Merge remote-tracking branch 'cd/master'

29 files changed, 453 insertions, 137 deletions

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 8297a56df..9b6382607 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -1,12 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.cd;
-  krebs.build.target = "root@cd.internet";
 
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 79e5f73b9..58a8fdcb2 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO merge with lass
@@ -17,9 +17,9 @@ in
 
 {
   krebs.build.host = config.krebs.hosts.mkdir;
-  krebs.build.target = "root@${primary-addr4}";
 
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 37ef204c7..2c9775da7 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -1,11 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.nomic;
 
   imports = [
+    ../.
     ../2configs/hw/AO753.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 6fd79c596..c54caa649 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO merge with lass
@@ -18,9 +18,8 @@ in
 {
   krebs.build.host = config.krebs.hosts.rmdir;
 
-  krebs.build.target = "root@rmdir.internet";
-
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 29e6de08b..6154e4df9 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -1,11 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.wu;
 
   imports = [
+    ../.
     ../2configs/hw/w110er.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
@@ -157,7 +158,7 @@ with lib;
 
   nixpkgs.config.chromium.enablePepperFlash = true;
 
-  nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name;
+  krebs.nixpkgs.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name;
   hardware.bumblebee.enable = true;
   hardware.bumblebee.group = "video";
   hardware.enableAllFirmware = true;
@@ -191,8 +192,6 @@ with lib;
     "d /tmp 1777 root root - -" # does this work with mounted /tmp?
   ];
 
-  virtualisation.libvirtd.enable = true;
-
   services.udev.extraRules = ''
     SUBSYSTEM=="net", ATTR{address}=="00:90:f5:da:aa:c3", NAME="en0"
     SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:1b:ae:6c", NAME="wl0"
@@ -211,5 +210,4 @@ with lib;
   services.tor.client.enable = true;
   services.tor.enable = true;
   services.virtualboxHost.enable = true;
-
 }
diff --git a/tv/1systems/xu-qemu0.nix b/tv/1systems/xu-qemu0.nix
new file mode 100644
index 000000000..8945c1907
--- /dev/null
+++ b/tv/1systems/xu-qemu0.nix
@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+{
+  krebs.hosts.xu-qemu0 = {
+    cores = 1;
+    ssh.privkey.path = <secrets/ssh.id_ed25519>;
+    # cannot define ssh.pubkey without at least one addr or alias
+    #ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFe51rD0ZqlMXNi/YpapnRzvdzCjI0icmxfCyBLSKG04";
+  };
+  krebs.build.host = config.krebs.hosts.xu-qemu0;
+
+  imports = [
+    ../.
+    <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
+  ];
+
+  boot.loader.grub.device = "/dev/sda";
+
+  fileSystems = {
+    "/boot" = {
+      device = "/dev/sda1";
+    };
+    "/" = {
+      device = "/dev/sda2";
+      fsType = "btrfs";
+    };
+  };
+}
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 8c4af2bd3..5ec1fe52b 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -1,11 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.xu;
 
   imports = [
+    ../.
     ../2configs/hw/x220.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
@@ -14,6 +15,7 @@ with lib;
     ../2configs/pulse.nix
     ../2configs/retiolum.nix
     ../2configs/xserver
+    ../2configs/xu-qemu0.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -43,7 +45,7 @@ with lib;
         # tv
         bc
         bind # dig
-        #cac
+        cac-api
         dic
         file
         gnupg21
@@ -189,8 +191,6 @@ with lib;
     "d /tmp 1777 root root - -" # does this work with mounted /tmp?
   ];
 
-  #virtualisation.libvirtd.enable = true;
-
   #services.bitlbee.enable = true;
   #services.tor.client.enable = true;
   #services.tor.enable = true;
diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index ce937a744..641e2d586 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -1,7 +1,7 @@
 { config, lib, ... }:
-with lib;
+with config.krebs.lib;
 {
-  krebs.backup.plans = addNames {
+  krebs.backup.plans = {
     wu-home-xu = {
       method = "push";
       src = { host = config.krebs.hosts.wu; path = "/home"; };
@@ -14,5 +14,40 @@ with lib;
         yearly   = { format = "%Y";                       };
       };
     };
+    xu-home-wu = {
+      method = "push";
+      src = { host = config.krebs.hosts.xu; path = "/home"; };
+      dst = { host = config.krebs.hosts.wu; path = "/bku/xu-home"; };
+      startAt = "06:00";
+      snapshots = {
+        daily    = { format = "%Y-%m-%d";    retain =  7; };
+        weekly   = { format = "%YW%W";       retain =  4; };
+        monthly  = { format = "%Y-%m";       retain = 12; };
+        yearly   = { format = "%Y";                       };
+      };
+    };
+  } // mapAttrs (_: recursiveUpdate {
+    snapshots = {
+      minutely = { format = "%Y-%m-%dT%H:%M"; retain = 3; };
+      hourly   = { format = "%Y-%m-%dT%H";    retain = 3; };
+      daily    = { format = "%Y-%m-%d";       retain = 3; };
+    };
+    startAt = null;
+  }) {
+    xu-test-push-xu = {
+      method = "push";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-push"; };
+    };
+    xu-test-pull-xu = {
+      method = "pull";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-pull"; };
+    };
+    xu-test-push-wu = {
+      method = "push";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.wu; path = "/bku/xu-test-push"; };
+    };
   };
 }
diff --git a/tv/2configs/charybdis.nix b/tv/2configs/charybdis.nix
index f9ab3da68..eefb2810b 100644
--- a/tv/2configs/charybdis.nix
+++ b/tv/2configs/charybdis.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.charybdis;
 
   out = {
     options.tv.charybdis = api;
-    config = mkIf cfg.enable (mkMerge [
+    config = lib.mkIf cfg.enable (lib.mkMerge [
       imp
       { tv.iptables.input-retiolum-accept-new-tcp = [ 6667 6697 ]; }
     ]);
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 57c4620c4..c4a2d6baa 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -1,21 +1,18 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.enable = true;
 
   krebs.build = {
     user = config.krebs.users.tv;
-    target = mkDefault "root@${config.krebs.build.host.name}";
     source = mapAttrs (_: mkDefault) ({
       nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix";
-      nixpkgs = symlink:stockholm/nixpkgs;
       secrets = "/home/tv/secrets/${config.krebs.build.host.name}";
       secrets-common = "/home/tv/secrets/common";
       stockholm = "/home/tv/stockholm";
-      stockholm-user = "symlink:stockholm/tv";
-      upstream-nixpkgs = {
+      nixpkgs = {
         url = https://github.com/NixOS/nixpkgs;
         rev = "77f8f35d57618c1ba456d968524f2fb2c3448295";
         dev = "/home/tv/nixpkgs";
@@ -45,6 +42,7 @@ with lib;
           tv = {
             isNormalUser = true;
             uid = 1337;
+            extraGroups = [ "tv" ];
           };
         };
       };
@@ -165,6 +163,7 @@ with lib;
 
     {
       tv.iptables.enable = true;
+      tv.iptables.accept-echo-request = "internet";
     }
 
     {
@@ -184,6 +183,15 @@ with lib;
       ];
     }
     {
+      environment.systemPackages = [
+        pkgs.get
+        pkgs.krebszones
+        pkgs.nix-prefetch-scripts
+        pkgs.push
+      ];
+    }
+
+    {
       systemd.tmpfiles.rules = let
         forUsers = flip map users;
         isUser = { name, group, ... }:
diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
index aedf25823..9197a3c30 100644
--- a/tv/2configs/exim-retiolum.nix
+++ b/tv/2configs/exim-retiolum.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.exim-retiolum.enable = true;
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index bcfea7821..4b49e20b1 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.exim-smarthost = {
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index b8180085f..7a42ca9fa 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -1,14 +1,14 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
   out = {
     krebs.git = {
       enable = true;
-      root-title = "public repositories at ${config.krebs.build.host.name}";
-      root-desc = "keep calm and engage";
+      root-title = "repositories at ${config.krebs.build.host.name}";
+      root-desc = "mostly krebs";
       repos = repos;
       rules = rules;
     };
@@ -21,7 +21,7 @@ let
   rules = concatMap make-rules (attrValues repos);
 
   public-repos = mapAttrs make-public-repo ({
-  } // mapAttrValues (setAttr "section" "1. Miscellaneous") {
+  } // mapAttrValues (setAttr "section" "1. miscellaneous") {
     cac-api = {
       desc = "CloudAtCost API command line interface";
     };
@@ -37,7 +37,7 @@ let
       desc = "SoundCloud command line interface";
     };
     stockholm = {
-      desc = "take all the computers hostage, they'll love you!";
+      desc = "NixOS configuration";
     };
     with-tmpdir = {};
   } // mapAttrValues (setAttr "section" "2. Haskell libraries") {
@@ -49,7 +49,7 @@ let
     web-routes-wai-custom = {};
     xintmap = {};
     xmonad-stockholm = {};
-  } // mapAttrValues (setAttr "section" "3. Museum") {
+  } // mapAttrValues (setAttr "section" "3. museum") {
     cgserver = {};
     crude-mail-setup = {};
     dot-xmonad = {};
@@ -90,12 +90,12 @@ let
     with git // config.krebs.users;
     repo:
       singleton {
-        user = [ tv tv_xu ];
+        user = [ tv tv-xu ];
         repo = [ repo ];
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
       optional repo.public {
-        user = [ lass makefu uriel ];
+        user = [ lass makefu ];
         repo = [ repo ];
         perm = fetch;
       } ++
diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix
index 72a40819f..b81b773be 100644
--- a/tv/2configs/hw/AO753.nix
+++ b/tv/2configs/hw/AO753.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   imports = [
@@ -41,5 +41,5 @@ with lib;
     HandleSuspendKey=ignore
   '';
 
-  nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name;
+  krebs.nixpkgs.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name;
 }
diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix
index 7cec670fa..9b3dd122a 100644
--- a/tv/2configs/hw/x220.nix
+++ b/tv/2configs/hw/x220.nix
@@ -5,18 +5,11 @@
     ../smartd.nix
   ];
 
-  boot.initrd.availableKernelModules = [ "ahci" ];
-  boot.kernelModules = [ "kvm-intel" ];
-
   boot.loader.gummiboot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
   networking.wireless.enable = true;
 
-  #hardware.enableAllFirmware = true;
-  #zramSwap.enable = true;
-  #zramSwap.numDevices = 2;
-
   hardware.trackpoint = {
     enable = true;
     sensitivity = 220;
@@ -46,14 +39,5 @@
   services.xserver = {
     videoDriver = "intel";
     vaapiDrivers = [ pkgs.vaapiIntel pkgs.vaapiVdpau ];
-    deviceSection = ''
-      Option "AccelMethod" "sna"
-    '';
   };
-
-  #services.xserver.displayManager.sessionCommands =''
-  #  xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 8 1
-  #  xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 8 2
-  #  xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Axes" 6 7 4 5
-  #'';
 }
diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix
index dc74f7f8d..15a3b5482 100644
--- a/tv/2configs/nginx-public_html.nix
+++ b/tv/2configs/nginx-public_html.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.nginx = {
diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix
index e1894ca64..8e611f21e 100644
--- a/tv/2configs/pulse.nix
+++ b/tv/2configs/pulse.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   pkg = pkgs.pulseaudioLight;
   runDir = "/run/pulse";
diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix
index d2bb9e6cf..e1598d792 100644
--- a/tv/2configs/retiolum.nix
+++ b/tv/2configs/retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.retiolum = {
diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix
index 8189f6345..0106cddf7 100644
--- a/tv/2configs/urlwatch.nix
+++ b/tv/2configs/urlwatch.nix
@@ -51,6 +51,9 @@
       # <stockholm/tv/2configs/xserver/xserver.conf.nix>
       # is derived from `configFile` in:
       https://raw.githubusercontent.com/NixOS/nixpkgs/master/nixos/modules/services/x11/xserver.nix
+
+      https://pypi.python.org/pypi/vncdotool
+      https://api.github.com/repos/kanaka/noVNC/tags
     ];
   };
 }
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 23f90af05..b0c26e50e 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -1,6 +1,6 @@
-{ lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   out = {
     environment.systemPackages = [
@@ -13,9 +13,21 @@ let
     environment.variables.VIMINIT = ":so /etc/vimrc";
   };
 
-  extra-runtimepath = concatStringsSep "," [
-    "${pkgs.vimPlugins.undotree}/share/vim-plugins/undotree"
-  ];
+  extra-runtimepath = let
+    inherit (pkgs.vimUtils) buildVimPlugin rtpPath;
+    fromVimPlugins = pkgs: concatStringsSep ","
+      (mapAttrsToList (name: pkg: "${pkg}/${rtpPath}/${name}") pkgs);
+  in fromVimPlugins {
+    inherit (pkgs.vimPlugins) undotree;
+    file-line = buildVimPlugin {
+      name = "file-line-1.0";
+      src = pkgs.fetchgit {
+        url = git://github.com/bogado/file-line;
+        rev = "refs/tags/1.0";
+        sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0";
+      };
+    };
+  };
 
   dirs = {
     backupdir = "$HOME/.cache/vim/backup";
@@ -32,12 +44,9 @@ let
     alldirs = attrValues dirs ++ map dirOf (attrValues files);
   in unique (sort lessThan alldirs);
 
-  vim = pkgs.writeScriptBin "vim" ''
-    #! ${pkgs.dash}/bin/dash
-    set -f
-    umask 0077
-    ${concatStringsSep "\n" (map (x: "mkdir -p ${x}") mkdirs)}
-    umask 0022
+  vim = pkgs.writeDashBin "vim" ''
+    set -efu
+    (umask 0077; exec ${pkgs.coreutils}/bin/mkdir -p ${toString mkdirs})
     exec ${pkgs.vim}/bin/vim "$@"
   '';
 
diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix
index f287bf206..923572721 100644
--- a/tv/2configs/xserver/Xresources.nix
+++ b/tv/2configs/xserver/Xresources.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 pkgs.writeText "Xresources" ''
   !URxvt*background:	#050505
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 5cd17aa1d..4b936f473 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }@args:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO krebs.build.user
diff --git a/tv/2configs/xserver/xserver.conf.nix b/tv/2configs/xserver/xserver.conf.nix
index e8a997a99..c452b4226 100644
--- a/tv/2configs/xserver/xserver.conf.nix
+++ b/tv/2configs/xserver/xserver.conf.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.services.xserver;
diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
new file mode 100644
index 000000000..720a8acd8
--- /dev/null
+++ b/tv/2configs/xu-qemu0.nix
@@ -0,0 +1,243 @@
+{ config, lib, pkgs, ... }:
+
+let
+  # XXX cannot use config.build.host.name here because infinite recursion when
+  # defining  krebs.hosts.${host-name}.nets.retiolum.aliases  below.
+  host-name = "xu";
+in
+
+# usage:
+#   echo set_password vnc correcthorze | xu-qemu0-monitor
+#
+#   vncdo -s xu:1 type 'curl init.xu.r' key shift-\\ type sh key return
+#
+#   http://vnc.xu/vnc_auto.html?port=5701&host=xu&password=correcthorze
+#
+#   make [install] system=xu-qemu0 target_host=10.56.0.101
+
+# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+# TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT
+# TODO iptables -A POSTROUTING -t nat -j MASQUERADE
+# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT
+# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
+
+with config.krebs.lib;
+
+{
+  networking.dhcpcd.denyInterfaces = [ "qemubr0" ];
+
+  systemd.network.enable = true;
+  services.resolved.enable = mkForce false;
+
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+  systemd.network.networks.qemubr0 = {
+    matchConfig.Name = "qemubr0";
+    address = ["10.56.0.1/24"];
+    routes = [{
+      routeConfig = {
+        Gateway = "*";
+        Destination = "10.56.0.0";
+      };
+    }];
+  };
+  systemd.network.netdevs.qemubr0 = {
+    netdevConfig = {
+      Name = "qemubr0";
+      Kind = "bridge";
+    };
+  };
+
+  users.groups.qemu-users.gid = genid "qemu-users";
+
+  environment.etc."qemu/bridge.conf".text = ''
+    allow qemubr0
+  '';
+
+  krebs.per-user.tv.packages = [
+    pkgs.vncdotool
+  ];
+
+  users.users.xu-qemu0 = {
+    createHome = true;
+    group = "qemu-users";
+    home = "/home/xu-qemu0";
+    uid = genid "xu-qemu0";
+  };
+
+  systemd.services.xu-qemu0 = let
+  in {
+    after = [ "network.target" "systemd-resolved.service" ];
+    serviceConfig = {
+      User = "xu-qemu0";
+      SyslogIdentifier = "xu-qemu0";
+      ExecStart = pkgs.writeDash "xu-qemu0" ''
+        set -efu
+        ${pkgs.coreutils}/bin/mkdir -p "$HOME/tmp"
+        img=$HOME/tmp/xu-qemu0.raw
+        if ! test -e "$img"; then
+          ${pkgs.kvm}/bin/qemu-img create "$img" 10G
+        fi
+        exec ${pkgs.kvm}/bin/qemu-kvm \
+            -monitor unix:$HOME/tmp/xu-qemu0-monitor.sock,server,nowait \
+            -boot order=cd \
+            -cdrom ${pkgs.fetchurl {
+              url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
+              sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9";
+            }} \
+            -m 1024 \
+            -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \
+            -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \
+            -drive file="$img",format=raw \
+            -display vnc=:1,websocket=5701,password,lossy \
+            -name xu-qemu0 \
+      '';
+    };
+  };
+
+  krebs.setuid.xu-qemu0-monitor = {
+    filename = pkgs.writeDash "xu-qemu0-monitor" ''
+      exec ${pkgs.socat}/bin/socat \
+          stdio \
+          UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0-monitor.sock \
+    '';
+    owner = "xu-qemu0";
+    group = "tv";
+  };
+
+  krebs.setuid.qemu-bridge-helper = {
+    filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
+    group = "qemu-users";
+  };
+
+  users.users.qemu-dnsmasq.uid = genid "qemu-dnsmasq";
+
+  # TODO need custom etc/dbus-1/system.d/dnsmasq.conf for different BusName
+  services.dbus.packages = [ pkgs.dnsmasq ];
+
+  systemd.services.qemu-dnsmasq = let
+    # bind-interfaces
+    conf = pkgs.writeText "qemu-dnsmasq.conf" ''
+      listen-address=10.56.0.1
+      interface=qemubr0
+      dhcp-range=10.56.0.200,10.56.0.250
+      dhcp-no-override
+      dhcp-leasefile=/tmp/qemu-dnsmasq.leases
+      domain=${host-name}.local
+      dhcp-host=52:54:00:12:34:56,xu-qemu0,10.56.0.101,1440m
+    '';
+  in {
+    after = [ "network.target" "systemd-resolved.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "dbus";
+      BusName = "uk.org.thekelleys.dnsmasq";
+      # -1 --enable-dbus[=uk.org.thekelleys.dnsmasq]
+      SyslogIdentifier = "qemu-dnsmasq";
+      ExecStart = "${pkgs.dnsmasq}/bin/dnsmasq -1k -u qemu-dnsmasq -C ${conf}";
+      ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+      PrivateTmp = "true";
+    };
+    restartTriggers = [ config.environment.etc.hosts.source ];
+  };
+
+
+  krebs.nginx.servers.init = {
+    server-names = [
+      "init.${host-name}"
+      "init.${host-name}.r"
+      "init.${host-name}.retiolum"
+    ];
+    extraConfig = ''
+      index init.txt;
+      root ${pkgs.writeTextFile {
+        name = "init-pages";
+        text = ''
+          #! /bin/sh
+          set -efu
+
+          dev=/dev/sda
+          pttype=dos # gpt
+
+          case $pttype in
+            dos)
+              if ! test "$(blkid -o value -s PTTYPE "$dev")" = dos; then
+                parted -s "$dev" mklabel msdos
+              fi
+              if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = primary; then
+                parted -s "$dev" mkpart primary ext4 1MiB 513MiB