From b54f00c6954a0b44abb52289332c748f95d796d3 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:29:49 +0100
Subject: tv modules: add per-user

---
 tv/3modules/default.nix  |  1 +
 tv/3modules/per-user.nix | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 tv/3modules/per-user.nix

diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
index bb10d8261..3a75d6e43 100644
--- a/tv/3modules/default.nix
+++ b/tv/3modules/default.nix
@@ -5,5 +5,6 @@ _:
     ./consul.nix
     ./ejabberd.nix
     ./iptables.nix
+    ./per-user.nix
   ];
 }
diff --git a/tv/3modules/per-user.nix b/tv/3modules/per-user.nix
new file mode 100644
index 000000000..8d21a01d9
--- /dev/null
+++ b/tv/3modules/per-user.nix
@@ -0,0 +1,35 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.tv.per-user;
+
+  out = {
+    options.tv.per-user = api;
+    config = imp;
+  };
+
+  api = mkOption {
+    type = with types; attrsOf (submodule {
+      options = {
+        packages = mkOption {
+          type = listOf path;
+          default = [];
+        };
+      };
+    });
+    default = {};
+  };
+
+  imp = {
+    environment = {
+      etc = flip mapAttrs' cfg (name: { packages, ... }: {
+        name = "per-user/${name}";
+        value.source = pkgs.symlinkJoin "per-user.${name}" packages;
+      });
+      profiles = ["/etc/per-user/$LOGNAME"];
+    };
+  };
+
+in out
-- 
cgit v1.2.3


From a0c068d6ec5d1cc6b1c58fe9af379b638a346220 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:37:58 +0100
Subject: {tv => krebs} per-user

---
 krebs/3modules/default.nix  |  1 +
 krebs/3modules/per-user.nix | 35 +++++++++++++++++++++++++++++++++++
 tv/3modules/default.nix     |  1 -
 tv/3modules/per-user.nix    | 35 -----------------------------------
 4 files changed, 36 insertions(+), 36 deletions(-)
 create mode 100644 krebs/3modules/per-user.nix
 delete mode 100644 tv/3modules/per-user.nix

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 2b5fc478c..438836f52 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -15,6 +15,7 @@ let
       ./git.nix
       ./iptables.nix
       ./nginx.nix
+      ./per-user.nix
       ./Reaktor.nix
       ./retiolum-bootstrap.nix
       ./realwallpaper.nix
diff --git a/krebs/3modules/per-user.nix b/krebs/3modules/per-user.nix
new file mode 100644
index 000000000..ee213deda
--- /dev/null
+++ b/krebs/3modules/per-user.nix
@@ -0,0 +1,35 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.krebs.per-user;
+
+  out = {
+    options.krebs.per-user = api;
+    config = imp;
+  };
+
+  api = mkOption {
+    type = with types; attrsOf (submodule {
+      options = {
+        packages = mkOption {
+          type = listOf path;
+          default = [];
+        };
+      };
+    });
+    default = {};
+  };
+
+  imp = {
+    environment = {
+      etc = flip mapAttrs' cfg (name: { packages, ... }: {
+        name = "per-user/${name}";
+        value.source = pkgs.symlinkJoin "per-user.${name}" packages;
+      });
+      profiles = ["/etc/per-user/$LOGNAME"];
+    };
+  };
+
+in out
diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
index 3a75d6e43..bb10d8261 100644
--- a/tv/3modules/default.nix
+++ b/tv/3modules/default.nix
@@ -5,6 +5,5 @@ _:
     ./consul.nix
     ./ejabberd.nix
     ./iptables.nix
-    ./per-user.nix
   ];
 }
diff --git a/tv/3modules/per-user.nix b/tv/3modules/per-user.nix
deleted file mode 100644
index 8d21a01d9..000000000
--- a/tv/3modules/per-user.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.tv.per-user;
-
-  out = {
-    options.tv.per-user = api;
-    config = imp;
-  };
-
-  api = mkOption {
-    type = with types; attrsOf (submodule {
-      options = {
-        packages = mkOption {
-          type = listOf path;
-          default = [];
-        };
-      };
-    });
-    default = {};
-  };
-
-  imp = {
-    environment = {
-      etc = flip mapAttrs' cfg (name: { packages, ... }: {
-        name = "per-user/${name}";
-        value.source = pkgs.symlinkJoin "per-user.${name}" packages;
-      });
-      profiles = ["/etc/per-user/$LOGNAME"];
-    };
-  };
-
-in out
-- 
cgit v1.2.3


From bad79f7f1270c01343b3c308f5a2cf390dac014c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:53:21 +0100
Subject: tv: init user z

---
 tv/1systems/wu.nix              | 11 +----------
 tv/1systems/xu.nix              | 11 +----------
 tv/2configs/base.nix            |  3 +++
 tv/2configs/xserver/default.nix |  8 --------
 tv/2configs/z.nix               | 40 ++++++++++++++++++++++++++++++++++++++++
 5 files changed, 45 insertions(+), 28 deletions(-)
 create mode 100644 tv/2configs/z.nix

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index b12e7df93..fe6a5f303 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -32,6 +32,7 @@ with lib;
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/xserver
+    ../2configs/z.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -287,16 +288,6 @@ with lib;
           onion = {
             uid = 6660010;
           };
-
-          zalora = {
-            uid = 1000301;
-            extraGroups = [
-              "audio"
-              # TODO remove vboxusers when hardening is active
-              "vboxusers"
-              "video"
-            ];
-          };
         };
 
       security.sudo.extraConfig =
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index e2cc2c06a..eb8c7c784 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -30,6 +30,7 @@ with lib;
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/xserver
+    ../2configs/z.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -286,16 +287,6 @@ with lib;
           onion = {
             uid = 6660010;
           };
-
-          zalora = {
-            uid = 1000301;
-            extraGroups = [
-              "audio"
-              # TODO remove vboxusers when hardening is active
-              "vboxusers"
-              "video"
-            ];
-          };
         };
 
       security.sudo.extraConfig =
diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
index a74ce3297..4beece5ef 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/base.nix
@@ -22,6 +22,9 @@ with lib;
         mapAttrs (_: h: { hashedPassword = h; })
                  (import <secrets/hashedPasswords.nix>);
     }
+    {
+      users.groups.subusers.gid = 1093178926; # genid subusers
+    }
     {
       users.defaultUserShell = "/run/current-system/sw/bin/bash";
       users.mutableUsers = false;
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 4d2fe9e45..df00203be 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -70,14 +70,6 @@ let
         ExecStart = "${xserver}/bin/xserver";
       };
     };
-
-    programs.bash.interactiveShellInit = ''
-      case ''${XMONAD_SPAWN_WORKSPACE-} in
-        za|zh|zj|zs)
-          exec sudo -u zalora -i
-        ;;
-      esac
-    '';
   };
 
   xmonad-environment = {
diff --git a/tv/2configs/z.nix b/tv/2configs/z.nix
new file mode 100644
index 000000000..e5494ecc9
--- /dev/null
+++ b/tv/2configs/z.nix
@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  krebs.per-user.z.packages = [
+    (pkgs.writeScriptBin "cr" ''
+      #! /bin/sh
+      set -efu
+      export LC_TIME=de_DE.utf8
+      exec ${pkgs.chromium}/bin/chromium \
+          --ssl-version-min=tls1 \
+          --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
+          --disk-cache-size=50000000 \
+          "%@"
+    '')
+  ];
+
+  programs.bash.interactiveShellInit = ''
+    case ''${XMONAD_SPAWN_WORKSPACE-} in
+      za|zh|zj|zs)
+        exec sudo -u z -i
+      ;;
+    esac
+  '';
+
+  security.sudo.extraConfig = "tv ALL=(z) NOPASSWD: ALL";
+
+  users.users.z = {
+    extraGroups = [
+      "audio"
+      "vboxusers"
+      "video"
+    ];
+    group = "subusers";
+    home = "/home/z";
+    uid = 3043726074; # genid z
+    useDefaultShell = true;
+  };
+}
-- 
cgit v1.2.3


From 3c75c59794d6b67c34d9a8857ca3fb64c649507c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:54:53 +0100
Subject: tv: set environment.profileRelativeEnvVars.PATH

---
 tv/2configs/base.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
index 4beece5ef..38cc1eefe 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/base.nix
@@ -72,6 +72,8 @@ with lib;
       nix.useChroot = true;
     }
     {
+      environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
+
       environment.systemPackages = with pkgs; [
         rxvt_unicode.terminfo
       ];
-- 
cgit v1.2.3


From 28fad6e2fc3aa45a9d1b5fad8810bbc7c78a5dc6 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:55:08 +0100
Subject: tv base: drop redundant with builtins

---
 tv/2configs/base.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
index 38cc1eefe..b74b721cb 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/base.nix
@@ -1,6 +1,5 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
 with lib;
 
 {
-- 
cgit v1.2.3


From 0bf6e55f77cffb4ca65c6926eea7bc77140574a5 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 21:55:38 +0100
Subject: tv base: tv@xu can root

---
 tv/2configs/base.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
index b74b721cb..d3f4eed0d 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/base.nix
@@ -33,6 +33,7 @@ with lib;
         root = {
           openssh.authorizedKeys.keys = [
             config.krebs.users.tv.pubkey
+            config.krebs.users.tv_xu.pubkey
           ];
         };
         tv = {
-- 
cgit v1.2.3


From f559b19bec61730c537cdd76233304e66c3f497a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 22:05:36 +0100
Subject: stockholm: import default user config

---
 default.nix             |   5 +-
 tv/1systems/cd.nix      |   1 -
 tv/1systems/mkdir.nix   |   1 -
 tv/1systems/nomic.nix   |   1 -
 tv/1systems/rmdir.nix   |   1 -
 tv/1systems/wu.nix      |   1 -
 tv/1systems/xu.nix      |   1 -
 tv/2configs/base.nix    | 168 ------------------------------------------------
 tv/2configs/default.nix | 168 ++++++++++++++++++++++++++++++++++++++++++++++++
 9 files changed, 172 insertions(+), 175 deletions(-)
 delete mode 100644 tv/2configs/base.nix
 create mode 100644 tv/2configs/default.nix

diff --git a/default.nix b/default.nix
index 472d7597d..ac748c286 100644
--- a/default.nix
+++ b/default.nix
@@ -32,7 +32,10 @@ let stockholm = {
   upath = lib.nspath current-user-name;
 
   base-module = { config, ... }: {
-    imports = map (f: f "3modules") [ kpath upath ];
+    imports = builtins.filter builtins.pathExists (lib.concatLists [
+      (map (f: f "2configs") [ upath ])
+      (map (f: f "3modules") [ kpath upath ])
+    ]);
 
     krebs.current.enable = true;
     krebs.current.host = config.krebs.hosts.${current-host-name};
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 1122e6a19..3f496fefb 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -26,7 +26,6 @@ with lib;
   imports = [
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/base.nix
     #../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index e8e354197..64896daf4 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -39,7 +39,6 @@ in
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/base.nix
     ../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index df45b8177..495c765f3 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -25,7 +25,6 @@ with lib;
 
   imports = [
     ../2configs/hw/AO753.nix
-    ../2configs/base.nix
     #../2configs/consul-server.nix
     ../2configs/git.nix
     {
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index e24ef64fc..62340b88c 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -39,7 +39,6 @@ in
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/base.nix
     ../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index fe6a5f303..8f714ec6b 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -27,7 +27,6 @@ with lib;
 
   imports = [
     ../2configs/hw/w110er.nix
-    ../2configs/base.nix
     #../2configs/consul-client.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index eb8c7c784..6f673ce9c 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -25,7 +25,6 @@ with lib;
 
   imports = [
     ../2configs/hw/x220.nix
-    ../2configs/base.nix
     #../2configs/consul-client.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
diff --git a/tv/2configs/base.nix b/tv/2configs/base.nix
deleted file mode 100644
index d3f4eed0d..000000000
--- a/tv/2configs/base.nix
+++ /dev/null
@@ -1,168 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-{
-  krebs.enable = true;
-
-  networking.hostName = config.krebs.build.host.name;
-
-  imports = [
-    ./vim.nix
-    {
-      # stockholm dependencies
-      environment.systemPackages = with pkgs; [
-        git
-      ];
-    }
-    {
-      # TODO never put hashedPassword into the store
-      users.extraUsers =
-        mapAttrs (_: h: { hashedPassword = h; })
-                 (import <secrets/hashedPasswords.nix>);
-    }
-    {
-      users.groups.subusers.gid = 1093178926; # genid subusers
-    }
-    {
-      users.defaultUserShell = "/run/current-system/sw/bin/bash";
-      users.mutableUsers = false;
-    }
-    {
-      users.extraUsers = {
-        root = {
-          openssh.authorizedKeys.keys = [
-            config.krebs.users.tv.pubkey
-            config.krebs.users.tv_xu.pubkey
-          ];
-        };
-        tv = {
-          uid = 1337;
-          group = "users";
-          home = "/home/tv";
-          createHome = true;
-          useDefaultShell = true;
-          extraGroups = [
-            "audio"
-            "video"
-            "wheel"
-          ];
-          openssh.authorizedKeys.keys = [
-            config.krebs.users.tv.pubkey
-          ];
-        };
-      };
-    }
-    {
-      security.sudo.extraConfig = ''
-        Defaults mailto="${config.krebs.users.tv.mail}"
-      '';
-      time.timeZone = "Europe/Berlin";
-    }
-    {
-      # TODO check if both are required:
-      nix.chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ];
-
-      nix.trustedBinaryCaches = [
-        "https://cache.nixos.org"
-        "http://cache.nixos.org"
-        "http://hydra.nixos.org"
-      ];
-
-      nix.useChroot = true;
-    }
-    {
-      environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
-
-      environment.systemPackages = with pkgs; [
-        rxvt_unicode.terminfo
-      ];
-
-      environment.shellAliases = mkForce {
-        # alias cal='cal -m3'
-        gp = "${pkgs.pari}/bin/gp -q";
-        df = "df -h";
-        du = "du -h";
-        # alias grep='grep --color=auto'
-
-        # TODO alias cannot contain #\'
-        # "ps?" = "ps ax | head -n 1;ps ax | fgrep -v ' grep --color=auto ' | grep";
-
-        # alias la='ls -lA'
-        lAtr = "ls -lAtr";
-        # alias ll='ls -l'
-        ls = "ls -h --color=auto --group-directories-first";
-        dmesg = "dmesg -L --reltime";
-        view = "vim -R";
-      };
-
-      programs.bash = {
-        interactiveShellInit = ''
-          HISTCONTROL='erasedups:ignorespace'
-          HISTSIZE=65536
-          HISTFILESIZE=$HISTSIZE
-
-          shopt -s checkhash
-          shopt -s histappend histreedit histverify
-          shopt -s no_empty_cmd_completion
-          complete -d cd
-
-          ${readFile ./bash_completion.sh}
-
-          # TODO source bridge
-        '';
-        promptInit = ''
-          case $UID in
-            0)
-              PS1='\[\e[1;31m\]\w\[\e[0m\] '
-              ;;
-            1337)
-              PS1='\[\e[1;32m\]\w\[\e[0m\] '
-              ;;
-            *)
-              PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] '
-              ;;
-          esac
-          if test -n "$SSH_CLIENT"; then
-            PS1='\[\e[35m\]\h'" $PS1"
-          fi
-          if test -n "$SSH_AGENT_PID"; then
-            PS1="ssh-agent[$SSH_AGENT_PID] $PS1"
-          fi
-        '';
-      };
-
-      programs.ssh.startAgent = false;
-    }
-
-    {
-      services.cron.enable = false;
-      services.nscd.enable = false;
-      services.ntp.enable = false;
-    }
-
-    {
-      boot.kernel.sysctl = {
-        # Enable IPv6 Privacy Extensions
-        "net.ipv6.conf.all.use_tempaddr" = 2;
-        "net.ipv6.conf.default.use_tempaddr" = 2;
-      };
-    }
-
-    {
-      services.openssh = {
-        enable = true;
-        hostKeys = [
-          { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
-        ];
-      };
-    }
-
-    {
-      # TODO: exim
-      security.setuidPrograms = [
-        "sendmail"  # for sudo
-      ];
-    }
-  ];
-}
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
new file mode 100644
index 000000000..d3f4eed0d
--- /dev/null
+++ b/tv/2configs/default.nix
@@ -0,0 +1,168 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  krebs.enable = true;
+
+  networking.hostName = config.krebs.build.host.name;
+
+  imports = [
+    ./vim.nix
+    {
+      # stockholm dependencies
+      environment.systemPackages = with pkgs; [
+        git
+      ];
+    }
+    {
+      # TODO never put hashedPassword into the store
+      users.extraUsers =
+        mapAttrs (_: h: { hashedPassword = h; })
+                 (import <secrets/hashedPasswords.nix>);
+    }
+    {
+      users.groups.subusers.gid = 1093178926; # genid subusers
+    }
+    {
+      users.defaultUserShell = "/run/current-system/sw/bin/bash";
+      users.mutableUsers = false;
+    }
+    {
+      users.extraUsers = {
+        root = {
+          openssh.authorizedKeys.keys = [
+            config.krebs.users.tv.pubkey
+            config.krebs.users.tv_xu.pubkey
+          ];
+        };
+        tv = {
+          uid = 1337;
+          group = "users";
+          home = "/home/tv";
+          createHome = true;
+          useDefaultShell = true;
+          extraGroups = [
+            "audio"
+            "video"
+            "wheel"
+          ];
+          openssh.authorizedKeys.keys = [
+            config.krebs.users.tv.pubkey
+          ];
+        };
+      };
+    }
+    {
+      security.sudo.extraConfig = ''
+        Defaults mailto="${config.krebs.users.tv.mail}"
+      '';
+      time.timeZone = "Europe/Berlin";
+    }
+    {
+      # TODO check if both are required:
+      nix.chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ];
+
+      nix.trustedBinaryCaches = [
+        "https://cache.nixos.org"
+        "http://cache.nixos.org"
+        "http://hydra.nixos.org"
+      ];
+
+      nix.useChroot = true;
+    }
+    {
+      environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
+
+      environment.systemPackages = with pkgs; [
+        rxvt_unicode.terminfo
+      ];
+
+      environment.shellAliases = mkForce {
+        # alias cal='cal -m3'
+        gp = "${pkgs.pari}/bin/gp -q";
+        df = "df -h";
+        du = "du -h";
+        # alias grep='grep --color=auto'
+
+        # TODO alias cannot contain #\'
+        # "ps?" = "ps ax | head -n 1;ps ax | fgrep -v ' grep --color=auto ' | grep";
+
+        # alias la='ls -lA'
+        lAtr = "ls -lAtr";
+        # alias ll='ls -l'
+        ls = "ls -h --color=auto --group-directories-first";
+        dmesg = "dmesg -L --reltime";
+        view = "vim -R";
+      };
+
+      programs.bash = {
+        interactiveShellInit = ''
+          HISTCONTROL='erasedups:ignorespace'
+          HISTSIZE=65536
+          HISTFILESIZE=$HISTSIZE
+
+          shopt -s checkhash
+          shopt -s histappend histreedit histverify
+          shopt -s no_empty_cmd_completion
+          complete -d cd
+
+          ${readFile ./bash_completion.sh}
+
+          # TODO source bridge
+        '';
+        promptInit = ''
+          case $UID in
+            0)
+              PS1='\[\e[1;31m\]\w\[\e[0m\] '
+              ;;
+            1337)
+              PS1='\[\e[1;32m\]\w\[\e[0m\] '
+              ;;
+            *)
+              PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] '
+              ;;
+          esac
+          if test -n "$SSH_CLIENT"; then
+            PS1='\[\e[35m\]\h'" $PS1"
+          fi
+          if test -n "$SSH_AGENT_PID"; then
+            PS1="ssh-agent[$SSH_AGENT_PID] $PS1"
+          fi
+        '';
+      };
+
+      programs.ssh.startAgent = false;
+    }
+
+    {
+      services.cron.enable = false;
+      services.nscd.enable = false;
+      services.ntp.enable = false;
+    }
+
+    {
+      boot.kernel.sysctl = {
+        # Enable IPv6 Privacy Extensions
+        "net.ipv6.conf.all.use_tempaddr" = 2;
+        "net.ipv6.conf.default.use_tempaddr" = 2;
+      };
+    }
+
+    {
+      services.openssh = {
+        enable = true;
+        hostKeys = [
+          { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
+        ];
+      };
+    }
+
+    {
+      # TODO: exim
+      security.setuidPrograms = [
+        "sendmail"  # for sudo
+      ];
+    }
+  ];
+}
-- 
cgit v1.2.3


From 4d93a8215f08cbea0bbcb8c668f2bbc9600016da Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 22:16:59 +0100
Subject: krebs.build.source.dir.host defaults to current.host

---
 krebs/3modules/build.nix | 5 ++++-
 tv/1systems/cd.nix       | 2 --
 tv/1systems/mkdir.nix    | 2 --
 tv/1systems/nomic.nix    | 2 --
 tv/1systems/rmdir.nix    | 2 --
 tv/1systems/wu.nix       | 2 --
 tv/1systems/xu.nix       | 2 --
 7 files changed, 4 insertions(+), 13 deletions(-)

diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 1205e192b..7f004cd81 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -29,10 +29,13 @@ let
     };
 
     options.krebs.build.source.dir = mkOption {
-      type = types.attrsOf (types.submodule ({ config, ... }: {
+      type = let
+        default-host = config.krebs.current.host;
+      in types.attrsOf (types.submodule ({ config, ... }: {
         options = {
           host = mkOption {
             type = types.host;
+            default = default-host;
           };
           path = mkOption {
             type = types.str;
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 3f496fefb..126c6feb5 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -14,11 +14,9 @@ with lib;
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/cd";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
     };
   };
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 64896daf4..55d83f8f3 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -27,11 +27,9 @@ in
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/mkdir";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
     };
   };
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 495c765f3..c2bb4dc78 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -14,11 +14,9 @@ with lib;
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/nomic";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
     };
   };
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 62340b88c..53f14d7df 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -27,11 +27,9 @@ in
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/rmdir";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
     };
   };
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 8f714ec6b..33292c608 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -15,11 +15,9 @@ with lib;
       target-path = "/var/src/nixpkgs";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/wu";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
       target-path = "/var/src/stockholm";
     };
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 6f673ce9c..607f89aea 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -14,11 +14,9 @@ with lib;
       rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
     };
     dir.secrets = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/secrets/xu";
     };
     dir.stockholm = {
-      host = config.krebs.hosts.wu;
       path = "/home/tv/stockholm";
     };
   };
-- 
cgit v1.2.3


From bae469d2a64165a42d93cdb31e231fa75e9813a5 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 6 Nov 2015 22:36:01 +0100
Subject: tv: condense krebs.build

---
 tv/1systems/mkdir.nix   | 14 --------------
 tv/1systems/nomic.nix   | 14 --------------
 tv/1systems/rmdir.nix   | 14 --------------
 tv/1systems/wu.nix      | 18 ------------------
 tv/1systems/xu.nix      | 16 ----------------
 tv/2configs/default.nix | 19 +++++++++++++++++++
 6 files changed, 19 insertions(+), 76 deletions(-)

diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 55d83f8f3..6ae4f80e8 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -17,23 +17,9 @@ in
 
 {
   krebs.build.host = config.krebs.hosts.mkdir;
-  krebs.build.user = config.krebs.users.tv;
 
   krebs.build.target = "root@${primary-addr4}";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/mkdir";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index c2bb4dc78..0c6c935a3 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -4,23 +4,9 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.nomic;
-  krebs.build.user = config.krebs.users.tv;
 
   krebs.build.target = "root@nomic.gg23";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/nomic";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/AO753.nix
     #../2configs/consul-server.nix
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 53f14d7df..1f1d975c9 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -17,23 +17,9 @@ in
 
 {
   krebs.build.host = config.krebs.hosts.rmdir;
-  krebs.build.user = config.krebs.users.tv;
 
   krebs.build.target = "root@rmdir.internet";
 
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/rmdir";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
-
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 33292c608..26a603e9b 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -4,24 +4,6 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.wu;
-  krebs.build.user = config.krebs.users.tv;
-
-  krebs.build.target = "root@wu";
-
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-      target-path = "/var/src/nixpkgs";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/wu";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-      target-path = "/var/src/stockholm";
-    };
-  };
 
   imports = [
     ../2configs/hw/w110er.nix
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 607f89aea..65220fe3e 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -4,22 +4,6 @@ with lib;
 
 {
   krebs.build.host = config.krebs.hosts.xu;
-  krebs.build.user = config.krebs.users.tv;
-
-  krebs.build.target = "root@xu";
-
-  krebs.build.source = {
-    git.nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
-    };
-    dir.secrets = {
-      path = "/home/tv/secrets/xu";
-    };
-    dir.stockholm = {
-      path = "/home/tv/stockholm";
-    };
-  };
 
   imports = [
     ../2configs/hw/x220.nix
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index d3f4eed0d..d31862b60 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -5,6 +5,25 @@ with lib;
 {
   krebs.enable = true;
 
+  krebs.build = {
+    user = config.krebs.users.tv;
+    target = mkDefault "root@${config.krebs.build.host.name}";
+    source = {
+      git.nixpkgs = {
+        url = mkDefault https://github.com/NixOS/nixpkgs;
+        rev = mkDefault "c44a593aa43bba6a0708f6f36065a514a5110613";
+        target-path = mkDefault "/var/src/nixpkgs";
+      };
+      dir.secrets = {
+        path = mkDefault "/home/tv/secrets/${config.krebs.build.host.name}";
+      };
+      dir.stockholm = {
+        path = mkDefault "/home/tv/stockholm";
+        target-path = mkDefault "/var/src/stockholm";
+      };
+    };
+  };
+
   networking.hostName = config.krebs.build.host.name;
 
   imports = [
-- 
cgit v1.2.3