summaryrefslogtreecommitdiffstats
path: root/krebs
diff options
context:
space:
mode:
Diffstat (limited to 'krebs')
-rw-r--r--krebs/2configs/acme.nix2
-rw-r--r--krebs/2configs/cal.nix2
-rw-r--r--krebs/2configs/hotdog-host.nix3
-rw-r--r--krebs/2configs/mastodon.nix6
-rw-r--r--krebs/2configs/news-host.nix3
-rw-r--r--krebs/2configs/reaktor2.nix2
-rw-r--r--krebs/2configs/repo-sync.nix2
-rw-r--r--krebs/2configs/syncthing.nix4
-rw-r--r--krebs/2configs/tor/initrd.nix4
-rw-r--r--krebs/2configs/wiki.nix2
-rw-r--r--krebs/3modules/exim-smarthost.nix4
-rw-r--r--krebs/3modules/fetchWallpaper.nix2
-rw-r--r--krebs/3modules/github/hosts-sync.nix2
-rw-r--r--krebs/3modules/iptables.nix2
-rw-r--r--krebs/3modules/power-action.nix6
-rw-r--r--krebs/3modules/repo-sync.nix2
-rw-r--r--krebs/3modules/retiolum-bootstrap.nix4
-rw-r--r--krebs/3modules/tinc.nix4
-rw-r--r--krebs/5pkgs/haskell/nix-serve-ng.nix6
-rw-r--r--krebs/5pkgs/simple/fzfmenu/default.nix2
-rw-r--r--krebs/5pkgs/simple/ovh-zone/default.nix1
-rw-r--r--krebs/5pkgs/simple/realwallpaper/get_constellations.py29
-rw-r--r--krebs/5pkgs/simple/renew-krebs-intermediate-ca/default.nix30
-rw-r--r--krebs/5pkgs/simple/vicuna-chat/default.nix2
-rw-r--r--krebs/nixpkgs-unstable.json10
-rw-r--r--krebs/nixpkgs.json10
26 files changed, 92 insertions, 54 deletions
diff --git a/krebs/2configs/acme.nix b/krebs/2configs/acme.nix
index 056aa7ae4..0b9cb91af 100644
--- a/krebs/2configs/acme.nix
+++ b/krebs/2configs/acme.nix
@@ -24,7 +24,7 @@ in {
path = "/var/lib/step-ca/intermediate_ca.key";
owner.name = "root";
mode = "1444";
- source-path = builtins.toString <secrets> + "/acme_ca.key";
+ source-path = "${config.krebs.secret.directory}/acme_ca.key";
};
services.step-ca = {
enable = true;
diff --git a/krebs/2configs/cal.nix b/krebs/2configs/cal.nix
index a1fe47b5d..1a0cdf019 100644
--- a/krebs/2configs/cal.nix
+++ b/krebs/2configs/cal.nix
@@ -108,7 +108,7 @@ in {
krebs.secret.files.calendar = {
path = "/var/lib/radicale/.ssh/id_ed25519";
owner = { name = "radicale"; };
- source-path = "${<secrets/radicale.id_ed25519>}";
+ source-path = "${config.krebs.secret.directory}/radicale.id_ed25519";
};
security.sudo.extraConfig = ''
diff --git a/krebs/2configs/hotdog-host.nix b/krebs/2configs/hotdog-host.nix
index 95d70376b..ab2b22b7c 100644
--- a/krebs/2configs/hotdog-host.nix
+++ b/krebs/2configs/hotdog-host.nix
@@ -1,6 +1,7 @@
+{ config, ... }:
{
krebs.sync-containers3.containers.hotdog = {
- sshKey = "${toString <secrets>}/hotdog.sync.key";
+ sshKey = "${config.krebs.secret.directory}/hotdog.sync.key";
};
containers.hotdog.bindMounts."/var/lib" = {
hostPath = "/var/lib/sync-containers3/hotdog/state";
diff --git a/krebs/2configs/mastodon.nix b/krebs/2configs/mastodon.nix
index 145b383ed..af308b2c7 100644
--- a/krebs/2configs/mastodon.nix
+++ b/krebs/2configs/mastodon.nix
@@ -33,8 +33,10 @@
];
environment.systemPackages = [
- (pkgs.writers.writeDashBin "tootctl" ''
- sudo -u mastodon /etc/profiles/per-user/mastodon/bin/mastodon-env /etc/profiles/per-user/mastodon/bin/tootctl "$@"
+ (pkgs.writers.writeDashBin "clear-mastodon-cache" ''
+ mastodon-tootctl media remove --prune-profiles --days=14 --concurrency=30
+ mastodon-tootctl media remove-orphans
+ mastodon-tootctl preview_cards remove --days=14
'')
(pkgs.writers.writeDashBin "create-mastodon-user" ''
set -efu
diff --git a/krebs/2configs/news-host.nix b/krebs/2configs/news-host.nix
index 71793e518..81922ef87 100644
--- a/krebs/2configs/news-host.nix
+++ b/krebs/2configs/news-host.nix
@@ -1,5 +1,6 @@
+{ config, ... }:
{
krebs.sync-containers3.containers.news = {
- sshKey = "${toString <secrets>}/news.sync.key";
+ sshKey = "${config.krebs.secret.directory}/news.sync.key";
};
}
diff --git a/krebs/2configs/reaktor2.nix b/krebs/2configs/reaktor2.nix
index 0f7ab0adf..bc5bfc0fb 100644
--- a/krebs/2configs/reaktor2.nix
+++ b/krebs/2configs/reaktor2.nix
@@ -486,7 +486,7 @@ in {
services.nginx.virtualHosts."agenda.r" = {
serverAliases = [ "kri.r" ];
locations."= /index.html".extraConfig = ''
- alias ./agenda.html;
+ alias ${./agenda.html};
'';
locations."/agenda.json".extraConfig = ''
proxy_set_header Host $host;
diff --git a/krebs/2configs/repo-sync.nix b/krebs/2configs/repo-sync.nix
index 1b72924a6..a488fdfea 100644
--- a/krebs/2configs/repo-sync.nix
+++ b/krebs/2configs/repo-sync.nix
@@ -98,7 +98,7 @@ in {
krebs.secret.files.konsens = {
path = "/var/lib/konsens/.ssh/id_ed25519";
owner = konsens-user;
- source-path = "${<secrets/konsens.id_ed25519>}";
+ source-path = "${config.krebs.secret.directory}/konsens.id_ed25519>";
};
imports = [
diff --git a/krebs/2configs/syncthing.nix b/krebs/2configs/syncthing.nix
index 59178516c..90ae66f6e 100644
--- a/krebs/2configs/syncthing.nix
+++ b/krebs/2configs/syncthing.nix
@@ -10,8 +10,8 @@ in {
services.syncthing = {
enable = true;
configDir = "/var/lib/syncthing";
- key = toString <secrets/syncthing.key>;
- cert = toString <secrets/syncthing.cert>;
+ key = "${config.krebs.secret.directory}/syncthing.key";
+ cert = "${config.krebs.secret.directory}/syncthing.cert";
# workaround for infinite recursion on unstable, remove in 23.11
} // (if builtins.hasAttr "settings" options.services.syncthing then
{ settings.devices = mk_peers used_peers; }
diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix
index 98ed039b4..21c46a0a7 100644
--- a/krebs/2configs/tor/initrd.nix
+++ b/krebs/2configs/tor/initrd.nix
@@ -13,12 +13,12 @@
config.krebs.users.makefu.pubkey
config.krebs.users.tv.pubkey
];
- hostKeys = [ <secrets/initrd/openssh_host_ecdsa_key> ];
+ hostKeys = [ "${config.krebs.secret.directory}/initrd/openssh_host_ecdsa_key" ];
};
boot.initrd.availableKernelModules = [ "e1000e" ];
boot.initrd.secrets = {
- "/etc/tor/onion/bootup" = <secrets/initrd>;
+ "/etc/tor/onion/bootup" = "${config.krebs.secret.directory}/initrd";
};
boot.initrd.extraUtilsCommands = ''
diff --git a/krebs/2configs/wiki.nix b/krebs/2configs/wiki.nix
index a227ceb4a..4b0bf9768 100644
--- a/krebs/2configs/wiki.nix
+++ b/krebs/2configs/wiki.nix
@@ -96,7 +96,7 @@ in
krebs.secret.files.gollum = {
path = "${config.services.gollum.stateDir}/.ssh/id_ed25519";
owner = { name = "gollum"; };
- source-path = "${<secrets/gollum.id_ed25519>}";
+ source-path = "${config.krebs.secret.directory}/gollum.id_ed25519";
};
security.sudo.extraConfig = ''
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index 093ae2030..4e42ce72e 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -20,14 +20,14 @@ let
};
dkim = mkOption {
- type = types.listOf (types.submodule ({ config, ... }: {
+ type = types.listOf (types.submodule (dkim: {
options = {
domain = mkOption {
type = types.str;
};
private_key = mkOption {
type = types.absolute-pathname;
- default = toString <secrets> + "/${config.domain}.dkim.priv";
+ default = "${config.krebs.secret.directory}/${dkim.config.domain}.dkim.priv";
defaultText = "‹secrets/‹domain›.dkim.priv›";
};
selector = mkOption {
diff --git a/krebs/3modules/fetchWallpaper.nix b/krebs/3modules/fetchWallpaper.nix
index 79187adfa..0d67120fd 100644
--- a/krebs/3modules/fetchWallpaper.nix
+++ b/krebs/3modules/fetchWallpaper.nix
@@ -40,7 +40,7 @@ let
};
};
- fetchWallpaperScript = pkgs.writeDash "fetchWallpaper" ''
+ fetchWallpaperScript = pkgs.writers.writeDash "fetchWallpaper" ''
set -euf
mkdir -p ${cfg.stateDir}
diff --git a/krebs/3modules/github/hosts-sync.nix b/krebs/3modules/github/hosts-sync.nix
index 6f9aee0ce..2f373f9bc 100644
--- a/krebs/3modules/github/hosts-sync.nix
+++ b/krebs/3modules/github/hosts-sync.nix
@@ -22,7 +22,7 @@ let
};
ssh-identity-file = mkOption {
type = types.suffixed-str [".ssh.id_ed25519" ".ssh.id_rsa"];
- default = toString <secrets/github-hosts-sync.ssh.id_ed25519>;
+ default = "${config.krebs.secret.directory}/github-hosts-sync.ssh.id_ed25519";
defaultText = "‹secrets/github-hosts-sync.ssh.id_ed25519›";
};
url = mkOption {
diff --git a/krebs/3modules/iptables.nix b/krebs/3modules/iptables.nix
index c1c5b68c8..32a5273a5 100644
--- a/krebs/3modules/iptables.nix
+++ b/krebs/3modules/iptables.nix
@@ -177,7 +177,7 @@ let
${buildTables iptables-version cfg.tables}
'';
- startScript = pkgs.writeDash "krebs-iptables_start" ''
+ startScript = pkgs.writers.writeDash "krebs-iptables_start" ''
set -euf
iptables-restore < ${rules "v4"}
ip6tables-restore < ${rules "v6"}
diff --git a/krebs/3modules/power-action.nix b/krebs/3modules/power-action.nix
index 71e2b541a..a9ed24d3f 100644
--- a/krebs/3modules/power-action.nix
+++ b/krebs/3modules/power-action.nix
@@ -60,7 +60,7 @@ let
};
};
- startScript = pkgs.writeDash "power-action" ''
+ startScript = pkgs.writers.writeDash "power-action" ''
set -euf
power="$(${powerlvl})"
@@ -77,11 +77,11 @@ let
writeRule = _: plan:
"if [ $power -ge ${toString plan.lowerLimit} ] && [ $power -le ${toString plan.upperLimit} ] ${charging_check plan}; then ${plan.action}; fi";
- powerlvl = pkgs.writeDash "powerlvl" ''
+ powerlvl = pkgs.writers.writeDash "powerlvl" ''
cat /sys/class/power_supply/${cfg.battery}/capacity
'';
- state = pkgs.writeDash "state" ''
+ state = pkgs.writers.writeDash "state" ''
if [ "$(cat /sys/class/power_supply/${cfg.battery}/status)" = "Discharging" ]
then echo "false"
else echo "true"
diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix
index a6de3f3f6..5208d91ae 100644
--- a/krebs/3modules/repo-sync.nix
+++ b/krebs/3modules/repo-sync.nix
@@ -123,7 +123,7 @@ let
privateKeyFile = mkOption {
type = types.absolute-pathname;
- default = toString <secrets> + "/repo-sync.ssh.key";
+ default = "${config.krebs.secret.directory}/repo-sync.ssh.key";
defaultText = "‹secrets/repo-sync.ssh.key›";
};
diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix
index c9ea8a619..bd7e7c5f6 100644
--- a/krebs/3modules/retiolum-bootstrap.nix
+++ b/krebs/3modules/retiolum-bootstrap.nix
@@ -14,12 +14,12 @@ in
sslCertificate = mkOption {
type = types.str;
description = "Certificate file to use for ssl";
- default = "${toString <secrets>}/tinc.krebsco.de.crt" ;
+ default = "${config.krebs.secret.directory}/tinc.krebsco.de.crt" ;
};
sslCertificateKey = mkOption {
type = types.str;
description = "Certificate key to use for ssl";
- default = "${toString <secrets>}/tinc.krebsco.de.key";
+ default = "${config.krebs.secret.directory}/tinc.krebsco.de.key";
};
# in use:
# <secrets/tinc.krebsco.de.crt>
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 2f9efad46..9df368cfb 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -149,7 +149,7 @@ with import ../../lib/pure.nix { inherit lib; }; {
privkey = mkOption {
type = types.absolute-pathname;
- default = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
+ default = "${config.krebs.secret.directory}/${tinc.config.netname}.rsa_key.priv";
defaultText = "‹secrets/‹netname›.rsa_key.priv›";
};
@@ -158,7 +158,7 @@ with import ../../lib/pure.nix { inherit lib; }; {
default =
if tinc.config.host.nets.${netname}.tinc.pubkey_ed25519 == null
then null
- else toString <secrets> + "/${tinc.config.netname}.ed25519_key.priv";
+ else "${config.krebs.secret.directory}/${tinc.config.netname}.ed25519_key.priv";
defaultText = "‹secrets/‹netname›.ed25519_key.priv›";
};
diff --git a/krebs/5pkgs/haskell/nix-serve-ng.nix b/krebs/5pkgs/haskell/nix-serve-ng.nix
index 8866b205b..62e02ce82 100644
--- a/krebs/5pkgs/haskell/nix-serve-ng.nix
+++ b/krebs/5pkgs/haskell/nix-serve-ng.nix
@@ -6,11 +6,11 @@
}:
mkDerivation {
pname = "nix-serve-ng";
- version = "1.0.0";
+ version = "1.0.1";
src = fetchgit {
url = "https://github.com/aristanetworks/nix-serve-ng";
- sha256 = "0mqp67z5mi8rsjahdh395n7ppf0b65k8rd3pvnl281g02rbr69y2";
- rev = "433f70f4daae156b84853f5aaa11987aa5ce7277";
+ sha256 = "sha256-PkzwtjUgYuqfWtCH1nRqVRaajihN1SqMVjWmoSG/CCY=";
+ rev = "9b546864f4090736f3f9069a01ea5d42cf7bab7c";
fetchSubmodules = true;
};
isLibrary = false;
diff --git a/krebs/5pkgs/simple/fzfmenu/default.nix b/krebs/5pkgs/simple/fzfmenu/default.nix
index eb2441330..030c1b1b1 100644
--- a/krebs/5pkgs/simple/fzfmenu/default.nix
+++ b/krebs/5pkgs/simple/fzfmenu/default.nix
@@ -43,7 +43,7 @@ pkgs.writers.writeDashBin "fzfmenu" ''
set -efu
# Spawn terminal if called without one, like e.g. from a window manager.
- if [ -z ''${TERM+x} ]; then
+ if [ -z ''${TERM+x} ] || [ $TERM = dumb ]; then
exec 3<&0
exec 4>&1
export FZFMENU_INPUT_FD=3
diff --git a/krebs/5pkgs/simple/ovh-zone/default.nix b/krebs/5pkgs/simple/ovh-zone/default.nix
index 051a14e8d..bc0e45cb9 100644
--- a/krebs/5pkgs/simple/ovh-zone/default.nix
+++ b/krebs/5pkgs/simple/ovh-zone/default.nix
@@ -9,7 +9,6 @@ python3Packages.buildPythonPackage rec {
name = "ovh-zone-${version}";
version = "0.4.4";
propagatedBuildInputs = with pkgs.python3Packages;[
- d2to1 # for setup to work
ovh
docopt
];
diff --git a/krebs/5pkgs/simple/realwallpaper/get_constellations.py b/krebs/5pkgs/simple/realwallpaper/get_constellations.py
index 5d8d3df5d..4ba766f6a 100644
--- a/krebs/5pkgs/simple/realwallpaper/get_constellations.py
+++ b/krebs/5pkgs/simple/realwallpaper/get_constellations.py
@@ -18,19 +18,24 @@ def points_to_lines(points):
return lines
-with open(sys.argv[1]) as f:
- constellations = json.load(f)['features']
+def main():
+ with open(sys.argv[1]) as f:
+ constellations = json.load(f)['features']
-output = []
+ output = []
-for const in constellations:
- for line in const['geometry']['coordinates']:
- transformed_line = []
- for point in line:
- transformed_line.append(convert_to_itrs(point))
+ for const in constellations:
+ for line in const['geometry']['coordinates']:
+ transformed_line = []
+ for point in line:
+ transformed_line.append(convert_to_itrs(point))
- line_combined = points_to_lines(transformed_line)
- for l in line_combined: # noqa
- output.append(f'{l[0][0]} {l[0][1]} {l[1][0]} {l[1][1]} # {const["id"]}') # noqa
+ line_combined = points_to_lines(transformed_line)
+ for l in line_combined: # noqa
+ output.append(f'{l[0][0]} {l[0][1]} {l[1][0]} {l[1][1]} # {const["id"]}') # noqa
-print('\n'.join(output))
+ print('\n'.join(output))
+
+
+if __name__ == "__main__":
+ main()
diff --git a/krebs/5pkgs/simple/renew-krebs-intermediate-ca/default.nix b/krebs/5pkgs/simple/renew-krebs-intermediate-ca/default.nix
new file mode 100644
index 000000000..d3557894d
--- /dev/null
+++ b/krebs/5pkgs/simple/renew-krebs-intermediate-ca/default.nix
@@ -0,0 +1,30 @@
+{ pkgs }:
+pkgs.writers.writeDashBin "renew-intermediate-ca" ''
+ TMPDIR=$(mktemp -d)
+ trap "rm -rf $TMPDIR;" INT TERM EXIT
+ mkdir -p "$TMPDIR/krebs"
+ brain show ca/ca.key > "$TMPDIR/krebs/ca.key"
+ brain show ca/ca.crt > "$TMPDIR/krebs/ca.crt"
+ brain show krebs-secrets/hotdog/acme_ca.key > "$TMPDIR/acme.key"
+ cp ${toString ../../../6assets/krebsAcmeCA.crt} "$TMPDIR/acme.crt"
+ export STEPPATH="$TMPDIR/step"
+ cat << EOF > "$TMPDIR/intermediate.tpl"
+ {
+ "subject": {{ toJson .Subject }},
+ "keyUsage": ["certSign", "crlSign"],
+ "basicConstraints": {
+ "isCA": true,
+ "maxPathLen": 0
+ },
+ "nameConstraints": {
+ "critical": true,
+ "permittedDNSDomains": ["r" ,"w"]
+ }
+ }
+ EOF
+
+ ${pkgs.step-cli}/bin/step ca renew "$TMPDIR/ca.crt" "$TMPDIR/ca.key" \
+ --offline \
+ --root "$TMPDIR/krebs/ca.crt" \
+ --ca-config "$TMPDIR/intermediate.tpl"
+''
diff --git a/krebs/5pkgs/simple/vicuna-chat/default.nix b/krebs/5pkgs/simple/vicuna-chat/default.nix
index 11a11aabe..db15899d6 100644
--- a/krebs/5pkgs/simple/vicuna-chat/default.nix
+++ b/krebs/5pkgs/simple/vicuna-chat/default.nix
@@ -23,7 +23,7 @@ pkgs.writers.writeDashBin "vicuna-chat" ''
add_to_context "{\"role\": \"user\", \"content\": \"$PROMPT\"}"
response=$(
jq -nc --slurpfile context "$CONTEXT" '{
- model: "vicuna-13b",
+ model: "vicuna-13b-v1.5-16k",
messages: $context[0],
}' |
curl -Ss http://vicuna.r/v1/chat/completions -H 'Content-Type: application/json' -d @-
diff --git a/krebs/nixpkgs-unstable.json b/krebs/nixpkgs-unstable.json
index 4ae0716ea..2233cd20b 100644
--- a/krebs/nixpkgs-unstable.json
+++ b/krebs/nixpkgs-unstable.json
@@ -1,10 +1,10 @@
{
"url": "https://github.com/NixOS/nixpkgs",
- "rev": "2a9d660ff0f7ffde9d73be328ee6e6f10ef66b28",
- "date": "2023-07-28T14:55:37+02:00",
- "path": "/nix/store/38nmp3rkbjic5dm6g9qp4ldwi7pr602p-nixpkgs",
- "sha256": "0c2x3bcal4kyxgf6i408622zqvxamz986h11z8zjvd7gc8y4wxn7",
- "hash": "sha256-x3ZOPGLvtC0/+iFAg9Kvqm/8hTAIkGjc634SqtgaXTA=",
+ "rev": "aa8aa7e2ea35ce655297e8322dc82bf77a31d04b",
+ "date": "2023-09-01T18:51:16+08:00",
+ "path": "/nix/store/10xskkarnksmn1fahylswv0y4216c73w-nixpkgs",
+ "sha256": "0bbv3y86kfpn02zh5vvdbkmnqyzagzbc1gzpvvlb6qbvgg639bf9",
+ "hash": "sha256-ya00zHt7YbPo3ve/wNZ/6nts61xt7wK/APa6aZAfey0=",
"fetchLFS": false,
"fetchSubmodules": false,
"deepClone": false,
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index 55e54ec64..0b6021ed0 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,10 +1,10 @@
{
"url": "https://github.com/NixOS/nixpkgs",
- "rev": "48e82fe1b1c863ee26a33ce9bd39621d2ada0a33",
- "date": "2023-07-28T18:34:19+03:00",
- "path": "/nix/store/pgqfg8ip3lv0lr6mpwh558npz3c1wwcr-nixpkgs",
- "sha256": "0d7na9ygda2r7gs3gbixd9gvcxgdv84993cilkj86bcwbpbg4vp5",
- "hash": "sha256-5W7y1l2cLYPkpJGNlAja7XW2X2o9rjf0O1mo9nxS9jQ=",
+ "rev": "9075cba53e86dc318d159aee55dc9a7c9a4829c1",
+ "date": "2023-09-02T08:28:47+02:00",
+ "path": "/nix/store/605bv7zssv38j0ii8rbnxkv1m0f0b53p-nixpkgs",
+ "sha256": "0kymzp32d31c0hny2b2f7zfn49nzrxlm963xbm4v0axka6abym36",
+ "hash": "sha256-ZlS/lFGzK7BJXX2YVGnP3yZi3T9OLOEtBCyMJsb91U8=",
"fetchLFS": false,
"fetchSubmodules": false,
"deepClone": false,