From cf53d56a92a67d0210d126acb60270ee5a4b4a21 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 22 Jul 2015 19:09:27 +0200 Subject: Zpkgs tv genid: bump min --- Zpkgs/tv/genid.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Zpkgs/tv/genid.nix b/Zpkgs/tv/genid.nix index 22ef6d29b..c75bec317 100644 --- a/Zpkgs/tv/genid.nix +++ b/Zpkgs/tv/genid.nix @@ -13,7 +13,8 @@ pkgs.writeScriptBin "genid" '' name=$1 hash=$(printf %s "$name" | sha1sum | cut -d\ -f1 | tr a-f A-F) echo " - min=2^16 # bigger than nobody and nogroup, see + min=2^24 # bigger than nobody and nogroup, see + # and some spare for stuff like lxd. max=2^32 # see 2^(8*sizeof(uid_t)) ibase=16 ($hash + min) % max -- cgit v1.2.3 From 14ac6d3bba12f07bd8aa79221b9c64469fe03046 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 22 Jul 2015 19:25:51 +0200 Subject: * tv: regen ids --- 2configs/tv/charybdis.nix | 2 +- 3modules/tv/consul.nix | 4 ++-- 3modules/tv/ejabberd.nix | 3 +-- 3modules/tv/git.nix | 8 ++++---- 3modules/tv/github-hosts-sync.nix | 2 +- 3modules/tv/retiolum.nix | 29 +++++++---------------------- 3modules/tv/urlwatch.nix | 24 ++++++++++-------------- 7 files changed, 26 insertions(+), 46 deletions(-) diff --git a/2configs/tv/charybdis.nix b/2configs/tv/charybdis.nix index f4b7c1012..014844e8b 100644 --- a/2configs/tv/charybdis.nix +++ b/2configs/tv/charybdis.nix @@ -74,7 +74,7 @@ let user = { name = "charybdis"; - uid = 3731512864; # genid charybdis + uid = 3748224544; # genid charybdis }; configFile = toFile "charybdis-ircd.conf" '' diff --git a/3modules/tv/consul.nix b/3modules/tv/consul.nix index 480198456..db0cd7a9e 100644 --- a/3modules/tv/consul.nix +++ b/3modules/tv/consul.nix @@ -88,7 +88,7 @@ let ExecStartPre = pkgs.writeScript "consul-init" '' #! /bin/sh mkdir -p ${cfg.data-dir} - chown consul: ${cfg.data-dir} + chown ${user.name}: ${cfg.data-dir} install -o ${user.name} -m 0400 ${cfg.encrypt-file} /tmp/encrypt.json ''; ExecStart = pkgs.writeScript "consul-service" '' @@ -111,7 +111,7 @@ let user = { name = "consul"; - uid = 2983239726; # genid consul + uid = 2999951406; # genid consul }; in diff --git a/3modules/tv/ejabberd.nix b/3modules/tv/ejabberd.nix index b694d05d2..2910a9a69 100644 --- a/3modules/tv/ejabberd.nix +++ b/3modules/tv/ejabberd.nix @@ -55,8 +55,7 @@ let user = { name = "ejabberd"; - uid = 405222; - # TODO uid = 3483034447; # genid ejabberd + uid = 3499746127; # genid ejabberd }; my-ejabberdctl = pkgs.writeScriptBin "ejabberdctl" '' diff --git a/3modules/tv/git.nix b/3modules/tv/git.nix index 8d2ab482d..8c73d0354 100644 --- a/3modules/tv/git.nix +++ b/3modules/tv/git.nix @@ -149,7 +149,7 @@ let shell = "/bin/sh"; openssh.authorizedKeys.keys = mapAttrsToList (_: makeAuthorizedKey git-ssh-command) cfg.users; - uid = 112606723; # genid git + uid = 129318403; # genid git }; }; @@ -237,13 +237,13 @@ let fcgitwrap-user = { name = "fcgiwrap"; - uid = 2851179180; # genid fcgiwrap + uid = 2867890860; # genid fcgiwrap group = "fcgiwrap"; }; fcgitwrap-group = { - name = "fcgiwrap"; - gid = 2851179180; # genid fcgiwrap + name = fcgitwrap-user.name; + gid = fcgitwrap-user.uid; }; diff --git a/3modules/tv/github-hosts-sync.nix b/3modules/tv/github-hosts-sync.nix index 3da1064a1..f50bf2b1b 100644 --- a/3modules/tv/github-hosts-sync.nix +++ b/3modules/tv/github-hosts-sync.nix @@ -75,7 +75,7 @@ let user = { name = "github-hosts-sync"; - uid = 3203842966; # genid github-hosts-sync + uid = 3220554646; # genid github-hosts-sync }; Zpkgs = import ../../Zpkgs/tv { inherit pkgs; }; diff --git a/3modules/tv/retiolum.nix b/3modules/tv/retiolum.nix index 8dc4197aa..ca1418c32 100644 --- a/3modules/tv/retiolum.nix +++ b/3modules/tv/retiolum.nix @@ -46,7 +46,6 @@ let description = '' The tinc network name. It is used to generate long host entries, - derive the name of the user account under which tincd runs, and name the TUN device. ''; }; @@ -106,20 +105,22 @@ let # and the private key. ExecStartPre = pkgs.writeScript "retiolum-init" '' #! /bin/sh - install -o ${user} -m 0400 ${cfg.privateKeyFile} /tmp/retiolum-rsa_key.priv + install -o ${user.name} -m 0400 ${cfg.privateKeyFile} /tmp/retiolum-rsa_key.priv ''; - ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user} -D"; + ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user.name} -D"; SyslogIdentifier = "retiolum"; }; }; - # TODO user.name = "retiolum" users.extraUsers = singleton { - name = user; - uid = 2961822815; # bin/genid retiolum-tinc + inherit (user) name uid; }; }; + user = { + name = "retiolum"; + uid = 301281149; # genid retiolum + }; tinc = cfg.tincPackage; hostsType = builtins.typeOf cfg.hosts; @@ -217,21 +218,5 @@ let chmod +x $out/tinc-up ''; - - - user = cfg.network + "-tinc"; - in out - - - -#let -# cfg = config.tv.retiolum; -# arg' = arg // { inherit cfg; }; -#in -# -#{ -# options.tv.retiolum = import ./options.nix arg'; -# config = lib.mkIf cfg.enable (import ./config.nix arg'); -#} diff --git a/3modules/tv/urlwatch.nix b/3modules/tv/urlwatch.nix index 05a0b0faf..a659fc74f 100644 --- a/3modules/tv/urlwatch.nix +++ b/3modules/tv/urlwatch.nix @@ -28,7 +28,7 @@ let }; from = mkOption { type = types.str; - default = "${cfg.user}@${config.networking.hostName}.retiolum"; + default = "${user.name}@${config.networking.hostName}.retiolum"; description = '' Content of the From: header of the generated mails. ''; @@ -54,11 +54,6 @@ let https://nixos.org/channels/nixos-unstable/git-revision ]; }; - user = mkOption { - type = types.str; - default = "urlwatch"; - description = "User under which urlwatch runs."; - }; }; urlsFile = toFile "urls" (concatStringsSep "\n" cfg.urls); @@ -84,7 +79,7 @@ let SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; }; serviceConfig = { - User = cfg.user; + User = user.name; PermissionsStartOnly = "true"; PrivateTmp = "true"; Type = "oneshot"; @@ -94,11 +89,10 @@ let set -euf dataDir=$HOME - user=${escapeShellArg cfg.user} if ! test -e "$dataDir"; then mkdir -m 0700 -p "$dataDir" - chown "$user": "$dataDir" + chown ${user.name}: "$dataDir" fi ''; ExecStart = pkgs.writeScript "urlwatch" '' @@ -108,7 +102,6 @@ let from=${escapeShellArg cfg.from} mailto=${escapeShellArg cfg.mailto} urlsFile=${escapeShellArg urlsFile} - user=${escapeShellArg cfg.user} cd /tmp @@ -130,11 +123,14 @@ let ''; }; }; - users.extraUsers = optionals (cfg.user == "urlwatch") (singleton { - name = "urlwatch"; - uid = 3450919516; # bin/genid urlwatch - }); + users.extraUsers = singleton { + inherit (user) name uid; + }; }; + user = { + name = "urlwatch"; + uid = 3467631196; # genid urlwatch + }; in out -- cgit v1.2.3 From 504b1b90e809934a01357450ccdf35c4e4afc74d Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 23 Jul 2015 00:37:21 +0200 Subject: * tv identity: define type harder --- 1systems/tv/cd.nix | 7 +-- 1systems/tv/mkdir.nix | 7 +-- 1systems/tv/nomic.nix | 7 +-- 1systems/tv/rmdir.nix | 7 +-- 1systems/tv/wu.nix | 7 +-- 2configs/tv/charybdis.nix | 16 +++---- 2configs/tv/identity.nix | 91 +++++++++++++++++++++++++++++++++++ 3modules/tv/consul.nix | 15 +++--- 3modules/tv/identity.nix | 119 +++++++++++++++++++++------------------------- 4lib/tv/default.nix | 64 +++++++++++++++++++++++-- 10 files changed, 230 insertions(+), 110 deletions(-) create mode 100644 2configs/tv/identity.nix diff --git a/1systems/tv/cd.nix b/1systems/tv/cd.nix index 42e4ecf1a..d3cae6f4a 100644 --- a/1systems/tv/cd.nix +++ b/1systems/tv/cd.nix @@ -35,11 +35,8 @@ in singleton config.tv.github-hosts-sync.port; } { - imports = [ ../../3modules/tv/identity.nix ]; - tv.identity = { - enable = true; - self = config.tv.identity.hosts.cd; - }; + imports = [ ../../2configs/tv/identity.nix ]; + tv.identity.self = config.tv.identity.hosts.cd; } { imports = [ ../../3modules/tv/iptables.nix ]; diff --git a/1systems/tv/mkdir.nix b/1systems/tv/mkdir.nix index e4e89872e..2e90c8acd 100644 --- a/1systems/tv/mkdir.nix +++ b/1systems/tv/mkdir.nix @@ -11,11 +11,8 @@ with lib; ../../2configs/tv/exim-smarthost.nix ../../2configs/tv/git-public.nix { - imports = [ ../../3modules/tv/identity.nix ]; - tv.identity = { - enable = true; - self = config.tv.identity.hosts.mkdir; - }; + imports = [ ../../2configs/tv/identity.nix ]; + tv.identity.self = config.tv.identity.hosts.mkdir; } { imports = [ ../../3modules/tv/iptables.nix ]; diff --git a/1systems/tv/nomic.nix b/1systems/tv/nomic.nix index b6235297f..6f984c44d 100644 --- a/1systems/tv/nomic.nix +++ b/1systems/tv/nomic.nix @@ -10,11 +10,8 @@ with lib; ../../2configs/tv/exim-retiolum.nix ../../2configs/tv/git-public.nix { - imports = [ ../../3modules/tv/identity.nix ]; - tv.identity = { - enable = true; - self = config.tv.identity.hosts.nomic; - }; + imports = [ ../../2configs/tv/identity.nix ]; + tv.identity.self = config.tv.identity.hosts.nomic; } { imports = [ ../../3modules/tv/iptables.nix ]; diff --git a/1systems/tv/rmdir.nix b/1systems/tv/rmdir.nix index 14817c9bc..b77a1c39e 100644 --- a/1systems/tv/rmdir.nix +++ b/1systems/tv/rmdir.nix @@ -11,11 +11,8 @@ with lib; ../../2configs/tv/exim-smarthost.nix ../../2configs/tv/git-public.nix { - imports = [ ../../3modules/tv/identity.nix ]; - tv.identity = { - enable = true; - self = config.tv.identity.hosts.rmdir; - }; + imports = [ ../../2configs/tv/identity.nix ]; + tv.identity.self = config.tv.identity.hosts.rmdir; } { imports = [ ../../3modules/tv/iptables.nix ]; diff --git a/1systems/tv/wu.nix b/1systems/tv/wu.nix index 866386698..400005cb7 100644 --- a/1systems/tv/wu.nix +++ b/1systems/tv/wu.nix @@ -18,11 +18,8 @@ in ../../2configs/tv/xserver.nix ../../2configs/tv/synaptics.nix # TODO w110er if xserver is enabled { - imports = [ ../../3modules/tv/identity.nix ]; - tv.identity = { - enable = true; - self = config.tv.identity.hosts.wu; - }; + imports = [ ../../2configs/tv/identity.nix ]; + tv.identity.self = config.tv.identity.hosts.wu; } { environment.systemPackages = with pkgs; [ diff --git a/2configs/tv/charybdis.nix b/2configs/tv/charybdis.nix index 014844e8b..a45c7aebe 100644 --- a/2configs/tv/charybdis.nix +++ b/2configs/tv/charybdis.nix @@ -123,7 +123,7 @@ let #loadmodule "extensions/ip_cloaking.so"; serverinfo { - name = ${toJSON config.tv.identity.self.fqdn}; + name = ${toJSON (head config.tv.identity.self.nets.retiolum.aliases)}; sid = "4z3"; description = "miep!"; network_name = "irc.retiolum"; @@ -133,9 +133,9 @@ let /* On multi-homed hosts you may need the following. These define * the addresses we connect from to other servers. */ /* for IPv4 */ - vhost = ${toJSON config.tv.identity.self.addr}; + vhost = ${concatMapStringsSep ", " toJSON config.tv.identity.self.nets.retiolum.addrs4}; /* for IPv6 */ - vhost6 = ${toJSON config.tv.identity.self.addr6}; + vhost6 = ${concatMapStringsSep ", " toJSON config.tv.identity.self.nets.retiolum.addrs6}; /* ssl_private_key: our ssl private key */ ssl_private_key = "/tmp/ssl.key"; @@ -238,12 +238,10 @@ let /* If you want to listen on a specific IP only, specify host. * host definitions apply only to the following port line. */ - host = ${toJSON config.tv.identity.self.addr}; - port = 6667; - sslport = 6697; - - /* Listen on IPv6 (if you used host= above). */ - host = ${toJSON config.tv.identity.self.addr6}; + # XXX This is stupid because only one host is allowed[?] + #host = ''${concatMapStringsSep ", " toJSON ( + # config.tv.identity.self.nets.retiolum.addrs + #)}; port = 6667; sslport = 6697; }; diff --git a/2configs/tv/identity.nix b/2configs/tv/identity.nix new file mode 100644 index 000000000..312c59d8d --- /dev/null +++ b/2configs/tv/identity.nix @@ -0,0 +1,91 @@ +{ config, ... }: + +{ + imports = [ ../../3modules/tv/identity.nix ]; + tv.identity = { + enable = true; + hosts = { + cd = { + cores = 2; + dc = "tv"; #dc = "cac"; + nets = { + internet = { + addrs4 = ["162.219.7.216"]; + aliases = [ + "cd.internet" + "cd.viljetic.de" + "cgit.cd.viljetic.de" + "cd.krebsco.de" + ]; + }; + retiolum = { + addrs4 = ["10.243.113.222"]; + addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af3"]; + aliases = [ + "cd.retiolum" + "cgit.cd.retiolum" + ]; + }; + }; + search = "retiolum"; + }; + mkdir = { + cores = 1; + dc = "tv"; #dc = "cac"; + nets = { + retiolum = { + addrs4 = ["10.243.113.223"]; + aliases = [ + "mkdir.retiolum" + "cgit.mkdir.retiolum" + ]; + }; + }; + search = "retiolum"; + }; + nomic = { + cores = 2; + dc = "tv"; #dc = "gg23"; + nets = { + retiolum = { + addrs4 = ["10.243.0.110"]; + aliases = [ + "nomic.retiolum" + "cgit.nomic.retiolum" + ]; + }; + }; + search = "retiolum"; + }; + rmdir = { + cores = 1; + dc = "tv"; #dc = "cac"; + nets = { + retiolum = { + addrs4 = ["10.243.113.224"]; + addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af5"]; + aliases = [ + "rmdir.retiolum" + "cgit.rmdir.retiolum" + ]; + }; + }; + search = "retiolum"; + }; + wu = { + cores = 4; + # TODO wu is mobile, so dc means "home data center" + dc = "tv"; #dc = "gg23"; + nets = { + retiolum = { + addrs4 = ["10.243.13.37"]; + aliases = [ + "wu.retiolum" + ]; + }; + }; + search = "retiolum"; + }; + }; + }; +} diff --git a/3modules/tv/consul.nix b/3modules/tv/consul.nix index db0cd7a9e..312faa02f 100644 --- a/3modules/tv/consul.nix +++ b/3modules/tv/consul.nix @@ -5,8 +5,7 @@ # TODO consul-bootstrap HOST that actually does is # TODO tools to inspect state of a cluster in outage state -with builtins; -with lib; +with import ../../4lib/tv { inherit lib pkgs; }; let cfg = config.tv.consul; @@ -24,10 +23,10 @@ let enable = mkEnableOption "tv.consul"; dc = mkOption { - type = types.unspecified; + type = types.label; }; hosts = mkOption { - type = with types; listOf unspecified; + type = with types; listOf host; }; encrypt-file = mkOption { type = types.str; # TODO path (but not just into store) @@ -38,7 +37,7 @@ let default = "/var/lib/consul"; }; self = mkOption { - type = types.unspecified; + type = types.host; }; server = mkOption { type = types.bool; @@ -56,9 +55,11 @@ let log_level = "INFO"; #node_name = server = cfg.server; - bind_addr = cfg.self.addr; # TODO cfg.addr enable_syslog = true; - retry_join = map (getAttr "addr") (filter (host: host.fqdn != cfg.self.fqdn) cfg.hosts); + retry_join = + # TODO allow consul in other nets than retiolum [maybe] + concatMap (host: host.nets.retiolum.addrs) + (filter (host: host.name != cfg.self.name) cfg.hosts); leave_on_terminate = true; } // optionalAttrs cfg.server { bootstrap_expect = length cfg.hosts; diff --git a/3modules/tv/identity.nix b/3modules/tv/identity.nix index d3ac91393..0b94dff85 100644 --- a/3modules/tv/identity.nix +++ b/3modules/tv/identity.nix @@ -1,6 +1,6 @@ -{ config, lib, ... }: +{ config, lib, pkgs, ... }: -with lib; +with import ../../4lib/tv { inherit lib pkgs; }; let cfg = config.tv.identity; @@ -13,77 +13,66 @@ let enable = mkEnableOption "tv.identity"; self = mkOption { - type = types.unspecified; + type = types.host; }; + + others = mkOption { + type = types.host; + default = filterAttrs (name: _host: name != cfg.self.name) cfg.hosts; + }; + hosts = mkOption { - type = with types; attrsOf unspecified; - default = { - cd = { - #dc = "cac"; - dc = "tv"; - fqdn = "cd.retiolum"; - subdomains = [ - "cgit" - ]; - addr = "10.243.113.222"; - addr6 = "42:4522:25f8:36bb:8ccb:0150:231a:2af3"; - #internet-addr = "162.219.5.183"; - cores = 2; - }; - mkdir = { - #dc = "cac"; - dc = "tv"; - fqdn = "mkdir.retiolum"; - subdomains = [ - "cgit" - ]; - addr = "10.243.113.223"; - cores = 1; - }; - nomic = { - #dc = "gg"; - dc = "tv"; - fqdn = "nomic.retiolum"; - subdomains = [ - "cgit" - ]; - addr = "10.243.0.110"; - cores = 2; - }; - rmdir = { - #dc = "cac"; - dc = "tv"; - fqdn = "rmdir.retiolum"; - subdomains = [ - "cgit" - ]; - addr = "10.243.113.224"; - #addr = "42:4522:25f8:36bb:8ccb:0150:231a:2af5"; - cores = 1; - }; - wu = { - #dc = "gg"; - dc = "tv"; - fqdn = "wu.retiolum"; - subdomains = [ - "cgit" - ]; - addr = "10.243.13.37"; - cores = 8; - }; - }; + type = with types; attrsOf host; + apply = mapAttrs (name: value: value // { inherit name; }); }; }; imp = { networking.extraHosts = - let - f = name: { addr, fqdn, subdomains, ... }: '' - ${addr} ${toString (map (s: "${s}.${name} ${s}.${fqdn}") subdomains)} - ''; - in - concatStringsSep "\n" (mapAttrsToList f cfg.hosts); + concatStringsSep "\n" (flatten ( + # TODO deepMap ["hosts" "nets"] (hostname: host: netname: net: + mapAttrsToList (hostname: host: + mapAttrsToList (netname: net: + let + aliases = toString (unique (longs ++ shorts)); + longs = (splitByProvider net.aliases).hosts; + shorts = map (removeSuffix ".${cfg.self.search}") longs; + in + map (addr: "${addr} ${aliases}") net.addrs + ) host.nets + ) cfg.hosts + )); + }; + + # TODO move domain name providers to a dedicated module + # providers : tree label providername + providers = { + internet = "hosts"; + retiolum = "hosts"; + de.viljetic = "regfish"; + de.krebsco = "ovh"; }; + # splitByProvider : [alias] -> set providername [alias] + splitByProvider = foldl (acc: alias: insert (providerOf alias) alias acc) {}; + + # providerOf : alias -> providername + providerOf = alias: + tree-get (splitString "." alias) providers; + + # insert : k -> v -> set k [v] -> set k [v] + insert = name: value: set: + set // { ${name} = set.${name} or [] ++ [value]; }; + + # tree k v = set k (either v (tree k v)) + + # tree-get : [k] -> tree k v -> v + tree-get = path: x: + let + y = x.${last path}; + in + if typeOf y != "set" + then y + else tree-get (init path) y; in out diff --git a/4lib/tv/default.nix b/4lib/tv/default.nix index 164a6a1aa..6985baa90 100644 --- a/4lib/tv/default.nix +++ b/4lib/tv/default.nix @@ -1,12 +1,10 @@ { lib, pkgs, ... }: with builtins; +with lib; -let - inherit (lib) mapAttrs stringAsChars; -in +builtins // lib // rec { -rec { git = import ./git.nix { lib = lib // { inherit addNames; @@ -59,4 +57,62 @@ rec { else if c == "\n" then "'\n'" else "\\${c}"); + types = lib.types // (with lib.types; rec { + + host = submodule { + options = { + name = mkOption { + type = label; + }; + dc = mkOption { + type = label; + }; + cores = mkOption { + type = positive; + }; + nets = mkOption { + type = attrsOf net; + apply = x: assert hasAttr "retiolum" x; x; + }; + search = mkOption { + type = hostname; + }; + }; + }; + + net = submodule ({ config, ... }: { + options = { + addrs = mkOption { + type = listOf addr; + apply = _: config.addrs4 ++ config.addrs6; + }; + addrs4 = mkOption { + type = listOf addr4; + default = []; + }; + addrs6 = mkOption { + type = listOf addr6; + default = []; + }; + aliases = mkOption { + # TODO nonEmptyListOf hostname + type = listOf hostname; + }; + }; + }); + + positive = mkOptionType { + name = "positive integer"; + check = x: isInt x && x > 0; + merge = mergeOneOption; + }; + + # TODO + addr = str; + addr4 = str; + addr6 = str; + hostname = str; + label = str; + }); + } -- cgit v1.2.3 From 8e41a4be471cd9bb74c8667140a70f8c05c363d4 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 23 Jul 2015 01:02:36 +0200 Subject: * tv identity: hosts.*.search -> search --- 2configs/tv/identity.nix | 6 +----- 3modules/tv/identity.nix | 14 +++++++++----- 4lib/tv/default.nix | 6 ------ 3 files changed, 10 insertions(+), 16 deletions(-) diff --git a/2configs/tv/identity.nix b/2configs/tv/identity.nix index 312c59d8d..36b387cdd 100644 --- a/2configs/tv/identity.nix +++ b/2configs/tv/identity.nix @@ -4,6 +4,7 @@ imports = [ ../../3modules/tv/identity.nix ]; tv.identity = { enable = true; + search = "retiolum"; hosts = { cd = { cores = 2; @@ -27,7 +28,6 @@ ]; }; }; - search = "retiolum"; }; mkdir = { cores = 1; @@ -41,7 +41,6 @@ ]; }; }; - search = "retiolum"; }; nomic = { cores = 2; @@ -55,7 +54,6 @@ ]; }; }; - search = "retiolum"; }; rmdir = { cores = 1; @@ -70,7 +68,6 @@ ]; }; }; - search = "retiolum"; }; wu = { cores = 4; @@ -84,7 +81,6 @@ ]; }; }; - search = "retiolum"; }; }; }; diff --git a/3modules/tv/identity.nix b/3modules/tv/identity.nix index 0b94dff85..584b27165 100644 --- a/3modules/tv/identity.nix +++ b/3modules/tv/identity.nix @@ -16,15 +16,19 @@ let type = types.host; }; - others = mkOption { - type = types.host; - default = filterAttrs (name: _host: name != cfg.self.name) cfg.hosts; - }; + #others = mkOption { + # type = types.host; + # default = filterAttrs (name: _host: name != cfg.self.name) cfg.hosts; + #}; hosts = mkOption { type = with types; attrsOf host; apply = mapAttrs (name: value: value // { inherit name; }); }; + + search = mkOption { + type = types.hostname; + }; }; imp = { @@ -36,7 +40,7 @@ let let aliases = toString (unique (longs ++ shorts)); longs = (splitByProvider net.aliases).hosts; - shorts = map (removeSuffix ".${cfg.self.search}") longs; + shorts = map (removeSuffix ".${cfg.search}") longs; in map (addr: "${addr} ${aliases}") net.addrs ) host.nets diff --git a/4lib/tv/default.nix b/4lib/tv/default.nix index 6985baa90..c134745d6 100644 --- a/4lib/tv/default.nix +++ b/4lib/tv/default.nix @@ -39,9 +39,6 @@ builtins // lib // rec { in xsn >= sn && substring (xsn - sn) sn xs == s ; - removeSuffix = - s : xs : substring 0 (stringLength xs - stringLength s) xs; - # setMap :: (String -> a -> b) -> Set String a -> [b] #setMap = f: xs: map (k : f k (getAttr k xs)) (attrNames xs); @@ -74,9 +71,6 @@ builtins // lib // rec { type = attrsOf net; apply = x: assert hasAttr "retiolum" x; x; }; - search = mkOption { - type = hostname; - }; }; }; -- cgit v1.2.3 From cd0a4d3bad0c7975df8dea5fd66614dda9fcfa32 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 23 Jul 2015 01:04:51 +0200 Subject: make eval --- Makefile | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/Makefile b/Makefile index 7225a5d6b..da234677b 100644 --- a/Makefile +++ b/Makefile @@ -2,6 +2,7 @@ # usage: # make system=foo # make systems='foo bar' +# make eval system=foo get=config.networking.extraHosts # .ONESHELL: @@ -82,6 +83,20 @@ deploy:;@ result/bin/switch-to-configuration switch EOF + +.PHONY: eval +eval: + @nix-instantiate \ + --json \ + --eval \ + --strict \ + -A "$$get" \ + -E ' + import { + system = builtins.currentSystem; + modules = [ ./1systems/$(LOGNAME)/$(system).nix ]; + } + ' | jq -r . else $(error unbound variable: system[s]) endif -- cgit v1.2.3 From d97be4322371f06b423e308b606824c02f1a67af Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 23 Jul 2015 01:25:26 +0200 Subject: * tv identity: add tinc public keys --- 2configs/tv/identity.nix | 58 ++++++++++++++++++++++++++++++++++++++++++++++++ 4lib/tv/default.nix | 3 +++ 2 files changed, 61 insertions(+) diff --git a/2configs/tv/identity.nix b/2configs/tv/identity.nix index 36b387cdd..1a02876f8 100644 --- a/2configs/tv/identity.nix +++ b/2configs/tv/identity.nix @@ -26,6 +26,21 @@ "cd.retiolum" "cgit.cd.retiolum" ]; + tinc-key = '' + -----BEGIN RSA PUBLIC KEY----- + MIICCgKCAgEAvmCBVNKT/Su4v9nl/Nm3STPo5QxWPg7xEkzIs3Oh39BS8+r6/7UQ + rebib7mczb+ebZd+Rg2yFoGrWO8cmM0VcLy5bYRMK7in8XroLEjWecNNM4TRfNR4 + e53+LhcPdkxo0A3/D+yiut+A2Mkqe+4VXDm/JhAiAYkZTn7jUtj00Atrc7CWW1gN + sP3jIgv4+CGftdSYOB4dm699B7OD9XDLci2kOaFqFl4cjDYUok03G0AduUlRx10v + CKbKOTIdm8C36A902/3ms+Hyzkruu+VagGIZuPSwqXHJPCu7Ju+jarKQstMmpQi0 + PubweWDL0o/Dfz2qT3DuL4xDecIvGE6kv3m41hHJYiK+2/azTSehyPFbsVbL7w0V + LgKN3usnZNcpTsBWxRGT7nMFSnX2FLDu7d9OfCuaXYxHVFLZaNrpccOq8NF/7Hbk + DDW81W7CvLyJDlp0WLnAawSOGTUTPoYv/2wAapJ89i8QGCueGvEc6o2EcnBVMFEW + ejWTQzyD816f4RsplnrRqLVlIMbr9Q/n5TvlgjjhX7IMEfMy4+7qLGRQkNbFzgwK + jxNG2fFSCjOEQitm0gAtx7QRIyvYr6c7/xiHz4AwxYzBmvQsL/OK57NO4+Krwgj5 + Vk8TQ2jGO7J4bB38zaxK+Lrtfl8i1AK1171JqFMhOc34JSJ7T4LWDMECAwEAAQ== + -----END RSA PUBLIC KEY----- + ''; }; }; }; @@ -35,10 +50,21 @@ nets = { retiolum = { addrs4 = ["10.243.113.223"]; + addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af4"]; aliases = [ "mkdir.retiolum" "cgit.mkdir.retiolum" ]; + tinc-key = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAuyfM+3od75zOYXqnqRMAt+yp/4z/vC3vSWdjUvEmCuM23c5BOBw+ + dKqbWoSPTzOuaQ0szdL7a6YxT+poSUXd/i3pPz59KgCl192rd1pZoJKgvoluITev + voYSP9rFQOUrustfDb9qKW/ZY95cwdCvypo7Vf4ghxwDCnlmyCGz7qXTJMLydNKF + 2PH9KiY4suv15sCg/zisu+q0ZYQXUc1TcgpoIYBOftDunOJoNdbti+XjwWdjGmJZ + Bn4GelsrrpwJFvfDmouHUe8GsD7nTgbZFtiJbKfCEiK16N0Q0d0ZFHhAV2nPjsk2 + 3JhG4n9vxATBkO82f7RLrcrhkx9cbLfN3wIDAQAB + -----END RSA PUBLIC KEY----- + ''; }; }; }; @@ -48,10 +74,21 @@ nets = { retiolum = { addrs4 = ["10.243.0.110"]; + addrs6 = ["42:02d5:733f:d6da:c0f5:2bb7:2b18:09ec"]; aliases = [ "nomic.retiolum" "cgit.nomic.retiolum" ]; + tinc-key = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAwb8Yk/YRc17g2J9n960p6j4W/l559OPyuMPdGJ4DmCm3WNQtxoa+ + qTFUiDiI85BcmfqnSeddLG8zTC2XnSlIvCRMJ9oKzppFM4PX4OTAaJZVE5WyCQhw + Kd4tHVdoQgJW5yFepmT9IUmHqkxXJ0R2W93l2eSZNOcnFvFn0ooiAlRi4zAiHClu + 5Mz80Sc2rvez+n9wtC2D06aYjP23pHYld2xighHR9SUqX1dFzgSXNSoWWCcgNp2a + OKcM8LzxLV7MTMZFOJCJndZ77e4LsUvxhQFP6nyKZWg30PC0zufZsuN5o2xsWSlA + Wi9sMB1AUR6mZrxgcgTFpUjbjbLQf+36CwIDAQAB + -----END RSA PUBLIC KEY----- + ''; }; }; }; @@ -66,6 +103,16 @@ "rmdir.retiolum" "cgit.rmdir.retiolum" ]; + tinc-key = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEA+twy4obSbJdmZLfBoe9YYeyoDnXkO/WPa2D6Eh6jXrWk5fbhBjRf + i3EAQfLiXXFJX3E8V8YvJyazXklI19jJtCLDiu/F5kgJJfyAkWHH+a/hcg7qllDM + Xx2CvS/nCbs+p48/VLO6zLC7b1oHu3K/ob5M5bwPK6j9NEDIL5qYiM5PQzV6zryz + hS9E/+l8Z+UUpYcfS3bRovXJAerB4txc/gD3Xmptq1zk53yn1kJFYfVlwyyz+NEF + 59JZj2PDrvWoG0kx/QjiNurs6XfdnyHe/gP3rmSTrihKFVuA3cZM62sDR4FcaeWH + SnKSp02pqjBOjC/dOK97nXpKLJgNH046owIDAQAB + -----END RSA PUBLIC KEY----- + ''; }; }; }; @@ -76,9 +123,20 @@ nets = { retiolum = { addrs4 = ["10.243.13.37"]; + addrs6 = ["42:0:0:0:0:0:0:1337"]; aliases = [ "wu.retiolum" ]; + tinc-key = '' + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEArDvU0cuBsVqTjCX2TlWL4XHSy4qSjUhjrDvUPZSKTVN7x6OENCUn + M27g9H7j4/Jw/8IHoJLiKnXHavOoc9UJM+P9Fla/4TTVADr69UDSnLgH+wGiHcEg + GxPkb2jt0Z8zcpD6Fusj1ATs3sssaLHTHvg1D0LylEWA3cI4WPP13v23PkyUENQT + KpSWfR+obqDl38Q7LuFi6dH9ruyvqK+4syddrBwjPXrcNxcGL9QbDn7+foRNiWw4 + 4CE5z25oGG2iWMShI7fe3ji/fMUAl7DSOOrHVVG9eMtpzy+uI8veOHrdTax4oKik + AFGCrMIov3F0GIeu3nDlrTIZPZDTodbFKQIDAQAB + -----END RSA PUBLIC KEY----- + ''; }; }; }; diff --git a/4lib/tv/default.nix b/4lib/tv/default.nix index c134745d6..ec46d8ea8 100644 --- a/4lib/tv/default.nix +++ b/4lib/tv/default.nix @@ -92,6 +92,9 @@ builtins // lib // rec { # TODO nonEmptyListOf hostname type = listOf hostname; }; + tinc-key = mkOption { + type = str; + }; }; }); -- cgit v1.2.3 From 7a40f89e01593adff35f943aa86492ac4281d4e8 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 23 Jul 2015 01:56:46 +0200 Subject: 4 tv: generate tinc config --- 1systems/tv/mkdir.nix | 2 +- 2configs/tv/identity.nix | 27 ++++++++++++++++++--------- 4lib/tv/default.nix | 23 +++++++++++++++++++++-- 3 files changed, 40 insertions(+), 12 deletions(-) diff --git a/1systems/tv/mkdir.nix b/1systems/tv/mkdir.nix index 2e90c8acd..e0e057d63 100644 --- a/1systems/tv/mkdir.nix +++ b/1systems/tv/mkdir.nix @@ -46,7 +46,7 @@ with lib; networking.hostName = "mkdir"; networking.interfaces.enp2s1.ip4 = [ { - address = "162.248.167.241"; + address = "162.248.167.241"; # TODO prefixLength = 24; } ]; diff --git a/2configs/tv/identity.nix b/2configs/tv/identity.nix index 1a02876f8..de99f507f 100644 --- a/2configs/tv/identity.nix +++ b/2configs/tv/identity.nix @@ -9,7 +9,7 @@ cd = { cores = 2; dc = "tv"; #dc = "cac"; - nets = { + nets = rec { internet = { addrs4 = ["162.219.7.216"]; aliases = [ @@ -20,13 +20,14 @@ ]; }; retiolum = { + via = internet; addrs4 = ["10.243.113.222"]; addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af3"]; aliases = [ "cd.retiolum" "cgit.cd.retiolum" ]; - tinc-key = '' + tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- MIICCgKCAgEAvmCBVNKT/Su4v9nl/Nm3STPo5QxWPg7xEkzIs3Oh39BS8+r6/7UQ rebib7mczb+ebZd+Rg2yFoGrWO8cmM0VcLy5bYRMK7in8XroLEjWecNNM4TRfNR4 @@ -47,15 +48,19 @@ mkdir = { cores = 1; dc = "tv"; #dc = "cac"; - nets = { + nets = rec { + internet = { + addrs4 = ["162.248.167.241"]; + }; retiolum = { + via = internet; addrs4 = ["10.243.113.223"]; addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af4"]; aliases = [ "mkdir.retiolum" "cgit.mkdir.retiolum" ]; - tinc-key = '' + tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- MIIBCgKCAQEAuyfM+3od75zOYXqnqRMAt+yp/4z/vC3vSWdjUvEmCuM23c5BOBw+ dKqbWoSPTzOuaQ0szdL7a6YxT+poSUXd/i3pPz59KgCl192rd1pZoJKgvoluITev @@ -71,7 +76,7 @@ nomic = { cores = 2; dc = "tv"; #dc = "gg23"; - nets = { + nets = rec { retiolum = { addrs4 = ["10.243.0.110"]; addrs6 = ["42:02d5:733f:d6da:c0f5:2bb7:2b18:09ec"]; @@ -79,7 +84,7 @@ "nomic.retiolum" "cgit.nomic.retiolum" ]; - tinc-key = '' + tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- MIIBCgKCAQEAwb8Yk/YRc17g2J9n960p6j4W/l559OPyuMPdGJ4DmCm3WNQtxoa+ qTFUiDiI85BcmfqnSeddLG8zTC2XnSlIvCRMJ9oKzppFM4PX4OTAaJZVE5WyCQhw @@ -95,15 +100,19 @@ rmdir = { cores = 1; dc = "tv"; #dc = "cac"; - nets = { + nets = rec { + internet = { + addrs4 = ["167.88.44.94"]; + }; retiolum = { + via = internet; addrs4 = ["10.243.113.224"]; addrs6 = ["42:4522:25f8:36bb:8ccb:0150:231a:2af5"]; aliases = [ "rmdir.retiolum" "cgit.rmdir.retiolum" ]; - tinc-key = '' + tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- MIIBCgKCAQEA+twy4obSbJdmZLfBoe9YYeyoDnXkO/WPa2D6Eh6jXrWk5fbhBjRf i3EAQfLiXXFJX3E8V8YvJyazXklI19jJtCLDiu/F5kgJJfyAkWHH+a/hcg7qllDM @@ -127,7 +136,7 @@ aliases = [ "wu.retiolum" ]; - tinc-key = '' + tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- MIIBCgKCAQEArDvU0cuBsVqTjCX2TlWL4XHSy4qSjUhjrDvUPZSKTVN7x6OENCUn M27g9H7j4/Jw/8IHoJLiKnXHavOoc9UJM+P9Fla/4TTVADr69UDSnLgH+wGiHcEg diff --git a/4lib/tv/default.nix b/4lib/tv/default.nix index ec46d8ea8..5eb9ac45f 100644 --- a/4lib/tv/default.nix +++ b/4lib/tv/default.nix @@ -76,6 +76,10 @@ builtins // lib // rec { net = submodule ({ config, ... }: { options = { + via = mkOption { + type = nullOr net; + default = null; + }; addrs = mkOption { type = listOf addr; apply = _: config.addrs4 ++ config.addrs6; @@ -92,8 +96,23 @@ builtins // lib // rec { # TODO nonEmptyListOf hostname type = listOf hostname; }; - tinc-key = mkOption { - type = str; + tinc = mkOption { + type = submodule { + options = { + config = mkOption { + type = str; + apply = _: '' + ${optionalString (config.via != null) + (concatMapStringsSep "\n" (a: "Address = ${a}") config.via.addrs)} + ${concatMapStringsSep "\n" (a: "Subnet = ${a}") config.addrs} + ${config.tinc.pubkey} + ''; + }; + pubkey = mkOption { + type = str; + }; + }; + }; }; }; }); -- cgit v1.2.3 From 791a7e79977de76908ab9e33eb64cbd2b02da3ed Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 23 Jul 2015 02:00:23 +0200 Subject: 4 tv: tinc.config can access tinc.pubkey --- 4lib/tv/default.nix | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/4lib/tv/default.nix b/4lib/tv/default.nix index 5eb9ac45f..092a9626c 100644 --- a/4lib/tv/default.nix +++ b/4lib/tv/default.nix @@ -97,22 +97,22 @@ builtins // lib // rec { type = listOf hostname; }; tinc = mkOption { - type = submodule { + type = let net-config = config; in submodule ({ config, ... }: { options = { config = mkOption { type = str; apply = _: '' - ${optionalString (config.via != null) - (concatMapStringsSep "\n" (a: "Address = ${a}") config.via.addrs)} - ${concatMapStringsSep "\n" (a: "Subnet = ${a}") config.addrs} - ${config.tinc.pubkey} + ${optionalString (net-config.via != null) + (concatMapStringsSep "\n" (a: "Address = ${a}") net-config.via.addrs)} + ${concatMapStringsSep "\n" (a: "Subnet = ${a}") net-config.addrs} + ${config.pubkey} ''; }; pubkey = mkOption { type = str; }; }; - }; + }); }; }; }); -- cgit v1.2.3