Merge remote-tracking branch 'lass/master'

19 files changed, 434 insertions, 247 deletions

diff --git a/lass/2configs/AP.nix b/lass/2configs/AP.nix
index dfffbfdf9..e38475381 100644
--- a/lass/2configs/AP.nix
+++ b/lass/2configs/AP.nix
@@ -68,8 +68,8 @@ in {
     { v6 = false; predicate = "-o br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
     { v6 = false; predicate = "-i br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
   ];
-  krebs.iptables.tables.nat.PREROUTING.rules = [
-    { v6 = false; predicate = "-s 10.99.0.0/24"; target = "ACCEPT"; precedence = 1000; }
+  krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
+    { v6 = false; predicate = "-s 10.99.0.0/24"; target = "ACCEPT"; }
   ];
   krebs.iptables.tables.nat.POSTROUTING.rules = [
     #TODO find out what this is about?
diff --git a/lass/2configs/autotether.nix b/lass/2configs/autotether.nix
new file mode 100644
index 000000000..98712303e
--- /dev/null
+++ b/lass/2configs/autotether.nix
@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+{
+  systemd.services.usb_tether = {
+    script = ''
+      ${pkgs.android-tools}/bin/adb -s QV770FAMEK wait-for-device
+      ${pkgs.android-tools}/bin/adb -s QV770FAMEK shell svc usb setFunctions rndis
+    '';
+  };
+  services.udev.extraRules = ''
+    ACTION=="add", SUBSYSTEM=="usb", ENV{PRODUCT}=="fce/320d/510", TAG+="systemd", ENV{SYSTEMD_WANTS}="usb_tether.service"
+  '';
+  systemd.network.networks.android = {
+    matchConfig.Name = "enp0s20u1";
+    DHCP = "yes";
+  };
+}
diff --git a/lass/2configs/c-base.nix b/lass/2configs/c-base.nix
index 3e533fb74..a8dd3dd1d 100644
--- a/lass/2configs/c-base.nix
+++ b/lass/2configs/c-base.nix
@@ -1,97 +1,115 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (import <stockholm/lib>) genid;
-
 in {
 
-  users.extraUsers = {
-    cbasevpn = rec {
-      name = "cbasevpn";
-      uid = genid "cbasevpn";
-      description = "user for running c-base openvpn";
-      home = "/home/${name}";
-    };
-  };
-
-  users.extraGroups.cbasevpn.gid = genid "cbasevpn";
-
   environment.systemPackages = [
     pkgs.cifs-utils
   ];
 
-  services.openvpn.servers = {
-    c-base = {
-      config = ''
-        client
-        dev tap
-        proto tcp
-        remote vpn.ext.c-base.org 1194
-        resolv-retry infinite
-        nobind
-        user cbasevpn
-        group cbasevpn
-        persist-key
-        persist-tun
-
-        auth-nocache
-        #auth-user-pass
-        auth-user-pass ${toString <secrets/cbase.txt>}
-
-        comp-lzo
-        verb 3
-
-        #script-security 2
-        #up /etc/openvpn/update-resolv-conf
-        #down /etc/openvpn/update-resolv-conf
-
-        <ca>
-        -----BEGIN CERTIFICATE-----
-        MIIDUjCCArugAwIBAgIJAOOk8EXgjsf5MA0GCSqGSIb3DQEBBQUAMHoxCzAJBgNV
-        BAYTAkRFMQswCQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGluMQ8wDQYDVQQKEwZj
-        LWJhc2UxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJ
-        ARYQYWRtYXhAYy1iYXNlLm9yZzAeFw0wOTAyMTMwOTE1MzdaFw0xOTAyMTEwOTE1
-        MzdaMHoxCzAJBgNVBAYTAkRFMQswCQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGlu
-        MQ8wDQYDVQQKEwZjLWJhc2UxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEf
-        MB0GCSqGSIb3DQEJARYQYWRtYXhAYy1iYXNlLm9yZzCBnzANBgkqhkiG9w0BAQEF
-        AAOBjQAwgYkCgYEAt3wEgXbqFKxs8z/E4rv13hkRi6J+QdshNzntm7rTOmUsXKE7
-        IEwoJSglrmsDPv4UqE86A7bjW7YYSFjhzxFRkTEHJanyOCF48ZPItVl7Eq7T81co
-        uR+6lAhxnLDrwnPJCC83NzAa6lw8U1DsQRDkayKlrQrtZq6++pFFEvZvt1cCAwEA
-        AaOB3zCB3DAdBgNVHQ4EFgQUqkSbdXS90+HtqXDeAI+PcyTSSHEwgawGA1UdIwSB
-        pDCBoYAUqkSbdXS90+HtqXDeAI+PcyTSSHGhfqR8MHoxCzAJBgNVBAYTAkRFMQsw
-        CQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGluMQ8wDQYDVQQKEwZjLWJhc2UxGzAZ
-        BgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJARYQYWRtYXhA
-        Yy1iYXNlLm9yZ4IJAOOk8EXgjsf5MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF
-        BQADgYEAOBANG1H4uEEWk3sbeQoSMeA3LFG1+6MgFGk2WAdeHYuV9GKYBq6/PLP5
-        ffw+FNkiDjLSeSQO88vHYJr2V1v8n/ZoCIT+1VBcDWXTpGz0YxDI1iBauO3tUPzK
-        wGs46RA/S0YwiZw64MaUHd88ZVadjKy9kNoO3w6/vpAS6s/Mh+o=
-        -----END CERTIFICATE-----
-        </ca>
-        key-direction 1
-        <tls-auth>
-        #
-        # 2048 bit OpenVPN static key
-        #
-        -----BEGIN OpenVPN Static key V1-----
-        5d49aa8c9cec18de7ab6e0b5cd09a368
-        d3f1b8b77e055e448804fa0e14f487cb
-        491681742f96b54a23fb8639aa9ed14e
-        c40b86a5546b888c4f3873f23c956e87
-        169076ec869127ffc85353fd5928871c
-        da19776b79f723abb366fae6cdfe4ad6
-        7ef667b7d05a7b78dfd5ea1d2da276dc
-        5f6c82313fe9c1178c7256b8d1d081b0
-        4c80bc8f21add61fbc52c158579edc1d
-        bbde230afb9d0e531624ce289a17098a
-        3261f9144a9a2a6f0da4250c9eed4086
-        187ec6fa757a454de743a349e32af193
-        e9f8b49b010014bdfb3240d992f2f234
-        581d0ce05d4e07a2b588ad9b0555b704
-        9d5edc28efde59226ec8942feed690a1
-        2acd0c8bc9424d6074d0d495391023b6
-        -----END OpenVPN Static key V1-----
-        </tls-auth>
-      '';
+  systemd.network.networks.c-base = {
+    matchConfig.Name = "c-base";
+    networkConfig = {
+      IgnoreCarrierLoss = "3s";
+      KeepConfiguration = "static";
+      DNS = "10.0.1.254";
+      Domains = "cbrp3.c-base.org";
     };
+    routes = [
+      { routeConfig = {
+        Destination = "10.0.1.0/24";
+        Gateway = "172.31.77.1";
+      };}
+      { routeConfig = {
+        Destination = "91.102.9.99/32"; # vorstand.c-base.org
+        Gateway = "172.31.77.1";
+      };}
+    ];
+  };
+  services.openvpn.servers.c-base = {
+    config = ''
+      remote vpn.ext.c-base.org 1194
+      verify-x509-name vpn.ext.c-base.org name
+      client
+      proto udp
+      dev-type tun
+      dev c-base
+      resolv-retry infinite
+      nobind
+      # user openvpn
+      # group openvpn
+      persist-key
+      persist-tun
+      comp-lzo
+      # register-dns
+      # block-outside-dns
+      script-security 2
+      auth-user-pass ${toString <secrets/cbase.txt>}
+      #auth-user-pass
+      key-direction 1
+      <tls-auth>
+      #
+      # 2048 bit OpenVPN static key
+      #
+      -----BEGIN OpenVPN Static key V1-----
+      54a66ed1048bed7508703347e89d68d6
+      5586e6a5d1218cf8675941031d540be6
+      993e07200a16ad3b770b659932ee71e5
+      f8080b5c9fa2acb3893abd40fad2552c
+      fdaf17565e617ae450efcccf5652dca5
+      a16419509024b075941098731eb25ac0
+      a64f963ece3dca1d2a64a9c5e17839d7
+      5b5080165a9b2dc90ef111879d7d3173
+      2d1027ae42d869394aca08da4472a9d0
+      6b724b4ed43a957feef7d6dfc86da241
+      74828fa0e1240941586f0d937cac32fc
+      13cc81e7bed58817353d6afaff7e6a26
+      4f9cc086af79c1cdca660d86e18cff96
+      69dd3d392caf09a468894a8504f4cc7c
+      7ae0072e6d9ad90b166ad13a39c57b3c
+      3a869e27a1d89deb161c255227551713
+      -----END OpenVPN Static key V1-----
+      </tls-auth>
+      <ca>
+      -----BEGIN CERTIFICATE-----
+      MIIGsDCCBJigAwIBAgIJAPkM1l2zA306MA0GCSqGSIb3DQEBCwUAMIGWMQswCQYD
+      VQQGEwJERTEPMA0GA1UEBxMGQmVybGluMRswGQYDVQQLExJ2cG4uZXh0LmMtYmFz
+      ZS5vcmcxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEbMBkGA1UEKRMSdnBu
+      LmV4dC5jLWJhc2Uub3JnMR8wHQYJKoZIhvcNAQkBFhBhZG1heEBjLWJhc2Uub3Jn
+      MB4XDTE2MDcwOTE4MjkyMFoXDTI2MDcxMDE4MjkyMFowgZYxCzAJBgNVBAYTAkRF
+      MQ8wDQYDVQQHEwZCZXJsaW4xGzAZBgNVBAsTEnZwbi5leHQuYy1iYXNlLm9yZzEb
+      MBkGA1UEAxMSdnBuLmV4dC5jLWJhc2Uub3JnMRswGQYDVQQpExJ2cG4uZXh0LmMt
+      YmFzZS5vcmcxHzAdBgkqhkiG9w0BCQEWEGFkbWF4QGMtYmFzZS5vcmcwggIiMA0G
+      CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXEs+uWCXLNmm+lgP9x7u3FqWa4pPI
+      h64c6EWIULMATrhEw+Ej4fpCXwU9otFaO04fAeJmZGkDcnAYdBDiCeI0luOSdj44
+      Bg9KecSei/TskqjhDVnEBp65hiz0rZE6c1baPdLYmD5xrXWb3i0zrlBYFawuL6C2
+      lwVCEm3cadvkDJ2DleMuu3NblV8ViIDN0HZqzJNP72g1I0MgohkpetACXlf7MzQV
+      PFHfzvb04Rj2lJ8BDhceQ0WmjtVV/Ag6nka5oi954OeHMujRuH+rZYiQZDZpJLHK
+      Kh1KWTVlWPRy+AvCi9lweDWSmLccq7Ug4xMtDF4I5qW3tjCd0xqpZ21Xmo2JyKtY
+      4h8wEDPqiJvgwvkXsH17GLn5ZxiMcQuRJQYZqJephkzR9uccJeWSS76kwm/vLqG3
+      +eORlYnyjiNXtiMIhmAEFjpWUrGH8v4CijpUNP6E63ynGrRVXK684YQXkqL+xPAt
+      t6dsMBUwf94a2S1o2kgvuRCim1wlHvf1QsHrO/Hwgpzc8no/daWL+Z9Rq9okTHNK
+      nc1G5dv8TkmxIDYnLm07QMzzBoOT36BcGtkEBA+0xhQlX5PyQdM5/jnZVhdSBmoP
+      MbZXPoU/gJAIuuBuwdTlgCzYf44/9/YU/AnW8eLrbhm9KtMtoMpatrWorKqk/GPv
+      /lGNRQuNffrbiQIDAQABo4H+MIH7MB0GA1UdDgQWBBTf5cYbK+KCF9u9aobFlLbu
+      ilwX4jCBywYDVR0jBIHDMIHAgBTf5cYbK+KCF9u9aobFlLbuilwX4qGBnKSBmTCB
+      ljELMAkGA1UEBhMCREUxDzANBgNVBAcTBkJlcmxpbjEbMBkGA1UECxMSdnBuLmV4
+      dC5jLWJhc2Uub3JnMRswGQYDVQQDExJ2cG4uZXh0LmMtYmFzZS5vcmcxGzAZBgNV
+      BCkTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJARYQYWRtYXhAYy1i
+      YXNlLm9yZ4IJAPkM1l2zA306MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQAD
+      ggIBAMs1moiS7UZ4neOivQjqwKrBbm1j3tgmPLhDfNMmXYarGhnBGAlLxLAQWtG+
+      Fnbx8KcsJnrsWcGfZcst1z45S4a5oBdVNKOfgkMOG0glZorIDO8Odrb51rpyzU0v
+      0wcNumMNWhkFuo2OTBHPnnJIWEAFwwCCSCL0I0hQxxoaV36kphjuIwzrMJhd+XAT
+      24En58cNp6sPRDd+FzOH08uFINevyzKWYxkMgVj+e3fbuiyOB8RqvndKvtfBBcpB
+      cCO86lGnj/ETMDciTczUShxaMn9wV1zr1KH1xvT3ohUeOcQZGbGTcjG4mxlns8ZO
+      U5J3Yrcd1eMfJq9Bwd3zPsTLnT8LwIS8vfYRav9b34XdqcBG73dhrjsicMK0Qy0z
+      Qz7vKJzcvrEnKuaMyB3mCxz/UvbNc2Bupwm4FmzN5eFjDs+7paYFdfOzqMjoRP+8
+      bcXSqDN5P2eUd7cdsZXaFNcsf1FkWlE3GudVBOmNJqz9zBab/T5J+l4Z90Pd6OUX
+      GNozEvLhcJkvPKA526TegHTGC8hMquxKc9tpOzNRqZJMFa+UG1mgMrMepRmM/B3s
+      QrKI1C11iCVYfb9J0tQUkfENHMx4J7mG2DZAhnKWQDU2awM41qU4A7aBYaJvDPnQ
+      RRcbaT0D794lKUQwH/mZuyKzF22oZNk1o1TV2SaFXqgX5tDt
+      -----END CERTIFICATE-----
+      </ca>
+    '';
   };
 }
diff --git a/lass/2configs/container-networking.nix b/lass/2configs/container-networking.nix
index f04e4342d..0cfe193d9 100644
--- a/lass/2configs/container-networking.nix
+++ b/lass/2configs/container-networking.nix
@@ -8,8 +8,8 @@
     { v6 = false; predicate = "-o ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
     { v6 = false; predicate = "-i ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
   ];
-  krebs.iptables.tables.nat.PREROUTING.rules = [
-    { v6 = false; predicate = "-s 10.233.2.0/24"; target = "ACCEPT"; precedence = 1000; }
+  krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
+    { v6 = false; predicate = "-s 10.233.2.0/24"; target = "ACCEPT"; }
   ];
   krebs.iptables.tables.nat.POSTROUTING.rules = [
     { v6 = false; predicate = "-s 10.233.2.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix
index 49a04e9c2..3d7188dc6 100644
--- a/lass/2configs/default.nix
+++ b/lass/2configs/default.nix
@@ -69,7 +69,6 @@ with import <stockholm/lib>;
   ];
 
   networking.hostName = config.krebs.build.host.name;
-  nix.maxJobs = config.krebs.build.host.cores;
 
   krebs = {
     enable = true;
@@ -190,28 +189,34 @@ with import <stockholm/lib>;
     enable = true;
     tables = {
       nat.PREROUTING.rules = [
-        { predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; }
-        { predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; }
-        { predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; precedence = 100; }
-        { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 99; }
+        { predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
+        { predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
+        { predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; }
+        { predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
       ];
       nat.OUTPUT.rules = [
-        { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; precedence = 100; }
+        { predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
       ];
       filter.INPUT.policy = "DROP";
       filter.FORWARD.policy = "DROP";
-      filter.INPUT.rules = [
-        { predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";}
-        { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; precedence = 10001; }
-        { predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; }
-        { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false;  precedence = 10000; }
-        { predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; }
-        { predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; }
-        { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; precedence = -10000; }
-        { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; precedence = -10000; }
-        { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; precedence = -10000; }
-        { predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
-        { predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
+      filter.INPUT.rules = mkMerge [
+        (mkBefore [
+          { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
+          { predicate = "-p icmp"; target = "ACCEPT"; }
+          { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false;  }
+          { predicate = "-i lo"; target = "ACCEPT"; }
+          { predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
+        ])
+        (mkOrder 1000 [
+          { predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT"; }
+          { predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
+          { predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
+        ])
+        (mkAfter [
+          { predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; }
+          { predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; }
+          { predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; }
+        ])
       ];
     };
   };
diff --git a/lass/2configs/gg23.nix b/lass/2configs/gg23.nix
index 89ccae408..51db9a40a 100644
--- a/lass/2configs/gg23.nix
+++ b/lass/2configs/gg23.nix
@@ -2,37 +2,56 @@
 with import <stockholm/lib>;
 
 {
+  systemd.network.networks."50-et0" = {
+    matchConfig.Name = "et0";
+    DHCP = "yes";
+    # dhcpV4Config.UseDNS = false;
+    # dhcpV6Config.UseDNS = false;
+    linkConfig = {
+      RequiredForOnline = "routable";
+    };
+    # networkConfig = {
+    #   LinkLocalAddressing = "no";
+    # };
+    # dhcpV6Config = {
+    #   PrefixDelegationHint = "::/60";
+    # };
+    # networkConfig = {
+    #   IPv6AcceptRA = true;
+    # };
+    # ipv6PrefixDelegationConfig = {
+    #   Managed = true;
+    # };
+  };
+  systemd.network.networks."50-int0" = {
+    name = "int0";
+    address = [
+      "10.42.0.1/24"
+    ];
+    networkConfig = {
+      IPForward = "yes";
+      IPMasquerade = "both";
+      ConfigureWithoutCarrier = true;
+      DHCPServer = "yes";
+      # IPv6SendRA = "yes";
+      # DHCPPrefixDelegation = "yes";
+    };
+  };
   networking.networkmanager.unmanaged = [ "int0" ];
-  networking.interfaces.int0.ipv4.addresses = [{
-    address = "10.42.0.1";
-    prefixLength = 24;
-  }];
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-i int0"; target = "ACCEPT"; }
+  ];
+  krebs.iptables.tables.filter.FORWARD.rules = [
+    { predicate = "-i int0"; target = "ACCEPT"; }
+    { predicate = "-o int0"; target = "ACCEPT"; }
+    { predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
+  ];
+  krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
+    { v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; }
+  ];
 
   networking.domain = "gg23";
 
-  services.dhcpd4 = {
-    enable = true;
-    interfaces = [ "int0" ];
-    extraConfig = ''
-      option subnet-mask 255.255.255.0;
-      option routers 10.42.0.1;
-      option domain-name-servers 10.42.0.1;
-      subnet 10.42.0.0 netmask 255.255.255.0 {
-        range 10.42.0.100 10.42.0.200;
-      }
-    '';
-    machines = [
-      { ethernetAddress = "a8:a6:48:65:ce:4c"; hostName = "tv"; ipAddress = "10.42.0.3"; }
-      { ethernetAddress = "3c:2a:f4:22:28:37"; hostName = "drucker"; ipAddress = "10.42.0.4"; }
-      { ethernetAddress = "80:7d:3a:67:b7:01"; hostName = "s20-tv"; ipAddress = "10.42.0.10"; }
-      { ethernetAddress = "80:7d:3a:68:04:f0"; hostName = "s20-drucker"; ipAddress = "10.42.0.11"; }
-      { ethernetAddress = "80:7d:3a:68:11:a5"; hostName = "s20-wasch"; ipAddress = "10.42.0.12"; }
-      { ethernetAddress = "80:7d:3a:67:bb:69"; hostName = "s20-stereo"; ipAddress = "10.42.0.13"; }
-      { ethernetAddress = "ec:b5:fa:07:78:16"; hostName = "hue-bridge"; ipAddress = "10.42.0.21"; }
-      { ethernetAddress = "80:8d:b7:c5:80:dc"; hostName = "arubaAP"; ipAddress = "10.42.0.99"; }
-    ];
-  };
-
   services.dnsmasq = {
     enable = true;
     resolveLocalQueries = false;
@@ -45,22 +64,4 @@ with import <stockholm/lib>;
       interface=int0
     '';
   };
-
-  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-  krebs.iptables.tables.filter.INPUT.rules = [
-    { predicate = "-i int0 -p udp --dport 53"; target = "ACCEPT"; } # dns
-  ];
-  krebs.iptables.tables.filter.FORWARD.rules = [
-    { v6 = false; predicate = "-d 10.42.0.0/24 -o int0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
-    { v6 = false; predicate = "-s 10.42.0.0/24 -i int0"; target = "ACCEPT"; }
-    { v6 = false; predicate = "-o int0"; target = "REJECT --reject-with icmp-port-unreachable"; }
-    { v6 = false; predicate = "-i int0"; target = "REJECT --reject-with icmp-port-unreachable"; }
-  ];
-  krebs.iptables.tables.nat.PREROUTING.rules = [
-    { v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; precedence = 1000; }
-  ];
-  krebs.iptables.tables.nat.POSTROUTING.rules = [
-    { v6 = false; predicate = "-s 10.42.0.0/24 ! -d 10.42.0.0/24"; target = "MASQUERADE"; }
-  ];
 }
-
diff --git a/lass/2configs/hfos.nix b/lass/2configs/hfos.nix
index f8dd2f0d2..9dafe086c 100644
--- a/lass/2configs/hfos.nix
+++ b/lass/2configs/hfos.nix
@@ -18,22 +18,22 @@ with import <stockholm/lib>;
     }
   ];
 
-  krebs.iptables.tables.nat.PREROUTING.rules = [
-    { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 22"; target = "DNAT --to-destination 192.168.122.208:22"; }
-    { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 25"; target = "DNAT --to-destination 192.168.122.208:25"; }
-    { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 80"; target = "DNAT --to-destination 192.168.122.208:1080"; }
-    { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; }
+  krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
+    { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 22"; target = "DNAT --to-destination 192.168.122.208:22"; }
+    { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 25"; target = "DNAT --to-destination 192.168.122.208:25"; }
+    { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 80"; target = "DNAT --to-destination 192.168.122.208:1080"; }
+    { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; }
   ];
 
-  krebs.iptables.tables.filter.FORWARD.rules = [
-    { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
-    { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
-    { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 1080 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
-    { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 1443 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
+  krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
+    { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
+    { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
+    { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 1080 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
+    { v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 1443 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
   ];
 
-  krebs.iptables.tables.nat.OUTPUT.rules = [
-    { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; }
+  krebs.iptables.tables.nat.OUTPUT.rules = mkBefore [
+    { v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; }
   ];
 
   # TODO use bridge interfaces instead of this crap
diff --git a/lass/2configs/libvirt.nix b/lass/2configs/libvirt.nix
index d391e0d7b..6d07c7a77 100644
--- a/lass/2configs/libvirt.nix
+++ b/lass/2configs/libvirt.nix
@@ -20,8 +20,8 @@
   krebs.iptables.tables.filter.OUTPUT.rules = [
     { v6 = false; predicate = "-o virbr0 -p udp -m udp --dport 68"; target = "ACCEPT"; }
   ];
-  krebs.iptables.tables.nat.PREROUTING.rules = [
-    { v6 = false; predicate = "-s 192.168.122.0/24"; target = "ACCEPT"; precedence = 1000; }
+  krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
+    { v6 = false; predicate = "-s 192.168.122.0/24"; target = "ACCEPT"; }
   ];
   krebs.iptables.tables.nat.POSTROUTING.rules = [
     { v6 = false; predicate = "-s 192.168.122.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
diff --git a/lass/2configs/radio/container-host.nix b/lass/2configs/radio/container-host.nix
new file mode 100644
index 000000000..e32095ffa
--- /dev/null
+++ b/lass/2configs/radio/container-host.nix
@@ -0,0 +1,23 @@
+{ config, pkgs, ... }:
+{
+  lass.sync-containers3.containers.radio = {
+    sshKey = "${toString <secrets>}/radio.sync.key";
+  };
+  containers.radio = {
+    bindMounts."/var/music" = {
+      hostPath = "/var/music";
+      isReadOnly = false;
+    };
+  };
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; }
+  ];
+  krebs.htgen.radio-redirect = {
+    port = 8000;
+    scriptFile = pkgs.writers.writeDash "redir" ''
+      printf 'HTTP/1.1 301 Moved Permanently\r\n'
+      printf "Location: http://radio.lassul.us''${Request_URI}\r\n"
+      printf '\r\n'
+    '';
+  };
+}
diff --git a/lass/2configs/radio/default.nix b/lass/2configs/radio/default.nix
index dfb3d7e0b..a511196fd 100644
--- a/lass/2configs/radio/default.nix
+++ b/lass/2configs/radio/default.nix
@@ -3,7 +3,7 @@
 let
   name = "radio";
 
-  music_dir = "/home/radio/music";
+  music_dir = "/var/music";
 
   skip_track = pkgs.writers.writeBashBin "skip_track" ''
     set -eu
@@ -113,7 +113,7 @@ in {
         LIMIT=1000 #how many tracks to keep in the history
         HISTORY_FILE=/var/lib/radio/recent
 
-        listeners=$(${pkgs.curl}/bin/curl -fSs lassul.us:8000/status-json.xsl |
+        listeners=$(${pkgs.curl}/bin/curl -fSs http://localhost:8000/status-json.xsl |
           ${pkgs.jq}/bin/jq '[.icestats.source[].listeners] | add' || echo 0)
         echo "$(${pkgs.coreutils}/bin/date -Is)" "$filename" | ${pkgs.coreutils}/bin/tee -a "$HISTORY_FILE"
         echo "$(${pkgs.coreutils}/bin/tail -$LIMIT "$HISTORY_FILE")" > "$HISTORY_FILE"
@@ -128,14 +128,33 @@ in {
     serviceConfig.User = lib.mkForce "radio";
   };
 
+  nixpkgs.config.packageOverrides = opkgs: {
+    icecast = opkgs.icecast.overrideAttrs (old: rec {
+      version = "2.5-beta3";
+
+      src = pkgs.fetchurl {
+        url = "http://downloads.xiph.org/releases/icecast/icecast-${version}.tar.gz";
+        sha256 = "sha256-4FDokoA9zBDYj8RAO/kuTHaZ6jZYBLSJZiX/IYFaCW8=";
+      };
+
+      buildInputs = old.buildInputs ++ [ pkgs.pkg-config ];
+    });
+  };
   services.icecast = {
     enable = true;
     hostname = "radio.lassul.us";
     admin.password = "hackme";
     extraConf = ''
       <authentication>
-       <source-password>hackme</source-password>
+        <source-password>hackme</source-password>
+        <admin-user>admin</admin-user>
+        <admin-password>hackme</admin-password>
       </authentication>
+      <logging>
+        <accesslog>-</accesslog>
+        <errorlog>-</errorlog>
+        <loglevel>3</loglevel>
+      </logging>
     '';
   };
 
@@ -234,18 +253,38 @@ in {
     '';
   };
 
+  networking.firewall.allowedTCPPorts = [ 80 ];
   services.nginx = {
     enable = true;
-    virtualHosts."radio.lassul.us" = {
-      forceSSL = true;
-      enableACME = true;
+    virtualHosts."radio.r" = {
       locations."/".extraConfig = ''
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Server $host;
-        proxy_set_header X-Real-IP $remote_addr;
+        # https://github.com/aswild/icecast-notes#core-nginx-config
         proxy_pass http://localhost:8000;
+        # Disable request size limit, very important for uploading large files
+        client_max_body_size 0;
+
+        # Enable support `Transfer-Encoding: chunked`
+        chunked_transfer_encoding on;
+
+        # Disable request and response buffering, minimize latency to/from Icecast
+        proxy_buffering off;
+        proxy_request_buffering off;
+
+        # Icecast needs HTTP/1.1, not 1.0 or 2
+        proxy_http_version 1.1;
+
+        # Forward all original request headers
+        proxy_pass_request_headers on;
+
+        # Set some standard reverse proxy headers. Icecast server currently ignores these,
+        # but may support them in a future version so that access logs are more useful.
+        proxy_set_header  Host              $host;
+        proxy_set_header  X-Real-IP         $remote_addr;
+        proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Proto $scheme;
+
+        # get source ip for weather reports
+        proxy_set_header user-agent "$http_user_agent; client-ip=$remote_addr";
       '';
       locations."= /recent".extraConfig = ''
         default_type "text/plain";
@@ -266,7 +305,7 @@ in {
         while sleep 1; do
           mpv \
             --cache-secs=0 --demuxer-readahead-secs=0 --untimed --cache-pause=no \
-            'http://lassul.us:8000/radio.ogg'
+            'http://radio.lassul.us/radio.ogg'
         done
       '';
       locations."= /controls".extraConfig = ''
@@ -278,35 +317,12 @@ in {
         add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
       '';
     };
-    virtualHosts."lassul.us".locations."= /the_playlist".extraConfig = let
-      html = pkgs.writeText "index.html" ''
-        <!DOCTYPE html>
-        <html lang="en">
-          <head>
-            <meta charset="utf-8">
-            <title>lassulus playlist</title>
-          </head>
-          <body>
-            <div style="display:inline-block;margin:0px;padding:0px;overflow:hidden">
-              <iframe src="https://kiwiirc.com/client/irc.hackint.org/?nick=kiwi_test|?&theme=cli#the_playlist" frameborder="0" style="overflow:hidden;overflow-x:hidden;overflow-y:hidden;height:95%;width:100%;position:absolute;top:0px;left:0px;right:0px;bottom:0px" height="95%" width="100%"></iframe>
-            </div>
-            <div style="position:absolute;bottom:1px;display:inline-block;background-color:red;">
-              <audio controls autoplay="autoplay"><source src="http://lassul.us:8000/radio.ogg" type="audio/ogg">Your browser does not support the audio element.</audio>
-            </div>
-            <!-- page content -->
-          </body>
-        </html>
-      '';
-    in ''
-      default_type "text/html";
-      alias ${html};
-    '';
   };
   services.syncthing.declarative.folders."the_playlist" = {
-    path = "/home/radio/music/the_playlist";
-    devices = [ "mors" "phone" "prism" "omo" ];
+    path = "/var/music/the_playlist";
+    devices = [ "mors" "phone" "prism" "omo" "radio" ];
   };
-  krebs.acl."/home/radio/music/the_playlist"."u:syncthing:X".parents = true;
-  krebs.acl."/home/radio/music/the_playlist"."u:syncthing:rwX" = {};
-  krebs.acl."/home/radio/music/the_playlist"."u:radio:rwX" = {};
+  krebs.acl."/var/music/the_playlist"."u:syncthing:X".parents = true;
+  krebs.acl."/var/music/the_playlist"."u:syncthing:rwX" = {};
+  krebs.acl."/var/music/the_playlist"."u:radio:rwX" = {};
 }
diff --git a/lass/2configs/radio/radio.liq b/lass/2configs/radio/radio.liq
index 70d316043..1366287a7 100644
--- a/lass/2configs/radio/radio.liq
+++ b/lass/2configs/radio/radio.liq
@@ -10,7 +10,7 @@ def stringify_attrs(attrs) =
   out
 end
 
-def filter_graveyard(req) =
+def filter_music(req) =
   filename = request.filename(req)
   if string.match(pattern = '.*/\\.graveyard/.*', filename) then
     false
@@ -27,7 +27,7 @@ end
 env = environment()
 port = string.to_int(env["RADIO_PORT"], default = 8000)
 
-all_music = playlist(env["MUSIC"], check_next = filter_graveyard)
+all_music = playlist(env["MUSIC"], check_next = filter_music)
 wishlist = request.queue()
 tracks = fallback(track_sensitive = true, [wishlist, all_music])
 tracks = blank.eat(tracks)
@@ -36,7 +36,7 @@ last_metadata = ref([])
 def on_metadata(m) =
   last_metadata := m
   print("changing tracks")
-  out = process.read(env["HOOK_TRACK_CHANGE"], env = m)
+  out = process.read(env["HOOK_TRACK_CHANGE"], env = m, timeout = 5.0)
   print(out)
 end
 tracks.on_metadata(on_metadata)
diff --git a/lass/2configs/radio/weather.nix b/lass/2configs/radio/weather.nix
index 704bf7218..dca8a7843 100644
--- a/lass/2configs/radio/weather.nix
+++ b/lass/2configs/radio/weather.nix
@@ -10,20 +10,25 @@ let
     export PATH="${lib.makeBinPath [