From 064d0111a0f56b813dba23ca0b19438f0c2e0530 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 16 Feb 2016 05:09:09 +0100 Subject: krebs.build: refactor a bit --- krebs/3modules/build.nix | 117 +++++++++++++++++++---------------------------- 1 file changed, 48 insertions(+), 69 deletions(-) diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index a1f446188..c700fbc56 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -20,35 +20,19 @@ let type = types.user; }; - options.krebs.build.source = let - raw = types.either types.str types.path; - url = types.submodule { + options.krebs.build.source = mkOption { + type = with types; attrsOf (either str (submodule { options = { - url = mkOption { - type = types.str; - }; - rev = mkOption { - type = types.str; - }; - dev = mkOption { - type = types.str; - }; + url = str; + rev = str; }; - }; - in mkOption { - type = types.attrsOf (types.either types.str url); - apply = let f = mapAttrs (_: value: { - string = value; - path = toString value; - set = f value; - }.${typeOf value}); in f; + })); default = {}; }; options.krebs.build.populate = mkOption { type = types.str; default = let - source = config.krebs.build.source; target-user = maybeEnv "target_user" "root"; target-host = maybeEnv "target_host" config.krebs.build.host.name; target-port = maybeEnv "target_port" "22"; @@ -75,24 +59,21 @@ let tmpdir=$(mktemp -dt stockholm.XXXXXXXX) chmod 0755 "$tmpdir" - ${concatStringsSep "\n" - (mapAttrsToList - (name: spec: let dst = removePrefix "symlink:" (get-url spec); in - "verbose ln -s ${shell.escape dst} $tmpdir/${shell.escape name}") - symlink-specs)} + ${concatStringsSep "\n" (mapAttrsToList (name: symlink: '' + verbose ln -s ${shell.escape symlink.target} \ + "$tmpdir"/${shell.escape name} + '') source-by-method.symlink)} verbose proot \ - -b $tmpdir:${shell.escape target-path} \ - ${concatStringsSep " \\\n " - (mapAttrsToList - (name: spec: - "-b ${shell.escape "${get-url spec}:${target-path}/${name}"}") - file-specs)} \ + -b "$tmpdir":${shell.escape target-path} \ + ${concatStringsSep " \\\n " (mapAttrsToList (name: file: + "-b ${shell.escape "${file.path}:${target-path}/${name}"}" + ) source-by-method.file)} \ rsync \ -f ${shell.escape "P /*"} \ - ${concatMapStringsSep " \\\n " - (name: "-f ${shell.escape "R /${name}"}") - (attrNames file-specs)} \ + ${concatMapStringsSep " \\\n " (name: + "-f ${shell.escape "R /${name}"}" + ) (attrNames source-by-method.file)} \ --delete \ -vFrlptD \ -e ${shell.escape "ssh -p ${target-port}"} \ @@ -100,30 +81,6 @@ let ${shell.escape "${target-user}@${target-host}:${target-path}"} ''; - get-schema = uri: - if substring 0 1 uri == "/" - then "file" - else head (splitString ":" uri); - - has-schema = schema: uri: get-schema uri == schema; - - get-url = spec: { - string = spec; - path = toString spec; - set = get-url spec.url; - }.${typeOf spec}; - - git-specs = - filterAttrs (_: spec: has-schema "https" (get-url spec)) source // - filterAttrs (_: spec: has-schema "http" (get-url spec)) source // - filterAttrs (_: spec: has-schema "git" (get-url spec)) source; - - file-specs = - filterAttrs (_: spec: has-schema "file" (get-url spec)) source; - - symlink-specs = - filterAttrs (_: spec: has-schema "symlink" (get-url spec)) source; - git-script = '' #! /bin/sh set -efu @@ -162,20 +119,42 @@ let git clean -dxf )} - ${concatStringsSep "\n" - (mapAttrsToList - (name: spec: toString (map shell.escape [ - "verbose" - "fetch_git" - "${target-path}/${name}" - spec.url - spec.rev - ])) - git-specs)} + ${concatStringsSep "\n" (mapAttrsToList (name: git: '' + verbose fetch_git ${concatMapStringsSep " " shell.escape [ + "${target-path}/${name}" + git.url + git.rev + ]} + '') source-by-method.git)} ''; in out; }; }; + source-by-method = let + known-methods = ["git" "file" "symlink"]; + in genAttrs known-methods (const {}) // recursiveUpdate source-by-scheme { + git = source-by-scheme.http or {} // + source-by-scheme.https or {}; + }; + + source-by-scheme = foldl' (out: { k, v }: recursiveUpdate out { + ${v.scheme}.${k} = v; + }) {} (mapAttrsToList (k: v: { inherit k v; }) normalized-source); + + normalized-source = mapAttrs (name: let f = x: getAttr (typeOf x) { + path = f (toString x); + string = f { + url = if substring 0 1 x == "/" then "file://${x}" else x; + }; + set = let scheme = head (splitString ":" x.url); in recursiveUpdate x { + inherit scheme; + } // { + symlink.target = removePrefix "symlink:" x.url; + file.path = # TODO file://host/... + assert hasPrefix "file:///" x.url; + removePrefix "file://" x.url; + }.${scheme} or {}; + }; in f) config.krebs.build.source; in out -- cgit v1.2.3 From 4fb829af7e5e9cb2837a052f34d789faf9f3cda9 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 16 Feb 2016 06:20:40 +0100 Subject: Makefile: parse target --- Makefile | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/Makefile b/Makefile index 384c872ab..a73a1aaf4 100644 --- a/Makefile +++ b/Makefile @@ -2,6 +2,30 @@ ifndef system $(error unbound variable: system) endif +# target = [target_user@]target_host[:target_port][/target_path] +ifdef target +_target_user != echo $(target) | sed -n 's/@.*//p' +_target_path != echo $(target) | sed -n 's/^[^/]*//p' +_target_port != echo $(target) | sed -En 's|^.*:([^/]*)(/.*)?$$|\1|p' +_target_host != echo $(target) | sed -En 's/^(.*@)?([^:/]*).*/\2/p' +ifneq ($(_target_host),) +$(if $(target_host),$(error cannot define both, target_host and host in target)) +target_host ?= $(_target_host) +endif +ifneq ($(_target_user),) +$(if $(target_user),$(error cannot define both, target_user and user in target)) +target_user ?= $(_target_user) +endif +ifneq ($(_target_port),) +$(if $(target_port),$(error cannot define both, target_port and port in target)) +target_port ?= $(_target_port) +endif +ifneq ($(_target_path),) +$(if $(target_path),$(error cannot define both, target_path and path in target)) +target_path ?= $(_target_path) +endif +endif + export target_host ?= $(system) export target_user ?= root export target_port ?= 22 -- cgit v1.2.3 From 439f913348f6135e0fd99d4e580a67a602bd72df Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 16 Feb 2016 07:31:37 +0100 Subject: Makefile: make nixos-config configurable --- Makefile | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index a73a1aaf4..e1889fc17 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,8 @@ -ifndef system -$(error unbound variable: system) +stockholm ?= . + +ifndef nixos-config +$(if $(system),,$(error unbound variable: system)) +nixos-config = ./$(LOGNAME)/1systems/$(system).nix endif # target = [target_user@]target_host[:target_port][/target_path] @@ -31,13 +34,18 @@ export target_user ?= root export target_port ?= 22 export target_path ?= /var/src +$(if $(target_host),,$(error unbound variable: target_host)) +$(if $(target_user),,$(error unbound variable: target_user)) +$(if $(target_port),,$(error unbound variable: target_port)) +$(if $(target_path),,$(error unbound variable: target_path)) + evaluate = \ nix-instantiate \ --eval \ --readonly-mode \ --show-trace \ - -I nixos-config=./$(LOGNAME)/1systems/$(system).nix \ - -I stockholm=. \ + -I nixos-config=$(nixos-config) \ + -I stockholm=$(stockholm) \ $(1) execute = \ -- cgit v1.2.3 From 18ac722ee6d85ba0d01f8cd3d04bca5b59843af8 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 16 Feb 2016 07:41:26 +0100 Subject: make test using nix-build --- Makefile | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Makefile b/Makefile index e1889fc17..7126332da 100644 --- a/Makefile +++ b/Makefile @@ -73,3 +73,10 @@ install: $(ssh) $(target_user)@$(target_host) -p $(target_port) \ env NIXOS_CONFIG=$(target_path)/nixos-config \ nixos-install + +# usage: make test system=foo [target=bar] +test: + $(call execute,populate) + ssh $(target_user)@$(target_host) -p $(target_port) \ + nix-build --no-out-link --show-trace -I $(target_path) \ + -A config.system.build.toplevel $(target_path)/stockholm -- cgit v1.2.3 From e8ccf0e4da1320dda3b7baca8f585f633726c755 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 16 Feb 2016 08:24:08 +0100 Subject: make {deploy,test}: make ssh configurable --- Makefile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 7126332da..8d1498d59 100644 --- a/Makefile +++ b/Makefile @@ -54,9 +54,10 @@ execute = \ echo "$$script" | sh # usage: make deploy system=foo [target_host=bar] +deploy: ssh ?= ssh deploy: $(call execute,populate) - ssh $(target_user)@$(target_host) -p $(target_port) \ + $(ssh) $(target_user)@$(target_host) -p $(target_port) \ nixos-rebuild switch --show-trace -I $(target_path) # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name @@ -75,8 +76,9 @@ install: nixos-install # usage: make test system=foo [target=bar] +test: ssh ?= ssh test: $(call execute,populate) - ssh $(target_user)@$(target_host) -p $(target_port) \ + $(ssh) $(target_user)@$(target_host) -p $(target_port) \ nix-build --no-out-link --show-trace -I $(target_path) \ -A config.system.build.toplevel $(target_path)/stockholm -- cgit v1.2.3 From d923ede6e33c57901039da59d50c45938228fd7a Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 16 Feb 2016 12:49:04 +0100 Subject: make test [method={build,eval}] # default=eval --- Makefile | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 8d1498d59..60dfe8030 100644 --- a/Makefile +++ b/Makefile @@ -75,10 +75,20 @@ install: env NIXOS_CONFIG=$(target_path)/nixos-config \ nixos-install -# usage: make test system=foo [target=bar] +# usage: make test system=foo [target=bar] [method={eval,build}] +method ?= eval +ifeq ($(method),build) +test: command = nix-build --no-out-link +else +ifeq ($(method),eval) +test: command ?= nix-instantiate --eval --json --readonly-mode --strict +else +$(error bad method: $(method)) +endif +endif test: ssh ?= ssh test: $(call execute,populate) $(ssh) $(target_user)@$(target_host) -p $(target_port) \ - nix-build --no-out-link --show-trace -I $(target_path) \ + $(command) --show-trace -I $(target_path) \ -A config.system.build.toplevel $(target_path)/stockholm -- cgit v1.2.3 From 2d79335e34d639657bd0045f9a6b777778a5ad82 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 17 Feb 2016 17:07:16 +0100 Subject: tv.mail: wu -> nomic --- krebs/3modules/tv/default.nix | 2 +- tv/1systems/nomic.nix | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index f8d3d8671..300fce017 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -352,7 +352,7 @@ with config.krebs.lib; pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod"; }; tv = { - mail = "tv@wu.retiolum"; + mail = "tv@nomic.retiolum"; pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDFR//RnCvEZAt0F6ExDsatKZ/DDdifanuSL360mqOhaFieKI34RoOwfQT9T+Ga52Vh5V2La6esvlph686EdgzeKLvDoxEwFM9ZYFBcMrNzu4bMTlgE7YUYw5JiORyXNfznBGnme6qpuvx9ibYhUyiZo99kM8ys5YrUHrP2JXQJMezDFZHxT4GFMOuSdh/1daGoKKD6hYL/jEHX8CI4E3BSmKK6ygYr1fVX0K0Tv77lIi5mLXucjR7CytWYWYnhM6DC3Hxpv2zRkPgf3k0x/Y1hrw3V/r0Me5h90pd2C8pFaWA2ZoUT/fmyVqvx1tZPYToU/O2dMItY0zgx2kR0yD+6g7Aahz3R+KlXkV8k5c8bbTbfGnZWDR1ZlbLRM9Yt5vosfwapUD90MmVkpmR3wUkO2sUKi80QfC7b4KvSDXQ+MImbGxMaU5Bnsq1PqLN95q+uat3nlAVBAELkcx51FlE9CaIS65y4J7FEDg8BE5JeuCNshh62VSYRXVSFt8bk3f/TFGgzC8OIo14BhVmiRQQ503Z1sROyf5xLX2a/EJavMm1i2Bs2TH6ROKY9z5Pz8hT5US0r381V8oG7TZyLF9HTtoy3wCYsgWA5EmLanjAsVU2YEeAA0rxzdtYP8Y2okFiJ6u+M4HQZ3Wg3peSodyp3vxdYce2vk4EKeqEFuuS82850DYb7Et7fmp+wQQUT8Q/bMO0DreWjHoMM5lE4LJ4ME6AxksmMiFtfo/4Fe2q9D+LAqZ+ANOcv9M+8Rn6ngiYmuRNd0l/a02q1PEvO6vTfXgcl4f7Z1IULHPEaDNZHCJS1K5RXYFqYQ6OHsTmOm7hnwaRAS97+VFMo1i5uvTx9nYaAcY7yzq3Ckfb67dMBKApGOpJpkvPgfrP7bgBO5rOZXM1opXqVPb09nljAhhAhyCTh1e/8+mJrBo0cLQ/LupQzVxGDgm3awSMPxsZAN45PSWz76zzxdDa1MMo51do+VJHfs7Wl0NcXAQrniOBYL9Wqt0qNkn1gY5smkkISGeQ/vxNap4MmzeZE7b5fpOy+2fpcRVQLpc4nooQzJvSVTFz+25lgZ6iHf45K87gQFMIAri1Pf/EDDpL87az+bRWvWi+BA2kMe1kf+Ay1LyMz8r+g51H0ma0bNFh6+fbWMfUiD9JCepIObclnUJ4NlWfcgHxTf17d/4tl6z4DTcLpCCk8Da77JouSHgvtcRbRlFV1OfhWZLXUsrlfpaQTiItv6TGIr3k7+7b66o3Qw/GQVs5GmYifaIZIz8n8my4XjkaMBd0SZfBzzvFjHMq6YUP9+SbjvReqofuoO+5tW1wTYZXitFFBfwuHlXm6w77K5QDBW6olT7pat41/F5eGxLcz tv@wu"; }; tv-nomic = { diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index 2c9775da7..c247bf796 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -10,6 +10,7 @@ with config.krebs.lib; ../2configs/hw/AO753.nix ../2configs/exim-retiolum.nix ../2configs/git.nix + ../2configs/mail-client.nix ../2configs/nginx-public_html.nix ../2configs/pulse.nix ../2configs/retiolum.nix -- cgit v1.2.3 From 468f294635523a39eaf1a6794571948066b63a1c Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 17 Feb 2016 17:23:19 +0100 Subject: tv im: init --- tv/1systems/nomic.nix | 1 + tv/1systems/wu.nix | 20 +------------------- tv/2configs/im.nix | 24 ++++++++++++++++++++++++ 3 files changed, 26 insertions(+), 19 deletions(-) create mode 100644 tv/2configs/im.nix diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index c247bf796..45320690b 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -10,6 +10,7 @@ with config.krebs.lib; ../2configs/hw/AO753.nix ../2configs/exim-retiolum.nix ../2configs/git.nix + ../2configs/im.nix ../2configs/mail-client.nix ../2configs/nginx-public_html.nix ../2configs/pulse.nix diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 6154e4df9..7615c4e80 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -10,6 +10,7 @@ with config.krebs.lib; ../2configs/hw/w110er.nix ../2configs/exim-retiolum.nix ../2configs/git.nix + ../2configs/im.nix ../2configs/mail-client.nix ../2configs/nginx-public_html.nix ../2configs/pulse.nix @@ -23,19 +24,6 @@ with config.krebs.lib; hashPassword haskellPackages.lentil parallel - (pkgs.writeScriptBin "im" '' - #! ${pkgs.bash}/bin/bash - export PATH=${makeSearchPath "bin" (with pkgs; [ - tmux - gnugrep - weechat - ])} - if tmux list-sessions -F\#S | grep -q '^im''$'; then - exec tmux attach -t im - else - exec tmux new -s im weechat - fi - '') # root cryptsetup @@ -201,12 +189,6 @@ with config.krebs.lib; KERNEL=="hpet", GROUP="audio" ''; - services.bitlbee = { - enable = true; - plugins = [ - pkgs.bitlbee-facebook - ]; - }; services.tor.client.enable = true; services.tor.enable = true; services.virtualboxHost.enable = true; diff --git a/tv/2configs/im.nix b/tv/2configs/im.nix new file mode 100644 index 000000000..db1be7f0b --- /dev/null +++ b/tv/2configs/im.nix @@ -0,0 +1,24 @@ +{ config, lib, pkgs, ... }: +with config.krebs.lib; +{ + environment.systemPackages = with pkgs; [ + (pkgs.writeDashBin "im" '' + export PATH=${makeSearchPath "bin" (with pkgs; [ + tmux + gnugrep + weechat + ])} + if tmux list-sessions -F\#S | grep -q '^im''$'; then + exec tmux attach -t im + else + exec tmux new -s im weechat + fi + '') + ]; + services.bitlbee = { + enable = true; + plugins = [ + pkgs.bitlbee-facebook + ]; + }; +} -- cgit v1.2.3 From d71a8863ac10f34bfe30f950f32bbf57427e2ca7 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 17 Feb 2016 17:30:39 +0100 Subject: tv krebs.backup.plans.nomic-home-xu: init --- tv/2configs/backup.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix index 641e2d586..decd8b286 100644 --- a/tv/2configs/backup.nix +++ b/tv/2configs/backup.nix @@ -2,6 +2,18 @@ with config.krebs.lib; { krebs.backup.plans = { + nomic-home-xu = { + method = "push"; + src = { host = config.krebs.hosts.nomic; path = "/home"; }; + dst = { host = config.krebs.hosts.xu; path = "/bku/nomic-home"; }; + startAt = "05:00"; + snapshots = { + daily = { format = "%Y-%m-%d"; retain = 7; }; + weekly = { format = "%YW%W"; retain = 4; }; + monthly = { format = "%Y-%m"; retain = 12; }; + yearly = { format = "%Y"; }; + }; + }; wu-home-xu = { method = "push"; src = { host = config.krebs.hosts.wu; path = "/home"; }; -- cgit v1.2.3 From a042769ee71e20176c5341bdcc029c3ac23646e1 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 17 Feb 2016 17:45:58 +0100 Subject: xu,wu: rm pkgs that belong to xserver --- tv/1systems/wu.nix | 5 ----- tv/1systems/xu.nix | 4 ---- 2 files changed, 9 deletions(-) diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 7615c4e80..2b6dca1c4 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -153,11 +153,7 @@ with config.krebs.lib; hardware.opengl.driSupport32Bit = true; environment.systemPackages = with pkgs; [ - xlibs.fontschumachermisc - slock ethtool - #firefoxWrapper # with plugins - #chromiumDevWrapper tinc iptables #jack2 @@ -165,7 +161,6 @@ with config.krebs.lib; security.setuidPrograms = [ "sendmail" # for cron - "slock" ]; services.printing.enable = true; diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index 5ec1fe52b..d4295d3b7 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -163,11 +163,7 @@ with config.krebs.lib; #hardware.opengl.driSupport32Bit = true; environment.systemPackages = with pkgs; [ - #xlibs.fontschumachermisc - #slock ethtool - #firefoxWrapper # with plugins - #chromiumDevWrapper tinc iptables #jack2 -- cgit v1.2.3 From 38cc636c8c1b8d95579ad9a980b29b494f383779 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 17 Feb 2016 22:28:02 +0100 Subject: tv sudo: !lecture --- tv/2configs/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index c4a2d6baa..13699a3d5 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -50,6 +50,7 @@ with config.krebs.lib; { security.sudo.extraConfig = '' Defaults mailto="${config.krebs.users.tv.mail}" + Defaults !lecture ''; time.timeZone = "Europe/Berlin"; } -- cgit v1.2.3 From f5d0b2a4020b3bd5150f9861fb27a7faaddbd0b9 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 17 Feb 2016 23:23:13 +0100 Subject: xu-qemu0: disable systemd-networkd-wait-online --- tv/2configs/xu-qemu0.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix index 720a8acd8..2b67a8b84 100644 --- a/tv/2configs/xu-qemu0.nix +++ b/tv/2configs/xu-qemu0.nix @@ -27,6 +27,8 @@ with config.krebs.lib; networking.dhcpcd.denyInterfaces = [ "qemubr0" ]; systemd.network.enable = true; + systemd.services.systemd-networkd-wait-online.enable = false; + services.resolved.enable = mkForce false; boot.kernel.sysctl."net.ipv4.ip_forward" = 1; -- cgit v1.2.3 From 970eed274818cb49517fa5ef8b39a30d99302f1e Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 17 Feb 2016 23:35:25 +0100 Subject: tv man: init --- tv/1systems/wu.nix | 3 +-- tv/1systems/xu.nix | 3 +-- tv/2configs/man.nix | 7 +++++++ 3 files changed, 9 insertions(+), 4 deletions(-) create mode 100644 tv/2configs/man.nix diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 2b6dca1c4..8c363d9fc 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -12,6 +12,7 @@ with config.krebs.lib; ../2configs/git.nix ../2configs/im.nix ../2configs/mail-client.nix + ../2configs/man.nix ../2configs/nginx-public_html.nix ../2configs/pulse.nix ../2configs/retiolum.nix @@ -40,14 +41,12 @@ with config.krebs.lib; haskellPackages.hledger htop jq - manpages mkpasswd netcat nix-repl nmap nq p7zip - posix_man_pages push qrencode texLive diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index d4295d3b7..c6a69a85a 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -11,6 +11,7 @@ with config.krebs.lib; ../2configs/exim-retiolum.nix ../2configs/git.nix ../2configs/mail-client.nix + ../2configs/man.nix ../2configs/nginx-public_html.nix ../2configs/pulse.nix ../2configs/retiolum.nix @@ -52,7 +53,6 @@ with config.krebs.lib; haskellPackages.hledger htop jq - manpages mkpasswd netcat nix-repl @@ -60,7 +60,6 @@ with config.krebs.lib; nq p7zip pass - posix_man_pages qrencode texLive tmux diff --git a/tv/2configs/man.nix b/tv/2configs/man.nix new file mode 100644 index 000000000..686e574fc --- /dev/null +++ b/tv/2configs/man.nix @@ -0,0 +1,7 @@ +{ config, lib, pkgs, ... }: +{ + environment.systemPackages = with pkgs; [ + manpages + posix_man_pages + ]; +} -- cgit v1.2.3 From f7d6e2043184401f7007b248fbe3af66b2752351 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 17 Feb 2016 23:35:43 +0100 Subject: tv man: inhibit warning break --- tv/2configs/man.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tv/2configs/man.nix b/tv/2configs/man.nix index 686e574fc..a84e60b73 100644 --- a/tv/2configs/man.nix +++ b/tv/2configs/man.nix @@ -1,5 +1,10 @@ { config, lib, pkgs, ... }: { + environment.etc."man.conf".source = pkgs.runCommand "man.conf" {} '' + ${pkgs.gnused}/bin/sed <${pkgs.man}/lib/man.conf >$out ' + s:^NROFF\t.*:& -Wbreak: + ' + ''; environment.systemPackages = with pkgs; [ manpages posix_man_pages -- cgit v1.2.3 From 7f1abe50ce0989d96c3d275a4d0481962848714f Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 18 Feb 2016 00:50:10 +0100 Subject: xu-qemu0 host: setup iptables --- tv/2configs/xu-qemu0.nix | 18 ++++++++++++------ tv/3modules/iptables.nix | 22 ++++++++++++++++++++++ 2 files changed, 34 insertions(+), 6 deletions(-) diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix index 2b67a8b84..5be4899c8 100644 --- a/tv/2configs/xu-qemu0.nix +++ b/tv/2configs/xu-qemu0.nix @@ -15,17 +15,23 @@ in # # make [install] system=xu-qemu0 target_host=10.56.0.101 -# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -# TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT -# TODO iptables -A POSTROUTING -t nat -j MASQUERADE -# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT -# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT - with config.krebs.lib; { networking.dhcpcd.denyInterfaces = [ "qemubr0" ]; + tv.iptables.extra = { + nat.POSTROUTING = ["-j MASQUERADE"]; + filter.FORWARD = [ + "-m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT" + "-i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT" + ]; + filter.INPUT = [ + "-i qemubr0 -p udp -m udp --dport bootps -j ACCEPT" + "-i qemubr0 -p udp -m udp --dport domain -j ACCEPT" + ]; + }; + systemd.network.enable = true; systemd.services.systemd-networkd-wait-online.enable = false; diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix index c0fd7ec12..c0e71f24d 100644 --- a/tv/3modules/iptables.nix +++ b/tv/3modules/iptables.nix @@ -26,6 +26,21 @@ let type = with types; listOf (either int str); default = []; }; + + extra = { + nat.POSTROUTING = mkOption { + type = with types; listOf str; + default = []; + }; + filter.FORWARD = mkOption { + type = with types; listOf str; + default = []; + }; + filter.INPUT = mkOption { + type = with types; listOf str; + default = []; + }; + }; }; imp = { @@ -57,6 +72,11 @@ let }; }; + formatTable = table: + (concatStringsSep "\n" + (mapAttrsToList + (chain: concatMapStringsSep "\n" (rule: "-A ${chain} ${rule}")) + table)); rules = iptables-version: let accept-echo-request = { @@ -79,6 +99,7 @@ let ${concatMapStringsSep "\n" (rule: "-A OUTPUT ${rule}") [ "-o lo -p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22" ]} + ${formatTable cfg.extra.nat} COMMIT *filter :INPUT DROP [0:0] @@ -94,6 +115,7 @@ let ++ map accept-new-tcp (unique (map toString cfg.input-internet-accept-new-tcp)) ++ ["-i retiolum -j Retiolum"] )} + ${formatTable cfg.extra.filter} ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([] ++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request ++ map accept-new-tcp (unique (map toString cfg.input-retiolum-accept-new-tcp)) -- cgit v1.2.3 From 8c264139b294cbbea27a042263a4b76991910f02 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 18 Feb 2016 01:15:58 +0100 Subject: krebs.build: use $F5 to prefix verbose commands --- Makefile | 2 +- krebs/3modules/build.nix | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/Makefile b/Makefile index 60dfe8030..9dcd47548 100644 --- a/Makefile +++ b/Makefile @@ -51,7 +51,7 @@ evaluate = \ execute = \ result=$$($(call evaluate,-A config.krebs.build.$(1) --json)) && \ script=$$(echo "$$result" | jq -r .) && \ - echo "$$script" | sh + echo "$$script" | PS5=% sh # usage: make deploy system=foo [target_host=bar] deploy: ssh ?= ssh diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index c700fbc56..b8ea34ae2 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -42,12 +42,13 @@ let set -eu verbose() { - printf '+%s\n' "$(printf ' %q' "$@")" >&2 + printf '%s%s\n' "$PS5$(printf ' %q' "$@")" >&2 "$@" } - echo ${shell.escape git-script} \ - | ssh -p ${shell.escape target-port} \ + { printf 'PS5=%q%q\n' @ "$PS5" + echo ${shell.escape git-script} + } | verbose ssh -p ${shell.escape target-port} \ ${shell.escape "${target-user}@${target-host}"} -T unset tmpdir @@ -86,7 +87,7 @@ let set -efu verbose() { - printf '+%s\n' "$(printf ' %q' "$@")" >&2 + printf '%s%s\n' "$PS5$(printf ' %q' "$@")" >&2 "$@" } -- cgit v1.2.3 From 1de8d5c44d9a3fe15aaace950347986aeaa0a355 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 18 Feb 2016 02:47:16 +0100 Subject: krebs.backup: talk about local and remote rsync --- krebs/3modules/backup.nix | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index 0aa86dec9..97082f56a 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -117,6 +117,14 @@ let "$dst_user@$dst_host" \ -T "$with_dst_path_lock_script" } + rsh="ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" + local_rsync() { + rsync "$@" + } + remote_rsync=${shell.escape (concatStringsSep " && " [ + "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current" + "exec flock -n ${shell.escape plan.dst.path} rsync" + ])} ''; pull = '' identity=${shell.escape plan.dst.host.ssh.privkey.path} @@ -131,6 +139,12 @@ let dst_shell() { eval "$with_dst_path_lock_script" } + rsh="ssh -F /dev/null -i $identity ''${src_port:+-p $src_port}" + local_rsync() { + mkdir -m 0700 -p ${shell.escape plan.dst.path}/current + flock -n ${shell.escape plan.dst.path} rsync "$@" + } + remote_rsync=rsync ''; }} # Note that this only works because we trust date +%s to produce output @@ -140,13 +154,10 @@ let with_dst_path_lock_script="exec env start_date=$(date +%s) "${shell.escape "flock -n ${shell.escape plan.dst.path} /bin/sh" } - rsync >&2 \ + local_rsync >&2 \ -aAXF --delete \ - -e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \ - --rsync-path ${shell.escape (concatStringsSep " && " [ - "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current" - "exec flock -n ${shell.escape plan.dst.path} rsync" - ])} \ + --rsh="$rsh" \ + --rsync-path="$remote_rsync" \ --link-dest="$dst_path/current" \ "$src/" \ "$dst/.partial" -- cgit v1.2.3 From db6342f58c534bd2ce631fd81d6956cdd8fe4637 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 18 Feb 2016 02:55:46 +0100 Subject: tv: init backup plans xu-pull-cd-{ejabberd,home} --- tv/2configs/backup.nix | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix index decd8b286..b5512662f 100644 --- a/tv/2configs/backup.nix +++ b/tv/2configs/backup.nix @@ -2,41 +2,43 @@ with config.krebs.lib; { krebs.backup.plans = { + } // mapAttrs (_: recursiveUpdate { + snapshots = { + daily = { format = "%Y-%m-%d"; retain = 7; }; + weekly = { format = "%YW%W"; retain = 4; }; + monthly = { format = "%Y-%m"; retain = 12; }; + yearly = { format = "%Y"; }; + }; + }) { nomic-home-xu = { method = "push"; src = { host = config.krebs.hosts.nomic; path = "/home"; }; dst = { host = config.krebs.hosts.xu; path = "/bku/nomic-home"; }; startAt = "05:00"; - snapshots = { - daily = { format = "%Y-%m-%d"; retain = 7; }; - weekly = { format = "%YW%W"; retain = 4; }; - monthly = { format = "%Y-%m"; retain = 12; }; - yearly = { format = "%Y"; }; - }; }; wu-home-xu = { method = "push"; src = { host = config.krebs.hosts.wu; path = "/home"; }; dst = { host = config.krebs.hosts.xu; path = "/bku/wu-home"; }; startAt = "05:00"; - snapshots = { - daily = { format = "%Y-%m-%d"; retain = 7; }; - weekly = { format = "%YW%W"; retain = 4; }; - monthly = { format = "%Y-%m"; retain = 12; }; - yearly = { format = "%Y"; }; - }; }; xu-home-wu = { method = "push"; src = { host = config.krebs.hosts.xu; path = "/home"; }; dst = { host = config.krebs.hosts.wu; path = "/bku/xu-home"; }; startAt = "06:00"; - snapshots = { - daily = { format = "%Y-%m-%d"; retain = 7; }; - weekly = { format = "%YW%W"; retain = 4; }; - monthly = { format = "%Y-%m"; retain = 12; }; - yearly = { format = "%Y"; }; - }; + }; + xu-pull-cd-ejabberd = { + method = "pull"; + src = { host = config.krebs.hosts.cd; path = "/var/ejabberd"; }; + dst = { host = config.krebs.hosts.xu; path = "/bku/cd-ejabberd"; }; + startAt = "07:00"; + }; + xu-pull-cd-home = { + method = "pull"; + src = { host = config.krebs.hosts.cd; path = "/home"; }; + dst = { host = config.krebs.hosts.xu; path = "/bku/cd-home"; }; + startAt = "07:00"; }; } // mapAttrs (_: recursiveUpdate { snapshots = { -- cgit v1.2.3 From bca88ce7c65d424cdda61f4a588794e8d52ed394 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 18 Feb 2016 16:42:11 +0100 Subject: krebs.urlwatch: add hooksFile and per-url filter --- krebs/3modules/urlwatch.nix | 69 +++++++++++++++++++++++++++++---------------- 1 file changed, 45 insertions(+), 24 deletions(-) diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix index cd4976a21..ed1a21260 100644 --- a/krebs/3modules/urlwatch.nix +++ b/krebs/3modules/urlwatch.nix @@ -3,7 +3,6 @@ # TODO multiple users # TODO inform about unused caches # cache = url: "${cfg.dataDir}/.urlwatch/cache/${hashString "sha1" url}" -# TODO hooks.py with config.krebs.lib; let @@ -32,6 +31,14 @@ let Content of the From: header of the generated mails. ''; }; + # TODO hooks :: attrsOf hook + hooksFile = mkOption { + type = with types; nullOr path; + default = null; + description = '' + File to use as hooks.py module. + ''; + }; mailto = mkOption { type = types.str; default = config.krebs.build.user.mail; @@ -48,7 +55,7 @@ let ''; }; urls = mkOption { - type = with types; listOf str; + type = with types; listOf (either str subtypes.job); default = []; description = "URL to watch."; example = [ @@ -56,7 +63,10 @@ let ]; apply = map (x: getAttr (typeOf x) { set = x; - string.url = x; + string = { + url = x; + filter = null; + }; }); }; verbose = mkOption { @@ -68,9 +78,12 @@ let }; }; - urlsFile = toFile "urls" (concatMapStringsSep "\n---\n" toJSON cfg.urls); + urlsFile = pkgs.writeText "urls" + (concatMapStringsSep "\n---\n" toJSON cfg.urls); + + hooksFile = cfg.hooksFile; - configFile = toFile "urlwatch.yaml" (toJSON { + configFile = pkgs.writeText "urlwatch.yaml" (toJSON { display = { error = true; new = true; @@ -127,10 +140,10 @@ let User = user.name; PermissionsStartOnly = "true"; PrivateTmp = "true"; + SyslogIdentifier = "urlwatch"; Type = "oneshot"; ExecStartPre = - pkgs.writeScript "urlwatch-prestart" '' - #! /bin/sh + pkgs.writeDash "urlwatch-prestart" '' set -euf dataDir=$HOME @@ -140,31 +153,29 @@ let chown ${user.name}: "$dataDir" fi ''; - ExecStart = pkgs.writeScript "urlwatch" '' - #! /bin/sh + ExecStart = pkgs.writeDash "urlwatch" '' set -euf - from=${escapeShellArg cfg.from} - mailto=${escapeShellArg cfg.mailto} - urlsFile=${escapeShellArg urlsFile} - configFile=${escapeShellArg configFile} cd /tmp urlwatch \ ${optionalString cfg.verbose "-v"} \ - --urls="$urlsFile" \ - --config="$configFile" \ + --config=${shell.escape configFile} \ + ${optionalString (hooksFile != null) + "--hooks=${shell.escape hooksFile}" + } \ + --urls=${shell.escape urlsFile} \ > changes || : if test -s changes; then - date=$(date -R) - subject=$(sed -n 's/^\(CHANGED\|ERROR\|NEW\): //p' changes \ - | tr \\n \ ) { - echo "Date: $date" - echo "From: $from" - echo "Subject: $subject" - echo "To: $mailto" + echo Date: $(date -R) + echo From: ${shell.escape cfg.from} + echo Subject: $( + sed -n 's/^\(CHANGED\|ERROR\|NEW\): //p' changes \ + | tr '\n' ' ' + ) + echo To: ${shell.escape cfg.mailto} echo cat changes } | /var/setuid-wrappers/sendmail -t @@ -181,5 +192,15 @@ let name = "urlwatch"; uid = genid name; }; -in -out + + subtypes.job = types.submodule { + options = { + url = mkOption { + type = types.str; + }; + filter = mkOption { + type = with types; nullOr str; # TODO nullOr subtypes.filter + }; + }; + }; +in out -- cgit v1.2.3 From ffc47bf80d521635021b3f7a0122092708ebd2bf Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 18 Feb 2016 14:14:30 +0100 Subject: tv urlwatch: filter pypi/vncdotool/json through jq --- tv/2configs/urlwatch.nix | 41 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 38 insertions(+), 3 deletions(-) diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix index 0106cddf7..51b53230b 100644 --- a/tv/2configs/urlwatch.nix +++ b/tv/2configs/urlwatch.nix @@ -1,5 +1,5 @@ -{ config, ... }: - +{ config, pkgs, ... }: +with config.krebs.lib; { krebs.urlwatch = { enable = true; @@ -52,8 +52,43 @@ # is derived from `configFile` in: https://raw.githubusercontent.com/NixOS/nixpkgs/master/nixos/modules/services/x11/xserver.nix - https://pypi.python.org/pypi/vncdotool + { + url = https://pypi.python.org/pypi/vncdotool/json; + filter = "system:${pkgs.jq}/bin/jq -r '.releases|keys[]'"; + } https://api.github.com/repos/kanaka/noVNC/tags ]; + hooksFile = toFile "hooks.py" '' + import subprocess + import urlwatch + + class CaseFilter(urlwatch.filters.FilterBase): + """Filter for piping data through an external process""" + + __kind__ = 'system' + + def filter(self, data, subfilter=None): + if subfilter is None: + raise ValueError('The system filter needs a command') + + proc = subprocess.Popen( + subfilter, + shell=True, + stdin=subprocess.PIPE, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + ) + + (stdout, stderr) = proc.communicate(data.encode()) + + if proc.returncode != 0: + raise RuntimeError( + "system filter returned non-zero exit status %d; stderr:\n" + % proc.returncode + + stderr.decode() + ) + + return stdout.decode() + ''; }; } -- cgit v1.2.3 From c040c8f1b5fcfbd1b784c9460f4a0b78091ff2db Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 19 Feb 2016 16:15:14 +0100 Subject: make: allow evaluation of arbitrary expressions --- Makefile | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index 9dcd47548..12a60a90b 100644 --- a/Makefile +++ b/Makefile @@ -46,10 +46,12 @@ evaluate = \ --show-trace \ -I nixos-config=$(nixos-config) \ -I stockholm=$(stockholm) \ - $(1) + -E '{ eval, f }: f eval' \ + --arg eval 'import ./.' \ + --arg f "eval@{ config, ... }: $(1)" execute = \ - result=$$($(call evaluate,-A config.krebs.build.$(1) --json)) && \ + result=$$($(call evaluate,config.krebs.build.$(1))) && \ script=$$(echo "$$result" | jq -r .) && \ echo "$$script" | PS5=% sh @@ -61,8 +63,8 @@ deploy: nixos-rebuild switch --show-trace -I $(target_path) # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name -eval eval.:;@$(call evaluate) -eval.%:;@$(call evaluate,-A $*) +eval eval.:;@$(call evaluate,$${expr-eval}) +eval.%:;@$(call evaluate,$*) # usage: make install system=foo [target_host=bar] install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -- cgit v1.2.3 From 47ef169276fcb500a3764c050dbeca1f7fc4a18b Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 19 Feb 2016 16:18:28 +0100 Subject: krebs.hosts.*: set owner --- krebs/3modules/lass/default.nix | 2 +- krebs/3modules/makefu/default.nix | 2 +- krebs/3modules/miefda/default.nix | 2 +- krebs/3modules/mv/default.nix | 2 +- krebs/3modules/tv/default.nix | 2 +- krebs/4lib/types.nix | 9 +++++++++ 6 files changed, 14 insertions(+), 5 deletions(-) diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix index 41a609105..4bf10ac56 100644 --- a/krebs/3modules/lass/default.nix +++ b/krebs/3modules/lass/default.nix @@ -3,7 +3,7 @@ with config.krebs.lib; { - hosts = { + hosts = mapAttrs (_: setAttr "owner" config.krebs.users.lass) { dishfire = { cores = 4; nets = rec { diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 6af77ad9b..d309c1714 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -3,7 +3,7 @@ with config.krebs.lib; { - hosts = { + hosts = mapAttrs (_: setAttr "owner" config.krebs.users.makefu) { pnp = { cores = 1; nets = { diff --git a/krebs/3modules/miefda/default.nix b/krebs/3modules/miefda/default.nix index 6587ad92d..9a5866294 100644 --- a/krebs/3modules/miefda/default.nix +++ b/krebs/3modules/miefda/default.nix @@ -3,7 +3,7 @@ with config.krebs.lib; { - hosts = { + hosts = mapAttrs (_: setAttr "owner" config.krebs.users.miefda) { bobby = { cores = 4; nets = { diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix index 33f941aae..3b4001e7a 100644 --- a/krebs/3modules/mv/default.nix +++ b/krebs/3modules/mv/default.nix @@ -3,7 +3,7 @@ with config.krebs.lib; { - hosts = { + hosts = mapAttrs (_: setAttr "owner" config.krebs.users.mv) { stro = { cores = 4; nets = { diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix index 300fce017..1a9198b4e 100644 --- a/krebs/3modules/tv/default.nix +++ b/krebs/3modules/tv/default.nix @@ -6,7 +6,7 @@ with config.krebs.lib; dns.providers = { de.viljetic = "regfish"; }; - hosts = { + hosts = mapAttrs (_: setAttr "owner" config.krebs.users.tv) { cd = rec { cores = 2; extraZones = { diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index d0a537467..d63080b99 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -20,6 +20,15 @@ types // rec { default = {}; }; + owner = mkOption { + type = user; + # TODO proper user + default = { + name = "krebs"; + mail = "spam@krebsco.de"; + }; + }; + extraZones = mkOption { default = {}; # TODO: string is either MX, NS, A or AAAA -- cgit v1.2.3 From dbe2ece8ad962d654bc34f3a7c4802768df71ebb Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 19 Feb 2016 16:18:50 +0100 Subject: krebs.hosts.*.infest: RIP --- krebs/4lib/types.nix | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix index d63080b99..7fb206928 100644 --- a/krebs/4lib/types.nix +++ b/krebs/4lib/types.nix @@ -35,19 +35,6 @@ types // rec { type = with types; attrsOf string; }; - infest = { - addr = mkOption { - type = str; - apply = trace "Obsolete option `krebs.hosts.${config.name}.infest.addr' is used. It was replaced by the `target' argument to `make` or `get`. See Makefile for more information."; - }; - port = mkOption { - type = int; - default = 22; - # TODO replacement: allow target with port, SSH-style: [lol]:666 - apply = trace "Obsolete option `krebs.hosts.${config.name}.infest.port' is used. It's gone without replacement."; - }; - }; - secure = mkOption { type = bool; default = false; -- cgit v1.2.3 From bb201b19659b1da47f212d3b74cd18da543e8d6e Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 19 Feb 2016 16:37:25 +0100 Subject: push: 1.1.1 -> 1.1.2 --- krebs/5pkgs/push/default.nix | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/krebs/5pkgs/push/default.nix b/krebs/5pkgs/push/default.nix index 13769c747..aa17a21a9 100644 --- a/krebs/5pkgs/push/default.nix +++ b/krebs/5pkgs/push/default.nix @@ -1,20 +1,21 @@ { fetchgit, lib, stdenv , coreutils -, get , git +, gnumake , gnused , jq +, nix , openssh , parallel , ... }: stdenv.mkDerivation { - name = "push-1.1.1"; + name = "push-1.1.2"; src = fetchgit { url = http://cgit.cd.krebsco.de/push; - rev = "ea8b76569c6b226fe148e559477669b095408472"; - sha256 = "c305a1515d30603f6ed825d44487e863fdc7d90400620ceaf2c335a3b5d1e221"; + rev = "da5b3a4b05ef822cc41d36b6cc2071a2e78506d4"; + sha256 = "0gfxz207lm11g77rw02jcqpvzhx07j9hzgjgscbmslzl5r8icd6g"; }; phases = [ @@ -26,10 +27,11 @@ stdenv.mkDerivation { let path = lib.makeSearchPath "bin" [ coreutils - get git + gnumake gnused jq + nix openssh parallel ]; -- cgit v1.2.3 From 06537421ddb9727cf33b1ce0115c9077751c8399 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 15 Feb 2016 16:56:29 +0100 Subject: l 1 helios: add pass.nix config --- lass/1systems/helios.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix index 88fb6aac7..593baa009 100644 --- a/lass/1systems/helios.nix +++ b/lass/1systems/helios.nix @@ -8,6 +8,7 @@ with builtins; ../2configs/browsers.nix ../2configs/programs.nix ../2configs/git.nix + ../2configs/pass.nix #{ # users.extraUsers = { # root = { -- cgit v1.2.3 From d1507e4c88dfa651bb1688e01875880d124340cb Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 15 Feb 2016 16:56:45 +0100 Subject: l 1 helios: open up port 8000 for webtesting --- lass/1systems/helios.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix index 593baa009..d878b2b64 100644 --- a/lass/1systems/helios.nix +++ b/lass/1systems/helios.nix @@ -18,6 +18,15 @@ with builtins; # }; # }; #} + { + krebs.iptables = { + tables = { + filter.INPUT.rules = [ + { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; precedence = 9001; } + ]; + }; + }; + } ]; krebs.build.host = config.krebs.hosts.helios; -- cgit v1.2.3 From 56aa68df42c21be4fc9d653cc61920e4827f47b7 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 15 Feb 2016 16:57:04 +0100 Subject: l 1 helios: disbale intel sna because of bugs --- lass/1systems/helios.nix | 9 --------- 1 file changed, 9 deletions(-) diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix index d878b2b64..0103b6ec0 100644 --- a/lass/1systems/helios.nix +++ b/lass/1systems/helios.nix @@ -63,15 +63,6 @@ with builtins; # SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:b8:c8:2e", NAME="et0" #''; - services.xserver = { - videoDriver = "intel"; - vaapiDrivers = [ pkgs.vaapiIntel ]; - deviceSection = '' - Option "AccelMethod" "sna" - BusID "PCI:0:2:0" - ''; - }; - services.xserver.synaptics = { enable = true; twoFingerScroll = true; -- cgit v1.2.3 From bb1d0e913e2f96ddfc28c199ab29372c8f57a9e3 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 15 Feb 2016 16:57:48 +0100 Subject: l 1 mors: add python test-env --- lass/1systems/mors.nix | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index f6ac1b4e6..96a57d0fa 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -97,6 +97,39 @@ # { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; precedence = 9998; } # ]; #} + { + containers.pythonenv = { + config = { + services.openssh.enable = true; + users.users.root.openssh.authorizedKeys.keys = [ + config.krebs.users.lass.pubkey + ]; + + environment = { + systemPackages = with pkgs; [ + git + libxml2 + libxslt + libzip + python27Full + python27Packages.buildout + stdenv + zlib + ]; + + pathsToLink = [ "/include" ]; + + shellInit = '' + # help pip to find libz.so when building lxml + export LIBRARY_PATH=/var/run/current-system/sw/lib + # ditto for header files, e.g. sqlite + export C_INCLUDE_PATH=/var/run/current-system/sw/include + ''; + }; + + }; + }; + } ]; krebs.build.host = config.krebs.hosts.mors; -- cgit v1.2.3 From 0e03417f2e214795320c0a0f75b10d1bfbdf8648 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 15 Feb 2016 16:58:04 +0100 Subject: l 1 mors: activate postgresql --- lass/1systems/mors.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index 96a57d0fa..e3bb4e487 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -130,6 +130,12 @@ }; }; } + { + services.postgresql = { + enable = true; + authentication = "local all all ident"; + }; + } ]; krebs.build.host = config.krebs.hosts.mors; -- cgit v1.2.3 From 3e542873a9bc1a66bd1ed25b0e72c0311f23ac00 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 16 Feb 2016 17:12:39 +0100 Subject: l 2 browsers: allow audio in flash browser --- lass/2configs/browsers.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lass/2configs/browsers.nix b/lass/2configs/browsers.nix index 61016fed0..eb764068b 100644 --- a/lass/2configs/browsers.nix +++ b/lass/2configs/browsers.nix @@ -58,7 +58,7 @@ in { ( createChromiumUser "cr" [ "audio" ] [ pkgs.chromium ] ) ( createChromiumUser "fb" [ ] [ pkgs.chromium ] ) ( createChromiumUser "gm" [ ] [ pkgs.chromium ] ) - ( createChromiumUser "flash" [ ] [ pkgs.flash ] ) + ( createChromiumUser "flash" [ "audio" ] [ pkgs.flash ] ) ]; nixpkgs.config.packageOverrides = pkgs : { -- cgit v1.2.3 From 168e8baaf0fc7c9318e60cfd5d0b4a9d507c8c72 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 16 Feb 2016 17:13:40 +0100 Subject: l 2 git: add extraction_webinterface repo --- lass/2configs/git.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix index 76b897d1f..bd4ce3ec2 100644 --- a/lass/2configs/git.nix +++ b/lass/2configs/git.nix @@ -42,6 +42,7 @@ let brain = { collaborators = with config.krebs.users; [ tv makefu ]; }; + extraction_webinterface = {}; } // import { inherit config lib pkgs; } ); -- cgit v1.2.3 From 179ce6c3f9eff376da6bb93feffbb11a52e5d33b Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 16 Feb 2016 17:13:54 +0100 Subject: l 2 git: add politics-fetching repo --- lass/2configs/git.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix index bd4ce3ec2..0aab298c7 100644 --- a/lass/2configs/git.nix +++ b/lass/2configs/git.nix @@ -43,6 +43,7 @@ let collaborators = with config.krebs.users; [ tv makefu ]; }; extraction_webinterface = {}; + politics-fetching = {}; } // import { inherit config lib pkgs; } ); -- cgit v1.2.3 From 81fa056af7446a461d24b538c225605589d15cef Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 16 Feb 2016 17:14:27 +0100 Subject: l 2 xserver: add systemPackages PATH --- lass/2configs/xserver/default.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/lass/2configs/xserver/default.nix b/lass/2configs/xserver/default.nix index 82cfd57bb..203ed0b09 100644 --- a/lass/2configs/xserver/default.nix +++ b/lass/2configs/xserver/default.nix @@ -93,11 +93,9 @@ let xmonad-start = pkgs.writeScriptBin "xmonad" '' #! ${pkgs.bash}/bin/bash set -efu - export PATH; PATH=${makeSearchPath "bin" [ - pkgs.alsaUtils - pkgs.pulseaudioLight + export PATH; PATH=${makeSearchPath "bin" ([ pkgs.rxvt_unicode - ]}:/var/setuid-wrappers + ] ++ config.environment.systemPackages)}:/var/setuid-wrappers settle() {( # Use PATH for a clean journal command=''${1##*/} -- cgit v1.2.3 From 4b1ff53f304ab41a99cb24fc0424017c86e5993b Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 17 Feb 2016 14:58:59 +0100 Subject: l 1 mors: disbale broken configs --- lass/1systems/mors.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index e3bb4e487..7d4cd72d2 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -20,12 +20,12 @@ ../2configs/git.nix #../2configs/wordpress.nix ../2configs/bitlbee.nix - ../2configs/firefoxPatched.nix + #../2configs/firefoxPatched.nix ../2configs/skype.nix ../2configs/teamviewer.nix ../2configs/libvirt.nix ../2configs/fetchWallpaper.nix - ../2configs/buildbot-standalone.nix + #../2configs/buildbot-standalone.nix { #risk of rain port krebs.iptables.tables.filter.INPUT.rules = [ -- cgit v1.2.3 From d01c882e1ead9a2cd01c2f3a7f1c198dbce24953 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 17 Feb 2016 14:59:21 +0100 Subject: l 1 mors: postgre -> mariadb --- lass/1systems/mors.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index 7d4cd72d2..31663008d 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -131,9 +131,10 @@ }; } { - services.postgresql = { + services.mysql = { enable = true; - authentication = "local all all ident"; + package = pkgs.mariadb; + rootPassword = "/mysql_rootPassword"; }; } ]; -- cgit v1.2.3 From 146421e96912ffd8dd5e2dd10019e5099d7d155b Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 17 Feb 2016 14:59:36 +0100 Subject: add /mnt/conf to automounted disks --- lass/1systems/mors.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index 31663008d..a7f4ee5f8 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -210,6 +210,11 @@ device = "/dev/big/public"; fsType = "ext4"; }; + + "/mnt/conf" = { + device = "/dev/big/conf"; + fsType = "ext4"; + }; }; services.udev.extraRules = '' -- cgit v1.2.3 From 9d519dd4d28d05f0fb86f742fedaa6a505522a4b Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 17 Feb 2016 15:00:18 +0100 Subject: l 2: use inherit genid from krebs.lib --- lass/2configs/libvirt.nix | 3 ++- lass/2configs/skype.nix | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/lass/2configs/libvirt.nix b/lass/2configs/libvirt.nix index 7520a0e36..a51ccae58 100644 --- a/lass/2configs/libvirt.nix +++ b/lass/2configs/libvirt.nix @@ -2,13 +2,14 @@ let mainUser = config.users.extraUsers.mainUser; + inherit (config.krebs.lib) genid; in { virtualisation.libvirtd.enable = true; users.extraUsers = { libvirt = { - uid = lib.genid "libvirt"; + uid = genid "libvirt"; description = "user for running libvirt stuff"; home = "/home/libvirt"; useDefaultShell = true; diff --git a/lass/2configs/skype.nix b/lass/2configs/skype.nix index d62a18a52..5b6da4a95 100644 --- a/lass/2configs/skype.nix +++ b/lass/2configs/skype.nix @@ -2,12 +2,13 @@ let mainUser = config.users.extraUsers.mainUser; + inherit (config.krebs.lib) genid; in { users.extraUsers = { skype = { name = "skype"; - uid = lib.genid "skype"; + uid = genid "skype"; description = "user for running skype"; home = "/home/skype"; useDefaultShell = true; -- cgit v1.2.3 From a278c6588750c09f97e83c53d86aef5ec82a7bcd Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 17 Feb 2016 15:00:52 +0100 Subject: l 5: callPackage -> pkgs.callPackage --- lass/5pkgs/default.nix | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/lass/5pkgs/default.nix b/lass/5pkgs/default.nix index fee4654ae..ce29ae33c 100644 --- a/lass/5pkgs/default.nix +++ b/lass/5pkgs/default.nix @@ -1,16 +1,13 @@ { pkgs, ... }: -let - inherit (pkgs) callPackage; -in { nixpkgs.config.packageOverrides = rec { firefoxPlugins = { - noscript = callPackage ./firefoxPlugins/noscript.nix {}; - ublock = callPackage ./firefoxPlugins/ublock.nix {}; - vimperator = callPackage ./firefoxPlugins/vimperator.nix {}; + noscript = pkgs.callPackage ./firefoxPlugins/noscript.nix {}; + ublock = pkgs.callPackage ./firefoxPlugins/ublock.nix {}; + vimperator = pkgs.callPackage ./firefoxPlugins/vimperator.nix {}; }; - newsbot-js = callPackage ./newsbot-js/default.nix {}; + newsbot-js = pkgs.callPackage ./newsbot-js/default.nix {}; xmonad-lass = let src = pkgs.writeNixFromCabal "xmonad-lass.nix" ./xmonad-lass; in pkgs.haskellPackages.callPackage src {}; -- cgit v1.2.3 From 43f06b9773bdd93e0e369012081dc359aa29ea1e Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 17 Feb 2016 15:01:35 +0100 Subject: l 5 xmonad-lass Main: fix xmonad errors --- lass/5pkgs/xmonad-lass/Main.hs | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/lass/5pkgs/xmonad-lass/Main.hs b/lass/5pkgs/xmonad-lass/Main.hs index faaa00aab..503df3be7 100644 --- a/lass/5pkgs/xmonad-lass/Main.hs +++ b/lass/5pkgs/xmonad-lass/Main.hs @@ -12,7 +12,6 @@ import XMonad import System.IO (hPutStrLn, stderr) import System.Environment (getArgs, withArgs, getEnv, getEnvironment) import System.Posix.Process (executeFile) -import XMonad.Prompt (defaultXPConfig) import XMonad.Actions.DynamicWorkspaces ( addWorkspacePrompt, renameWorkspace , removeEmptyWorkspace) import XMonad.Actions.GridSelect @@ -73,7 +72,7 @@ mainNoArgs = do -- $ withUrgencyHook borderUrgencyHook "magenta" -- $ withUrgencyHookC BorderUrgencyHook { urgencyBorderColor = "magenta" } urgencyConfig { suppressWhen = Never } $ withUrgencyHook (SpawnUrgencyHook "echo emit Urgency ") - $ defaultConfig + $ def { terminal = myTerm , modMask = mod4Mask , workspaces = workspaces0 @@ -169,7 +168,7 @@ myWSConfig = myGSConfig } pagerConfig :: PagerConfig -pagerConfig = defaultPagerConfig +pagerConfig = def { pc_font = myFont , pc_cellwidth = 64 --, pc_cellheight = 36 -- TODO automatically keep screen aspect @@ -182,13 +181,13 @@ pagerConfig = defaultPagerConfig where windowColors _ _ _ True _ = ("#ef4242","#ff2323") windowColors wsf m c u wf = do - let def = defaultWindowColors wsf m c u wf + let y = defaultWindowColors wsf m c u wf if m == False && wf == True - then ("#402020", snd def) - else def + then ("#402020", snd y) + else y wGSConfig :: GSConfig Window -wGSConfig = defaultGSConfig +wGSConfig = def { gs_cellheight = 20 , gs_cellwidth = 192 , gs_cellpadding = 5 -- cgit v1.2.3 From 98ca03d76bb63cd9ac429d541a91d4da7080107c Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 17 Feb 2016 15:01:59 +0100 Subject: l: add 5pkgs to default.nix --- lass/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/lass/default.nix b/lass/default.nix index 69b4abaac..377708c3e 100644 --- a/lass/default.nix +++ b/lass/default.nix @@ -3,5 +3,6 @@ _: imports = [ ../krebs ./3modules + ./5pkgs ]; } -- cgit v1.2.3 From 8f6892ef5b73230fab2fae58b969c00cd328d71f Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 18 Feb 2016 17:05:01 +0100 Subject: l 1 mors: enable elasticsearch --- lass/1systems/mors.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index a7f4ee5f8..9f492e2c6 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -137,6 +137,14 @@ rootPassword = "/mysql_rootPassword"; }; } + { + services.elasticsearch = { + enable = true; + plugins = [ + pkgs.elasticsearchPlugins.elasticsearch_kopf + ]; + }; + } ]; krebs.build.host = config.krebs.hosts.mors; -- cgit v1.2.3 From a60767166201066eea80b7f53fdcc2e623dc769a Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 19 Feb 2016 18:54:20 +0100 Subject: krebs.build.populate: allow overriding ssh --- krebs/3modules/build.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix index b8ea34ae2..08a7cd047 100644 --- a/krebs/3modules/build.nix +++ b/krebs/3modules/build.nix @@ -41,6 +41,8 @@ let #! /bin/sh set -eu + ssh=''${ssh-ssh} + verbose() { printf '%s%s\n' "$PS5$(printf ' %q' "$@")" >&2 "$@" @@ -48,7 +50,7 @@ let { printf 'PS5=%q%q\n' @ "$PS5" echo ${shell.escape git-script} - } | verbose ssh -p ${shell.escape target-port} \ + } | verbose $ssh -p ${shell.escape target-port} \ ${shell.escape "${target-user}@${target-host}"} -T unset tmpdir @@ -77,7 +79,7 @@ let ) (attrNames source-by-method.file)} \ --delete \ -vFrlptD \ - -e ${shell.escape "ssh -p ${target-port}"} \ + -e "$ssh -p ${shell.escape target-port}" \ ${shell.escape target-path}/ \ ${shell.escape "${target-user}@${target-host}:${target-path}"} ''; -- cgit v1.2.3 From 2ff36bad032df0900e13a3ec743b09064c3d07c6 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 19 Feb 2016 18:56:01 +0100 Subject: test infest-cac-centos7: use make install interface --- krebs/5pkgs/test/infest-cac-centos7/notes | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/krebs/5pkgs/test/infest-cac-centos7/notes b/krebs/5pkgs/test/infest-cac-centos7/notes index db80c0c6c..6bb0258a9 100755 --- a/krebs/5pkgs/test/infest-cac-centos7/notes +++ b/krebs/5pkgs/test/infest-cac-centos7/notes @@ -1,4 +1,4 @@ -# nix-shell -p gnumake jq openssh cac-api cac-panel +# nix-shell -p gnumake jq openssh cac-api cac-panel sshpass set -eufx # 2 secrets are required: @@ -99,7 +99,7 @@ defer "cac-api delete $id;$old_trapstr" mkdir -p shared/2configs/temp cac-api generatenetworking $id > \ shared/2configs/temp/networking.nix -# new temporary ssh key we will use to log in after infest +# new temporary ssh key we will use to log in after install ssh-keygen -f $krebs_ssh -N "" cp $retiolum_key $krebs_secrets/retiolum.rsa_key.priv # we override the directories for secrets and stockholm @@ -118,12 +118,12 @@ _: { } EOF -LOGNAME=shared make eval get=krebs.infest \ - target=derp system=test-centos7 filter=json \ - | sed -e "s#^ssh.*<<#cac-api ssh $id<<#" \ - -e "/^rsync/a -e 'cac-api ssh $