diff options
41 files changed, 751 insertions, 270 deletions
diff --git a/default.nix b/default.nix index 11bae7d98..b261e51e7 100644 --- a/default.nix +++ b/default.nix @@ -17,7 +17,8 @@ { current-date ? abort "current-date not defined" , current-host-name ? abort "current-host-name not defined" , current-user-name ? builtins.getEnv "LOGNAME" -}@current: +, StrictHostKeyChecking ? "yes" +}@args: let stockholm = { # The generated scripts to deploy (or infest) systems can be found in the @@ -44,11 +45,25 @@ let stockholm = { # Additionally, output lib and pkgs for easy access from the shell. # Notice how we're evaluating just the base module to obtain pkgs. inherit lib; - inherit (eval {}) pkgs; + inherit pkgs; }; - krebs = import ./krebs (current // { inherit stockholm; }); - inherit (krebs) lib; + krebs = import ./krebs (args // { inherit lib stockholm; }); + + lib = + let + lib = import <nixpkgs/lib>; + klib = import ./krebs/4lib { inherit lib; }; + #ulib = import (./. + "/${current-user-name}/4lib") { lib = lib // klib; }; + ulib = {}; # TODO + in + builtins // lib // klib // ulib // rec { + # TODO move this stuff + stockholm-path = ./.; + nspath = ns: p: stockholm-path + "/${ns}/${p}"; + }; + + inherit (eval {}) pkgs; # Path resolvers for common and individual files. # Example: `upath "3modules"` produces the current user's 3modules directory @@ -65,8 +80,8 @@ let stockholm = { let # Notice the ordering. Krebs packages can only depend on Nixpkgs, # whereas user packages additionally can depend on krebs packages. - kpkgs = import (kpath "5pkgs") { inherit pkgs; }; - upkgs = import (upath "5pkgs") { pkgs = pkgs // kpkgs; }; + kpkgs = import (kpath "5pkgs") { inherit lib pkgs; }; + upkgs = import (upath "5pkgs") { inherit lib; pkgs = pkgs // kpkgs; }; in kpkgs // upkgs; }; @@ -76,8 +91,10 @@ let stockholm = { # packages and modules on top of NixOS. Some of this stuff might become # useful to a broader audience, at which point it should probably be merged # and pull-requested for inclusion into NixOS/nixpkgs. - # TODO provide krebs lib, so modules don't have to import it awkwardly eval = config: import <nixpkgs/nixos/lib/eval-config.nix> { + specialArgs = { + inherit lib; + }; modules = [ base-module config diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index 57495ea69..1205e192b 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -1,6 +1,6 @@ { config, lib, ... }: -with import ../4lib { inherit lib; }; +with lib; let target = config.krebs.build // { user.name = "root"; }; diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index bc858f668..e0c3b00f8 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -1,6 +1,6 @@ { config, lib, ... }: -with import ../4lib { inherit lib; }; +with lib; let cfg = config.krebs; diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index 64b7820b2..234129497 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -6,7 +6,7 @@ # TODO when authorized_keys changes, then restart ssh # (or kill already connected users somehow) -with import ../4lib { inherit lib; }; +with lib; let cfg = config.krebs.git; diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix index 2a1df9e03..5503ee8d6 100644 --- a/krebs/3modules/github-hosts-sync.nix +++ b/krebs/3modules/github-hosts-sync.nix @@ -1,7 +1,6 @@ { config, lib, pkgs, ... }: -with builtins; -with import ../4lib { inherit lib; }; +with lib; let cfg = config.krebs.github-hosts-sync; diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index afedf95f2..498282b03 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -1,8 +1,36 @@ { lib, ... }: -with import ../../4lib { inherit lib; }; +with lib; -{ +let + testHosts = lib.genAttrs [ + "test-arch" + "test-centos6" + "test-centos7" + ] (name: { + inherit name; + cores = 1; + nets = { + retiolum = { + addrs4 = ["10.243.111.111"]; + addrs6 = ["42:0:0:0:0:0:0:7357"]; + aliases = [ + "test.retiolum" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAy41YKF/wpHLnN370MSdnAo63QUW30aw+6O79cnaJyxoL6ZQkk4Nd + mrX2tBIfb2hhhgm4Jecy33WVymoEL7EiRZ6gshJaYwte51Jnrac6IFQyiRGMqHY5 + TG/6IzzTOkeQrT1fw3Yfh0NRfqLBZLr0nAFoqgzIVRxvy+QO1gCU2UDKkQ/y5df1 + K+YsMipxU08dsOkPkmLdC/+vDaZiEdYljIS3Omd+ED5JmLM3MSs/ZPQ8xjkjEAy8 + QqD9/67bDoeXyg1ZxED2n0+aRKtU/CK/66Li//yev6yv38OQSEM4t/V0dr9sjLcY + VIdkxKf96F9r3vcDf/9xw2HrqVoy+D5XYQIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + }); +in { hosts = addNames { echelon = { cores = 4; @@ -104,7 +132,11 @@ with import ../../4lib { inherit lib; }; uriel = { cores = 1; dc = "lass"; - nets = rec { + nets = { + gg23 = { + addrs4 = ["10.23.1.12"]; + aliases = ["uriel.gg23"]; + }; retiolum = { addrs4 = ["10.243.81.176"]; addrs6 = ["42:dc25:60cf:94ef:759b:d2b6:98a9:2e56"]; @@ -131,7 +163,11 @@ with import ../../4lib { inherit lib; }; mors = { cores = 2; dc = "lass"; - nets = rec { + nets = { + gg23 = { + addrs4 = ["10.23.1.11"]; + aliases = ["mors.gg23"]; + }; retiolum = { addrs4 = ["10.243.0.2"]; addrs6 = ["42:0:0:0:0:0:0:dea7"]; @@ -155,8 +191,24 @@ with import ../../4lib { inherit lib; }; ssh.privkey.path = <secrets/ssh.id_ed25519>; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAMPlIG+6u75GJ3kvsPF6OoIZsU+u8ZQ+rdviv5fNMD"; }; + schnabel-ap = { + nets = { + gg23 = { + addrs4 = ["10.23.1.20"]; + aliases = ["schnabel-ap.gg23"]; + }; + }; + }; + Reichsfunk-ap = { + nets = { + gg23 = { + addrs4 = ["10.23.1.10"]; + aliases = ["Reichsfunk-ap.gg23"]; + }; + }; + }; - }; + } // testHosts; users = addNames { lass = { pubkey = readFile ../../Zpubkeys/lass.ssh.pub; diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index bc0d389f2..d328033cc 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -1,6 +1,6 @@ { lib, ... }: -with import ../../4lib { inherit lib; }; +with lib; { hosts = addNames { diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index 5d5fead8f..4c295dffe 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -1,6 +1,6 @@ { lib, ... }: -with import ../../4lib { inherit lib; }; +with lib; { dns.providers = { @@ -65,7 +65,7 @@ with import ../../4lib { inherit lib; }; dc = "tv"; #dc = "cac"; nets = rec { internet = { - addrs4 = ["104.233.84.215"]; + addrs4 = ["104.167.114.142"]; aliases = [ "mkdir.internet" ]; @@ -231,6 +231,7 @@ with import ../../4lib { inherit lib; }; addrs6 = ["42:0:0:0:0:0:0:1337"]; aliases = [ "wu.retiolum" + "cgit.wu.retiolum" ]; tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix index 0a6101314..396307c22 100644 --- a/krebs/4lib/default.nix +++ b/krebs/4lib/default.nix @@ -3,8 +3,6 @@ with builtins; with lib; -builtins // -lib // rec { eq = x: y: x == y; diff --git a/krebs/4lib/infest/finalize.sh b/krebs/4lib/infest/finalize.sh index 0039960c5..94b13e0be 100644 --- a/krebs/4lib/infest/finalize.sh +++ b/krebs/4lib/infest/finalize.sh @@ -3,8 +3,8 @@ set -eux { umount /mnt/nix umount /mnt/root - umount /boot || : umount /mnt/boot + umount /boot || : umount /mnt coreutils_path=$(set +f; for i in /nix/store/*coreutils*/bin; do :; done; echo $i) diff --git a/krebs/4lib/infest/prepare.sh b/krebs/4lib/infest/prepare.sh index 9fbd5be86..94c9b0fb5 100644 --- a/krebs/4lib/infest/prepare.sh +++ b/krebs/4lib/infest/prepare.sh @@ -18,6 +18,13 @@ prepare() {( esac ;; esac + elif test -e /etc/centos-release; then + case $(cat /etc/centos-release) in + 'CentOS release 6.5 (Final)') + prepare_centos "$@" + exit + ;; + esac fi echo "$0 prepare: unknown OS" >&2 exit -1 diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix index 84fb8725b..0ec4b3ded 100644 --- a/krebs/5pkgs/default.nix +++ b/krebs/5pkgs/default.nix @@ -1,7 +1,6 @@ -{ pkgs, ... }: - -with import ../4lib { inherit (pkgs) lib; }; +{ lib, pkgs, ... }: +with lib; let subdirs = mapAttrs (_: flip pkgs.callPackage {}) (subdirsOf ./.); pkgs' = pkgs // subdirs; diff --git a/krebs/default.nix b/krebs/default.nix index c23cf152a..31a7f7d04 100644 --- a/krebs/default.nix +++ b/krebs/default.nix @@ -1,14 +1,16 @@ { current-date , current-host-name , current-user-name +, lib , stockholm +, StrictHostKeyChecking ? "yes" }: let out = { inherit deploy; inherit infest; inherit init; - inherit lib; + inherit nixos-install; }; deploy = @@ -23,7 +25,7 @@ let out = { set -efu (${populate args}) ${rootssh target '' - ${install args} + ${nix-install args} ${config.krebs.build.profile}/bin/switch-to-configuration switch ''} echo OK @@ -39,63 +41,14 @@ let out = { # krebs.infest set -efu - # XXX type -p is non-standard - #export RSYNC_RSH; RSYNC_RSH="$(type -p ssh) \ - # -o 'HostName $ {target.host.infest.addr}' \ - # -o 'Port $ {toString target.host.infest.port}' \ - #" - #ssh() { - # eval "$RSYNC_RSH \"\$@\"" - #} - - ${lib.rootssh target '' + ${rootssh target '' ${builtins.readFile ./4lib/infest/prepare.sh} ${builtins.readFile ./4lib/infest/install-nix.sh} ''} - (${lib.populate args}) - - ${lib.rootssh target '' - export PATH; PATH=/root/.nix-profile/bin:$PATH - - src=$(type -p nixos-install) - cat_src() { - sed < "$src" "$( - { sed < "$src" -n ' - /^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/= - /^nixpkgs=/= - /^NIX_PATH=/,/^$/{/./=} - - # Disable: Copy the NixOS/Nixpkgs sources to the target as - # the initial contents of the NixOS channel. - /^srcs=/,/^ln -sfn /= - ' - } | sed 's:$:s/^/#krebs#/:' - )" - } - - # Location to insert install - i=$(sed -n '/^echo "building the system configuration/=' "$src") - - { - cat_src | sed -n "1,$i{p}" - cat ${lib.doc (install args)} - cat_src | sed -n "$i,\''${$i!p}" - } > nixos-install - chmod +x nixos-install - - ## Wrap inserted install into chroot. - #nix_env=$(cat_src | sed -n ' - # s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q - #') - #echo nix-env is $nix_env - #sed -i ' - # s:^nix-env:chroot $mountPoint '"$nix_env"': - #' nixos-install - - unset SSL_CERT_FILE - ./nixos-install + (${nixos-install args}) + ${rootssh target '' ${builtins.readFile ./4lib/infest/finalize.sh} ''} ''; @@ -135,10 +88,74 @@ let out = { EOF ''; - lib = import ./4lib { lib = import <nixpkgs/lib>; } // rec { - stockholm-path = ../.; - nspath = ns: p: stockholm-path + "/${ns}/${p}"; - }; + nixos-install = + { system ? current-host-name + , target ? system + }@args: let + in '' + #! /bin/sh + # ${current-date} ${current-user-name}@${current-host-name} + # krebs.nixos-install + (${populate args}) + + ${rootssh target '' + export PATH; PATH=/root/.nix-profile/bin:$PATH + + src=$(type -p nixos-install) + cat_src() { + sed < "$src" "$( + { sed < "$src" -n ' + /^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/= + /^nixpkgs=/= + /^NIX_PATH=/,/^$/{/./=} + + # Disable: Copy the NixOS/Nixpkgs sources to the target as + # the initial contents of the NixOS channel. + /^srcs=/,/^ln -sfn /= + ' + } | sed 's:$:s/^/#krebs#/:' + )" + } + + # Location to insert `nix-install` + i=$(sed -n '/^echo "building the system configuration/=' "$src") + + { + cat_src | sed -n "1,$i{p}" + cat ${doc (nix-install args)} + cat_src | sed -n "$i,\''${$i!p}" + } > nixos-install + chmod +x nixos-install + + # Wrap inserted nix-install into chroot. + nix_env=$(cat_src | sed -n ' + s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q + ') + echo "nix-env is $nix_env" >&2 + findpkg() {( + name=$1 + path=$(find /nix/store \ + -mindepth 1 -maxdepth 1 -type d -name '*-'"$name"'-*' \ + | head -n 1 | sed s:^/mnt::) + if echo "$path" | grep .; then + echo "$name is $path" >&2 + else + echo "Error: package not found: $name" >&2 + exit 1 + fi + )} + cacert=$(findpkg cacert) + coreutils=$(findpkg coreutils) + cp "$cacert"/etc/ssl/certs/ca-bundle.crt /mnt/root/SSL_CERT_FILE + env="$coreutils/bin/env SSL_CERT_FILE=/root/SSL_CERT_FILE" + sed -i ' + s:^NIX_PATH=:chroot $mountPoint '"$env"' &: + s:^nix-env:'"$nix_env"': + ' nixos-install + + ./nixos-install + ''} + ''; doc = s: let b = "EOF${builtins.hashString "sha256" s}"; in @@ -152,7 +169,7 @@ let out = { stockholm.users.${current-user-name}.${system}.config or (abort "unknown system: ${system}, user: ${current-user-name}"); - install = + nix-install = { system ? current-host-name , target ? system }: @@ -203,11 +220,8 @@ let out = { current-host = config.krebs.hosts.${current-host-name}; current-user = config.krebs.users.${current-user-name}; - target-host = config.krebs.hosts.${system}; - methods.dir = config: let - can-link = config.host.name == target-host.name; can-push = config.host.name == current-host.name; push-method = '' rsync \ @@ -221,11 +235,11 @@ let out = { ${config.path}/ \ root@${target}:${config.target-path} ''; - url = "file://${config.host.name}${config.path}"; in - #if can-link then link-method else if can-push then push-method else - throw "cannot source ${url}"; + let dir = "file://${config.host.name}${config.path}"; in + # /!\ revise this message when using more than just push-method + throw "No way to push ${dir} from ${current-host.name} to ${target}"; methods.git = config: rootssh target '' @@ -251,7 +265,10 @@ let out = { in out; rootssh = target: script: - "ssh root@${target} -T ${doc '' + let + flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}"; + in + "ssh ${flags} root@${target} -T ${doc '' set -efu ${script} ''}"; diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs.nix index 17915e087..ab24b584b 100644 --- a/lass/1systems/cloudkrebs.nix +++ b/lass/1systems/cloudkrebs.nix @@ -27,30 +27,9 @@ in { } { - nix.maxJobs = 1; sound.enable = false; } ]; - krebs.build = { - user = config.krebs.users.lass; - host = config.krebs.hosts.cloudkrebs; - source = { - dir.secrets = { - host = config.krebs.hosts.mors; - path = "/home/lass/secrets/${config.krebs.build.host.name}"; - }; - dir.stockholm = { - host = config.krebs.hosts.mors; - path = "/home/lass/dev/stockholm"; - }; - }; - }; - - networking.hostName = "cloudkrebs"; - - environment.systemPackages = [ - pkgs.dic - ]; - + krebs.build.host = config.krebs.hosts.cloudkrebs; } diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix index feaf77ef6..94c793b08 100644 --- a/lass/1systems/echelon.nix +++ b/lass/1systems/echelon.nix @@ -31,26 +31,23 @@ in { } { - nix.maxJobs = 1; sound.enable = false; } - ]; - - krebs.build = { - user = config.krebs.users.lass; - host = config.krebs.hosts.echelon; - source = { - dir.secrets = { - host = config.krebs.hosts.mors; - path = "/home/lass/secrets/${config.krebs.build.host.name}"; - }; - dir.stockholm = { - host = config.krebs.hosts.mors; - path = "/home/lass/dev/stockholm"; + { + imports = [ + ../3modules/dnsmasq.nix + ]; + lass.dnsmasq = { + enable = true; + config = '' + interface=retiolum + ''; }; - }; - }; - - networking.hostName = config.krebs.build.host.name; + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-i retiolum -p udp --dport 53"; target = "ACCEPT"; } + ]; + } + ]; + krebs.build.host = config.krebs.hosts.echelon; } diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index 7076c8b14..b0b8ff573 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -2,7 +2,7 @@ { imports = [ - ../2configs/desktop-base.nix + ../2configs/baseX.nix ../2configs/programs.nix ../2configs/bitcoin.nix ../2configs/browsers.nix @@ -10,7 +10,6 @@ ../2configs/pass.nix ../2configs/virtualbox.nix ../2configs/elster.nix - ../2configs/urxvt.nix ../2configs/steam.nix ../2configs/wine.nix ../2configs/texlive.nix @@ -18,7 +17,6 @@ #../2configs/ircd.nix ../2configs/chromium-patched.nix ../2configs/git.nix - #../../2configs/tv/synaptics.nix ../2configs/retiolum.nix ../2configs/wordpress.nix ../2configs/bitlbee.nix @@ -26,22 +24,8 @@ ../2configs/skype.nix ]; - krebs.build = { - user = config.krebs.users.lass; - host = config.krebs.hosts.mors; - source = { - dir.secrets = { - host = config.krebs.hosts.mors; - path = "/home/lass/secrets/${config.krebs.build.host.name}"; - }; - dir.stockholm = { - host = config.krebs.hosts.mors; - path = "/home/lass/dev/stockholm"; - }; - }; - }; + krebs.build.host = config.krebs.hosts.mors; - networking.hostName = "mors"; networking.wireless.enable = true; networking.extraHosts = '' @@ -52,8 +36,6 @@ 10.243.206.102 apanowicz.de ''; - nix.maxJobs = 4; - hardware.enableAllFirmware = true; nixpkgs.config.allowUnfree = true; @@ -159,11 +141,6 @@ emulateWheel = true; }; - #system.activationScripts.trackpoint = '' - # echo 0 > '/sys/devices/platform/i8042/serio1/serio2/speed' - # echo 220 > '/sys/devices/platform/i8042/serio1/serio2/sensitivity' - #''; - services.xserver = { videoDriver = "intel"; vaapiDrivers = [ pkgs.vaapiIntel ]; @@ -210,9 +187,19 @@ ]; }; }; + #touchpad config services.xserver.synaptics = { enable = true; + accelFactor = "0.035";</ |