Merge remote-tracking branch 'gum/master'

3 files changed, 59 insertions, 22 deletions

diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
index fbd06a9c7..e71055f54 100644
--- a/makefu/1systems/omo.nix
+++ b/makefu/1systems/omo.nix
@@ -5,9 +5,10 @@
 { config, pkgs, lib, ... }:
 let
   byid = dev: "/dev/disk/by-id/" + dev;
-  keyFile = "/dev/disk/by-id/usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
-  rootDisk = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN";
-  homePartition = byid "ata-INTEL_SSDSA2M080G2GC_CVPO003402PB080BGN-part3";
+  keyFile = byid "usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
+  rootDisk = byid "ata-SanDisk_SD8SNAT128G1122_162099420904";
+  rootPartition = byid "ata-SanDisk_SD8SNAT128G1122_162099420904-part2";
+  primaryInterface = "enp1s0";
   # cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
   # cryptsetup luksAddKey $dev tmpkey
   # cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096
@@ -15,14 +16,14 @@ let
 
   # omo Chassis:
   # __FRONT_
-  # |* d2   |
+  # |* d0   |
   # |       |
   # |* d3   |
   # |       |
-  # |* d0   |
+  # |* d3   |
   # |       |
-  # |* d1   |
   # |*      |
+  # |* d2   |
   # |  * r0 |
   # |_______|
   cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
@@ -38,27 +39,31 @@ in {
     [
       ../.
       # TODO: unlock home partition via ssh
-      ../2configs/fs/single-partition-ext4.nix
+      ../2configs/fs/sda-crypto-root.nix
       ../2configs/zsh-user.nix
       ../2configs/exim-retiolum.nix
       ../2configs/smart-monitor.nix
       ../2configs/mail-client.nix
-      ../2configs/share-user-sftp.nix
-      ../2configs/graphite-standalone.nix
+      #../2configs/graphite-standalone.nix
+      #../2configs/share-user-sftp.nix
       ../2configs/omo-share.nix
+
+      ## as long as pyload is not in nixpkgs:
+      # docker run -d -v /var/lib/pyload:/opt/pyload/pyload-config -v /media/crypt0/pyload:/opt/pyload/Downloads --name pyload --restart=always -p 8112:8000 -P writl/pyload
     ];
 
   krebs.retiolum.enable = true;
-  networking.firewall.trustedInterfaces = [ "enp3s0" ];
+  networking.firewall.trustedInterfaces = [ primaryInterface ];
   # udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net
   # tcp:80          - nginx for sharing files
   # tcp:655 udp:655 - tinc
   # tcp:8111        - graphite
+  # tcp:8112        - pyload
   # tcp:9090        - sabnzbd
   # tcp:9200        - elasticsearch
   # tcp:5601        - kibana
   networking.firewall.allowedUDPPorts = [ 655 ];
-  networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 9200 9090 ];
+  networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 8112 9200 9090 ];
 
   # services.openssh.allowSFTP = false;
 
@@ -66,6 +71,9 @@ in {
   services.sabnzbd.enable = true;
   systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
 
+  virtualisation.docker.enable = true;
+
+
   # HDD Array stuff
   services.smartd.devices = builtins.map (x: { device = x; }) allDisks;
 
@@ -76,15 +84,11 @@ in {
     disks = map toMapper [ 0 1 ];
     parity = toMapper 2;
   };
+
   fileSystems = let
     cryptMount = name:
       { "/media/${name}" = { device = "/dev/mapper/${name}"; fsType = "xfs"; };};
-  in {
-    "/home" = {
-      device = "/dev/mapper/home";
-      fsType = "ext4";
-    };
-  } // cryptMount "crypt0"
+  in   cryptMount "crypt0"
     // cryptMount "crypt1"
     // cryptMount "crypt2";
 
@@ -101,15 +105,16 @@ in {
         usbkey = name: device: {
           inherit name device keyFile;
           keyFileSize = 4096;
+          allowDiscards = true;
         };
       in [
-        (usbkey "home" homePartition)
+        (usbkey "luksroot" rootPartition)
         (usbkey "crypt0" cryptDisk0)
         (usbkey "crypt1" cryptDisk1)
         (usbkey "crypt2" cryptDisk2)
       ];
     };
-    loader.grub.device = rootDisk;
+    loader.grub.device = lib.mkForce rootDisk;
 
     initrd.availableKernelModules = [
       "ahci"
@@ -121,12 +126,12 @@ in {
       "usbhid"
     ];
 
-    kernelModules = [ "kvm-amd" ];
+    kernelModules = [ "kvm-intel" ];
     extraModulePackages = [ ];
   };
 
   hardware.enableAllFirmware = true;
-  hardware.cpu.amd.updateMicrocode = true;
+  hardware.cpu.intel.updateMicrocode = true;
 
   zramSwap.enable = true;
 
diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix
index fa39b121c..2fb93798a 100644
--- a/makefu/1systems/pornocauster.nix
+++ b/makefu/1systems/pornocauster.nix
@@ -31,6 +31,7 @@
 
       # hardware specifics are in here
       ../2configs/hw/tp-x220.nix
+      ../2configs/hw/rtl8812au.nix
       # mount points
       ../2configs/fs/sda-crypto-root-home.nix
       # ../2configs/mediawiki.nix
@@ -59,7 +60,6 @@
   networking.firewall.allowedUDPPorts = [ 665 ];
 
   krebs.build.host = config.krebs.hosts.pornocauster;
-
   krebs.hosts.omo.nets.retiolum.via.ip4.addr = "192.168.1.11";
   krebs.retiolum = {
     enable = true;
@@ -68,4 +68,6 @@
   networking.extraHosts = ''
     192.168.1.11 omo.local
   '';
+  # hard dependency because otherwise the device will not be unlocked
+  boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
 }
diff --git a/makefu/1systems/shoney.nix b/makefu/1systems/shoney.nix
new file mode 100644
index 000000000..ebe5222c3
--- /dev/null
+++ b/makefu/1systems/shoney.nix
@@ -0,0 +1,30 @@
+{ config, pkgs, ... }:
+let
+  ip = "64.137.235.70";
+  gw = "64.137.235.1";
+in {
+  imports = [
+    ../.
+    ../../tv/2configs/hw/CAC.nix
+    ../../tv/2configs/fs/CAC-CentOS-7-64bit.nix
+
+  ];
+
+  # minimal resources
+  services.nixosManual.enable = false;
+  programs.man.enable = false;
+  nix.gc.automatic = true;
+  nix.gc.dates = "03:10";
+
+  krebs = {
+    enable = true;
+    retiolum.enable = true;
+    build.host = config.krebs.hosts.shoney;
+  };
+  networking.interfaces.enp2s1.ip4 = [ {
+    address = ip;
+    prefixLength = 24;
+  } ];
+  networking.defaultGateway = gw;
+  networking.nameservers = [ "8.8.8.8" ];
+}