests syncthing
-
-
-{ config, lib, pkgs, ... }:
-with import <stockholm/lib>;
-
-let
-
-  cname = "green-plain";
-
-in {
-  imports = [
-    <stockholm/lass/2configs/container-networking.nix>
-    <stockholm/lass/2configs/syncthing.nix>
-  ];
-
-  services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
-    devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
-    ignorePerms = false;
-  };
-
-  krebs.permown."/var/lib/containers/${cname}/var/state" = {
-    file-mode = "u+rw";
-    directory-mode = "u+rwx";
-    owner = "syncthing";
-    keepGoing = true;
-  };
-
-  systemd.services."container@${cname}".reloadIfChanged = mkForce false;
-  containers.${cname} = {
-    config = { ... }: {
-      environment.systemPackages = [
-        pkgs.git
-        pkgs.rxvt-unicode-unwrapped.terminfo
-      ];
-      services.openssh.enable = true;
-      users.users.root.openssh.authorizedKeys.keys = [
-        config.krebs.users.lass.pubkey
-      ];
-      system.activationScripts.fuse = {
-        text = ''
-          ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
-        '';
-        deps = [];
-      };
-    };
-    allowedDevices = [
-      { modifier = "rwm"; node = "/dev/fuse"; }
-    ];
-    autoStart = false;
-    enableTun = true;
-    privateNetwork = true;
-    hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
-    localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
-  };
-
-  environment.systemPackages = [
-    (pkgs.writeDashBin "start-${cname}" ''
-      set -euf
-      set -x
-
-      mkdir -p /var/lib/containers/${cname}/var/state
-
-      STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
-      if [ "$STATE" = 'down' ]; then
-        ${pkgs.nixos-container}/bin/nixos-container start ${cname}
-      fi
-
-      ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
-        set -x
-
-        mkdir -p /var/state/var_src
-        ln -sfTr /var/state/var_src /var/src
-        touch /etc/NIXOS
-      ''}
-
-      if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
-        ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
-      fi
-    '')
-    (pkgs.writeDashBin "stop-${cname}" ''
-      set -euf
-
-      ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
-    '')
-  ];
-}
-
diff --git a/lass/2configs/green-hosts/plain.nix b/lass/2configs/green-hosts/plain.nix
deleted file mode 100644
index 58f54b748..000000000
--- a/lass/2configs/green-hosts/plain.nix
+++ /dev/null
@@ -1,87 +0,0 @@
-{ config, lib, pkgs, ... }:
-with import <stockholm/lib>;
-
-let
-
-  cname = "green-plain";
-
-in {
-  imports = [
-    <stockholm/lass/2configs/container-networking.nix>
-    <stockholm/lass/2configs/syncthing.nix>
-  ];
-
-  programs.fuse.userAllowOther = true;
-
-  services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
-    devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
-    ignorePerms = false;
-  };
-
-  krebs.permown."/var/lib/containers/${cname}/var/state" = {
-    file-mode = "u+rw";
-    directory-mode = "u+rwx";
-    owner = "syncthing";
-    keepGoing = true;
-  };
-
-  systemd.services."container@${cname}".reloadIfChanged = mkForce false;
-  containers.${cname} = {
-    config = { ... }: {
-      environment.systemPackages = [
-        pkgs.git
-        pkgs.rxvt-unicode-unwrapped.terminfo
-      ];
-      services.openssh.enable = true;
-      users.users.root.openssh.authorizedKeys.keys = [
-        config.krebs.users.lass.pubkey
-      ];
-      system.activationScripts.fuse = {
-        text = ''
-          ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
-        '';
-        deps = [];
-      };
-    };
-    allowedDevices = [
-      { modifier = "rwm"; node = "/dev/fuse"; }
-    ];
-    autoStart = false;
-    enableTun = true;
-    privateNetwork = true;
-    hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
-    localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
-  };
-
-  environment.systemPackages = [
-    (pkgs.writeDashBin "start-${cname}" ''
-      set -euf
-      set -x
-
-      mkdir -p /var/lib/containers/${cname}/var/state
-
-      STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
-      if [ "$STATE" = 'down' ]; then
-        ${pkgs.nixos-container}/bin/nixos-container start ${cname}
-      fi
-
-      ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
-        set -x
-
-        mkdir -p /var/state/var_src
-        ln -sfTr /var/state/var_src /var/src
-        touch /etc/NIXOS
-      ''}
-
-      if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
-        ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
-      fi
-    '')
-    (pkgs.writeDashBin "stop-${cname}" ''
-      set -euf
-
-      ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
-    '')
-  ];
-}
-
diff --git a/lass/2configs/green-hosts/securefs.nix b/lass/2configs/green-hosts/securefs.nix
deleted file mode 100644
index a69cfe6ca..000000000
--- a/lass/2configs/green-hosts/securefs.nix
+++ /dev/null
@@ -1,101 +0,0 @@
-# broken, muchsync cant sync into the folders which should be handles by bindfs
-# ls -la also does not show the full directory permissions
-{ config, lib, pkgs, ... }:
-with import <stockholm/lib>;
-
-let
-
-  cname = "green";
-
-in {
-  imports = [
-    <stockholm/lass/2configs/container-networking.nix>
-    <stockholm/lass/2configs/syncthing.nix>
-  ];
-
-  programs.fuse.userAllowOther = true;
-
-  services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/securefs" = {
-    devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
-    ignorePerms = false;
-  };
-
-  krebs.permown."/var/lib/sync-containers/${cname}/securefs" = {
-    file-mode = "u+rw";
-    directory-mode = "u+rwx";
-    owner = "syncthing";
-    keepGoing = false;
-  };
-
-  systemd.services."container@${cname}".reloadIfChanged = mkForce false;
-  containers.${cname} = {
-    config = { ... }: {
-      environment.systemPackages = [
-        pkgs.git
-        pkgs.rxvt-unicode-unwrapped.terminfo
-      ];
-      services.openssh.enable = true;
-      users.users.root.openssh.authorizedKeys.keys = [
-        config.krebs.users.lass.pubkey
-      ];
-      system.activationScripts.fuse = {
-        text = ''
-          ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
-        '';
-        deps = [];
-      };
-    };
-    allowedDevices = [
-      { modifier = "rwm"; node = "/dev/fuse"; }
-    ];
-    autoStart = false;
-    enableTun = true;
-    privateNetwork = true;
-    hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
-    localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
-  };
-
-  environment.systemPackages = [
-    (pkgs.writeDashBin "start-${cname}" ''
-      set -euf
-      set -x
-
-      mkdir -p /var/lib/containers/${cname}/var/state
-
-      if ! mount | grep -q 'securefs on /var/lib/containers/${cname}/var/state type fuse.securefs'; then
-        if ! ${pkgs.securefs}/bin/securefs info /var/lib/sync-containers/${cname}/securefs; then
-          ${pkgs.securefs}/bin/securefs create --format 4 /var/lib/sync-containers/${cname}/securefs
-        fi
-
-        ${pkgs.securefs}/bin/securefs mount -b \
-          -o allow_other -o default_permissions \
-          --log /var/lib/sync-containers/${cname}/securefs.log \
-          /var/lib/sync-containers/${cname}/securefs /var/lib/containers/${cname}/var/state
-      fi
-
-      STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
-      if [ "$STATE" = 'down' ]; then
-        ${pkgs.nixos-container}/bin/nixos-container start ${cname}
-      fi
-
-      ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
-        set -x
-
-        mkdir -p /var/state/var_src
-        ln -sfTr /var/state/var_src /var/src
-        touch /etc/NIXOS
-      ''}
-
-      if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
-        ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
-      fi
-    '')
-    (pkgs.writeDashBin "stop-${cname}" ''
-      set -euf
-
-      ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
-      umount /var/lib/containers/${cname}/var/state
-    '')
-  ];
-}
-