From fa8abf4a270596ec418f923216c57c95c50cf7c8 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Sat, 17 Oct 2015 23:51:02 +0200
Subject: m 3,5 tinc_graphs: use new tinc_graphs

---
 makefu/3modules/tinc_graphs.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'makefu/3modules')

diff --git a/makefu/3modules/tinc_graphs.nix b/makefu/3modules/tinc_graphs.nix
index 62d607527..ff2f55873 100644
--- a/makefu/3modules/tinc_graphs.nix
+++ b/makefu/3modules/tinc_graphs.nix
@@ -83,7 +83,9 @@ let
 
         ExecStartPre = pkgs.writeScript "tinc_graphs-init" ''
           #!/bin/sh
-          mkdir -p "${external_dir}" "${internal_dir}"
+          if ! test -e "${cfg.workingDir}/internal/index.html"; then
+            cp -fr "$(${pkgs.tinc_graphs}/bin/tincstats-static-dir)/internal/" "${internal_dir}"
+          fi
         '';
 
         ExecStart = "${pkgs.tinc_graphs}/bin/all-the-graphs";
@@ -94,10 +96,10 @@ let
           # this is needed because homedir is created with 700
           chmod 755  "${cfg.workingDir}"
         '';
+        PrivateTmp = "yes";
 
         User = "root"; # tinc cannot be queried as user,
                        #  seems to be a tinc-pre issue
-        privateTmp = true;
       };
     };
 
-- 
cgit v1.2.3


From 24271c6f6b4e730eccb238c28ca4b04eb70ede92 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Tue, 20 Oct 2015 18:11:30 +0200
Subject: m 3 bepasty-server.nix: init

---
 makefu/3modules/bepasty-server.nix | 160 +++++++++++++++++++++++++++++++++++++
 1 file changed, 160 insertions(+)
 create mode 100644 makefu/3modules/bepasty-server.nix

(limited to 'makefu/3modules')

diff --git a/makefu/3modules/bepasty-server.nix b/makefu/3modules/bepasty-server.nix
new file mode 100644
index 000000000..d970652a4
--- /dev/null
+++ b/makefu/3modules/bepasty-server.nix
@@ -0,0 +1,160 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  gunicorn = pkgs.pythonPackages.gunicorn;
+  bepasty = pkgs.pythonPackages.bepasty-server;
+  gevent = pkgs.pythonPackages.gevent;
+  python = pkgs.pythonPackages.python;
+  cfg = config.makefu.bepasty-server;
+
+  out = {
+    options.makefu.bepasty-server = api;
+    config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ;
+  };
+
+  api = {
+    enable = mkEnableOption "Bepasty Servers";
+    serveNginx = mkEnableOption "Serve Bepasty Servers with Nginx";
+
+    servers = mkOption {
+      type = with types; attrsOf optionSet;
+      options = singleton {
+        nginxCfg = mkOption {
+          # TODO use the correct type
+          type = with types; attrsOf unspecified;
+          description = ''
+            additional nginx configuration. see krebs.nginx for all options
+          '' ;
+        };
+        debug = mkOption {
+          type = types.bool;
+          description = ''
+            run server in debug mode
+          '';
+          default = false;
+        };
+
+        # TODO: assert secretKey
+        secretKey = mkOption {
+          type = types.str;
+          description = ''
+            server secret for safe session cookies, must be set.
+          '';
+        };
+
+        # we create a wsgi socket in $workDir/gunicorn-${name}.wsgi
+        workDir = mkOption {
+          type = types.str;
+          description = ''
+            Path to the working directory (used for sockets and pidfile).
+            Defaults to the users home directory. Must be accessible to nginx,
+            permissions will be set to 755
+          '';
+          default = config.users.extraUsers.bepasty.home;
+        };
+
+        dataDir = mkOption {
+          type = types.str;
+          description = ''
+            Defaults to the new users home dir which defaults to
+            /var/lib/bepasty-server/data
+            '';
+          default = "${config.users.extraUsers.bepasty.home}/data";
+        };
+
+        extraConfig = mkOption {
+          type = types.str;
+          default = "";
+          example = ''
+            PERMISSIONS = {
+              'myadminsecret': 'admin,list,create,read,delete',
+            }
+            MAX_ALLOWED_FILE_SIZE = 5 * 1000 * 1000
+            '';
+        };
+
+        defaultPermissions = mkOption {
+          type = types.str;
+          default = "list";
+        };
+
+      };
+      default = {};
+    };
+
+  };
+
+  imp = {
+    # Configures systemd services for each configured server
+    # environment.systemPackages = [ bepasty gunicorn gevent ];
+    systemd.services = mapAttrs' (name: server:
+      nameValuePair ("bepasty-server-${name}")
+        ({
+          description = "Bepasty Server ${name}";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          restartIfChanged = true;
+          environment = {
+            BEPASTY_CONFIG = "${server.workDir}/bepasty-${name}.conf";
+            PYTHONPATH= "${bepasty}/lib/${python.libPrefix}/site-packages:${gevent}/lib/${python.libPrefix}/site-packages";
+          };
+          serviceConfig = {
+            Type = "simple";
+            PrivateTmp = true;
+            ExecStartPre = pkgs.writeScript "bepasty-server.${name}-init" ''
+              #!/bin/sh
+              chmod 755 ${server.workDir}
+              mkdir -p ${server.dataDir}
+              cat > ${server.workDir}/bepasty-${name}.conf <<EOF
+              SITENAME="${name}"
+              STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
+              SECRET_KEY="${escapeShellArg server.secretKey}"
+              DEFAULT_PERMISSIONS="${server.defaultPermissions}"
+              ${server.extraConfig}
+              EOF
+            '';
+            Directory = "${bepasty}/lib/${python.libPrefix}/site-packages";
+            # we use Gunicorn to start a wsgi server
+            ExecStart = ''${gunicorn}/bin/gunicorn bepasty.wsgi --name ${name} \
+              --workers 3 --log-level=info \
+              --bind=unix:${server.workDir}/gunicorn-${name}.sock \
+              --pid ${server.workDir}/gunicorn-${name}.pid \
+              -k gevent
+            '';
+          };
+        })
+    ) cfg.servers;
+
+    users.extraUsers.bepasty = {
+      uid = 2796546855; #genid bepasty
+      home = "/var/lib/bepasty-server";
+      createHome = true;
+    };
+  };
+  nginx-imp = {
+    assertions = [ { assertion = config.krebs.nginx.enable;
+                      message = "krebs.nginx.enable must be true"; }];
+
+    krebs.nginx.servers = mapAttrs' (name: server:
+      nameValuePair("bepasty-server-${name}")
+      (server.nginxCfg // {
+        extraConfig = ''
+          client_max_body_size 32M;
+          '';
+        locations = [
+          (nameValuePair ("/")
+          (''
+            proxy_set_header Host $http_host;
+            proxy_pass http://unix:${server.workDir}/gunicorn-${name}.sock;
+          ''))
+          (nameValuePair ("/static/")
+          (''
+            alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/;
+          ''))
+          ];
+      })
+    ) cfg.servers ;
+  };
+in
+out
-- 
cgit v1.2.3


From 90683369be019254c2b86bfc4ca3c8de3b441ff0 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 21 Oct 2015 09:11:01 +0200
Subject: m 3 bepasty-server: fix escape

---
 makefu/3modules/bepasty-server.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'makefu/3modules')

diff --git a/makefu/3modules/bepasty-server.nix b/makefu/3modules/bepasty-server.nix
index d970652a4..bc7158d8d 100644
--- a/makefu/3modules/bepasty-server.nix
+++ b/makefu/3modules/bepasty-server.nix
@@ -104,12 +104,12 @@ let
             PrivateTmp = true;
             ExecStartPre = pkgs.writeScript "bepasty-server.${name}-init" ''
               #!/bin/sh
-              chmod 755 ${server.workDir}
-              mkdir -p ${server.dataDir}
+              chmod 755 "${server.workDir}"
+              mkdir -p "${server.dataDir}"
               cat > ${server.workDir}/bepasty-${name}.conf <<EOF
               SITENAME="${name}"
               STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
-              SECRET_KEY="${escapeShellArg server.secretKey}"
+              SECRET_KEY="${escape server.secretKey}"
               DEFAULT_PERMISSIONS="${server.defaultPermissions}"
               ${server.extraConfig}
               EOF
-- 
cgit v1.2.3


From ba4708f2638722c8d18e560847946fdb5c87484d Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 21 Oct 2015 17:13:12 +0200
Subject: m 3 tinc_graphs: new api for nginx

---
 makefu/3modules/tinc_graphs.nix | 51 ++++++++++++++++++++++++-----------------
 1 file changed, 30 insertions(+), 21 deletions(-)

(limited to 'makefu/3modules')

diff --git a/makefu/3modules/tinc_graphs.nix b/makefu/3modules/tinc_graphs.nix
index ff2f55873..42b08d62a 100644
--- a/makefu/3modules/tinc_graphs.nix
+++ b/makefu/3modules/tinc_graphs.nix
@@ -20,26 +20,37 @@ let
       default = "${pkgs.geolite-legacy}/share/GeoIP/GeoIPCity.dat";
     };
 
-    krebsNginx = {
-      # configure krebs nginx to serve the new graphs
-      enable = mkEnableOption "tinc_graphs nginx";
+    nginx = {
+      enable = mkEnableOption "enable tinc_graphs to be served with nginx";
+
+      anonymous = {
+        server-names = mkOption {
+          type = with types; listOf str;
+          description = "hostnames which serve anonymous graphs";
+          default = [ "graphs.${config.krebs.build.host.name}" ];
+        };
+
+        listen = mkOption {
+          type = with types; listOf str;
+          description = "listen address for anonymous graphs";
+          default = [ "80" ];
+        };
 
-      hostnames_complete = mkOption {
-        #TODO: this is not a secure way to serve these graphs,better listen to
-        #      the correct interface, krebs.nginx does not support this yet
-
-        type = with types; listOf str;
-        description = "hostname which serves complete graphs";
-        default = [ "graphs.${config.krebs.build.host.name}" ];
       };
 
-      hostnames_anonymous = mkOption {
-        type = with types; listOf str;
-        description = ''
-          hostname which serves anonymous graphs
-          must be different from hostname_complete
-        '';
-        default = [ "anongraphs.${config.krebs.build.host.name}" ];
+      complete = {
+        server-names = mkOption {
+          type = with types; listOf str;
+          description = "hostname which serves complete graphs";
+          default = [ "graphs.${config.krebs.build.host.name}" ];
+        };
+
+        listen = mkOption {
+          type = with types; listOf str;
+          description = "listen address for complete graphs";
+          default = [ "127.0.0.1:80" ];
+        };
+
       };
     };
 
@@ -110,8 +121,7 @@ let
     };
 
     krebs.nginx.servers = mkIf cfg.krebsNginx.enable {
-      tinc_graphs_complete = {
-        server-names = cfg.krebsNginx.hostnames_complete;
+      tinc_graphs_complete = cfg.nginx.complete {
         locations = [
           (nameValuePair "/" ''
             autoindex on;
@@ -119,8 +129,7 @@ let
           '')
         ];
       };
-      tinc_graphs_anonymous = {
-        server-names = cfg.krebsNginx.hostnames_anonymous;
+      tinc_graphs_anonymous = cfg.nginx.anonymous // {
         locations = [
           (nameValuePair "/" ''
             autoindex on;
-- 
cgit v1.2.3


From 49b8d341f64b039448a21feeaed777573574549d Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 21 Oct 2015 18:47:26 +0200
Subject: m 3 tinc_graphs: merge instead of override nginx config

---
 makefu/3modules/tinc_graphs.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

(limited to 'makefu/3modules')

diff --git a/makefu/3modules/tinc_graphs.nix b/makefu/3modules/tinc_graphs.nix
index 42b08d62a..1f87f00cc 100644
--- a/makefu/3modules/tinc_graphs.nix
+++ b/makefu/3modules/tinc_graphs.nix
@@ -31,6 +31,7 @@ let
         };
 
         listen = mkOption {
+          # use the type of the nginx listen option
           type = with types; listOf str;
           description = "listen address for anonymous graphs";
           default = [ "80" ];
@@ -120,23 +121,23 @@ let
       createHome = true;
     };
 
-    krebs.nginx.servers = mkIf cfg.krebsNginx.enable {
-      tinc_graphs_complete = cfg.nginx.complete {
+    krebs.nginx.servers = mkIf cfg.nginx.enable {
+      tinc_graphs_complete = mkMerge [ cfg.nginx.complete  {
         locations = [
           (nameValuePair "/" ''
             autoindex on;
             root ${internal_dir};
           '')
         ];
-      };
-      tinc_graphs_anonymous = cfg.nginx.anonymous // {
+      }] ;
+      tinc_graphs_anonymous = mkMerge [ cfg.nginx.anonymous {
         locations = [
           (nameValuePair "/" ''
             autoindex on;
             root ${external_dir};
           '')
         ];
-      };
+      }];
     };
   };
 
-- 
cgit v1.2.3


From 34fd2ceb299d55b5edff124f86adf0883101197c Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 21 Oct 2015 18:48:13 +0200
Subject: m 3 bepasty-server: finishing touches

---
 makefu/3modules/bepasty-server.nix | 48 +++++++++++++++++++++-----------------
 makefu/3modules/default.nix        |  1 +
 2 files changed, 27 insertions(+), 22 deletions(-)

(limited to 'makefu/3modules')

diff --git a/makefu/3modules/bepasty-server.nix b/makefu/3modules/bepasty-server.nix
index bc7158d8d..ff32eea60 100644
--- a/makefu/3modules/bepasty-server.nix
+++ b/makefu/3modules/bepasty-server.nix
@@ -6,10 +6,10 @@ let
   bepasty = pkgs.pythonPackages.bepasty-server;
   gevent = pkgs.pythonPackages.gevent;
   python = pkgs.pythonPackages.python;
-  cfg = config.makefu.bepasty-server;
+  cfg = config.krebs.bepasty;
 
   out = {
-    options.makefu.bepasty-server = api;
+    options.krebs.bepasty = api;
     config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ;
   };
 
@@ -20,27 +20,20 @@ let
     servers = mkOption {
       type = with types; attrsOf optionSet;
       options = singleton {
-        nginxCfg = mkOption {
+        nginx = mkOption {
           # TODO use the correct type
           type = with types; attrsOf unspecified;
           description = ''
             additional nginx configuration. see krebs.nginx for all options
           '' ;
         };
-        debug = mkOption {
-          type = types.bool;
-          description = ''
-            run server in debug mode
-          '';
-          default = false;
-        };
 
-        # TODO: assert secretKey
         secretKey = mkOption {
           type = types.str;
           description = ''
             server secret for safe session cookies, must be set.
           '';
+          default = "";
         };
 
         # we create a wsgi socket in $workDir/gunicorn-${name}.wsgi
@@ -66,6 +59,7 @@ let
         extraConfig = mkOption {
           type = types.str;
           default = "";
+          # TODO configure permissions in separate
           example = ''
             PERMISSIONS = {
               'myadminsecret': 'admin,list,create,read,delete',
@@ -75,8 +69,13 @@ let
         };
 
         defaultPermissions = mkOption {
+          # TODO: listOf str
           type = types.str;
-          default = "list";
+          description = ''
+          default permissions for all unauthenticated users.
+          '';
+          example = "read,create,delete";
+          default = "read";
         };
 
       };
@@ -102,21 +101,22 @@ let
           serviceConfig = {
             Type = "simple";
             PrivateTmp = true;
-            ExecStartPre = pkgs.writeScript "bepasty-server.${name}-init" ''
+
+            ExecStartPre = assert server.secretKey != ""; pkgs.writeScript "bepasty-server.${name}-init" ''
               #!/bin/sh
-              chmod 755 "${server.workDir}"
-              mkdir -p "${server.dataDir}"
-              cat > ${server.workDir}/bepasty-${name}.conf <<EOF
+              mkdir -p "${server.dataDir}" "${server.workDir}"
+              chown bepasty:bepasty "${server.workDir}" "${server.dataDir}"
+              cat > "${server.workDir}/bepasty-${name}.conf" <<EOF
               SITENAME="${name}"
               STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
-              SECRET_KEY="${escape server.secretKey}"
+              SECRET_KEY="${server.secretKey}"
               DEFAULT_PERMISSIONS="${server.defaultPermissions}"
               ${server.extraConfig}
               EOF
             '';
-            Directory = "${bepasty}/lib/${python.libPrefix}/site-packages";
-            # we use Gunicorn to start a wsgi server
             ExecStart = ''${gunicorn}/bin/gunicorn bepasty.wsgi --name ${name} \
+              -u bepasty \
+              -g bepasty \
               --workers 3 --log-level=info \
               --bind=unix:${server.workDir}/gunicorn-${name}.sock \
               --pid ${server.workDir}/gunicorn-${name}.pid \
@@ -128,17 +128,21 @@ let
 
     users.extraUsers.bepasty = {
       uid = 2796546855; #genid bepasty
+      group = "bepasty";
       home = "/var/lib/bepasty-server";
-      createHome = true;
+    };
+    users.extraGroups.bepasty = {
+      gid = 2796546855; #genid bepasty
     };
   };
+
   nginx-imp = {
     assertions = [ { assertion = config.krebs.nginx.enable;
                       message = "krebs.nginx.enable must be true"; }];
 
     krebs.nginx.servers = mapAttrs' (name: server:
       nameValuePair("bepasty-server-${name}")
-      (server.nginxCfg // {
+      (mkMerge [ server.nginx  {
         extraConfig = ''
           client_max_body_size 32M;
           '';
@@ -153,7 +157,7 @@ let
             alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/;
           ''))
           ];
-      })
+      }])
     ) cfg.servers ;
   };
 in
diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix
index 598365c39..3ac325b29 100644
--- a/makefu/3modules/default.nix
+++ b/makefu/3modules/default.nix
@@ -3,6 +3,7 @@ _:
 {
   imports = [
     ./tinc_graphs.nix
+    ./bepasty-server.nix
   ];
 }
 
-- 
cgit v1.2.3


From 9be59a04001698e8e34ae4e2a49e2dea920765b1 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 22 Oct 2015 15:26:54 +0200
Subject: krebs 3 modules: bepasty-server is a krebs module

---
 makefu/3modules/bepasty-server.nix | 164 -------------------------------------
 makefu/3modules/default.nix        |   1 -
 2 files changed, 165 deletions(-)
 delete mode 100644 makefu/3modules/bepasty-server.nix

(limited to 'makefu/3modules')

diff --git a/makefu/3modules/bepasty-server.nix b/makefu/3modules/bepasty-server.nix
deleted file mode 100644
index ff32eea60..000000000
--- a/makefu/3modules/bepasty-server.nix
+++ /dev/null
@@ -1,164 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-let
-  gunicorn = pkgs.pythonPackages.gunicorn;
-  bepasty = pkgs.pythonPackages.bepasty-server;
-  gevent = pkgs.pythonPackages.gevent;
-  python = pkgs.pythonPackages.python;
-  cfg = config.krebs.bepasty;
-
-  out = {
-    options.krebs.bepasty = api;
-    config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ;
-  };
-
-  api = {
-    enable = mkEnableOption "Bepasty Servers";
-    serveNginx = mkEnableOption "Serve Bepasty Servers with Nginx";
-
-    servers = mkOption {
-      type = with types; attrsOf optionSet;
-      options = singleton {
-        nginx = mkOption {
-          # TODO use the correct type
-          type = with types; attrsOf unspecified;
-          description = ''
-            additional nginx configuration. see krebs.nginx for all options
-          '' ;
-        };
-
-        secretKey = mkOption {
-          type = types.str;
-          description = ''
-            server secret for safe session cookies, must be set.
-          '';
-          default = "";
-        };
-
-        # we create a wsgi socket in $workDir/gunicorn-${name}.wsgi
-        workDir = mkOption {
-          type = types.str;
-          description = ''
-            Path to the working directory (used for sockets and pidfile).
-            Defaults to the users home directory. Must be accessible to nginx,
-            permissions will be set to 755
-          '';
-          default = config.users.extraUsers.bepasty.home;
-        };
-
-        dataDir = mkOption {
-          type = types.str;
-          description = ''
-            Defaults to the new users home dir which defaults to
-            /var/lib/bepasty-server/data
-            '';
-          default = "${config.users.extraUsers.bepasty.home}/data";
-        };
-
-        extraConfig = mkOption {
-          type = types.str;
-          default = "";
-          # TODO configure permissions in separate
-          example = ''
-            PERMISSIONS = {
-              'myadminsecret': 'admin,list,create,read,delete',
-            }
-            MAX_ALLOWED_FILE_SIZE = 5 * 1000 * 1000
-            '';
-        };
-
-        defaultPermissions = mkOption {
-          # TODO: listOf str
-          type = types.str;
-          description = ''
-          default permissions for all unauthenticated users.
-          '';
-          example = "read,create,delete";
-          default = "read";
-        };
-
-      };
-      default = {};
-    };
-
-  };
-
-  imp = {
-    # Configures systemd services for each configured server
-    # environment.systemPackages = [ bepasty gunicorn gevent ];
-    systemd.services = mapAttrs' (name: server:
-      nameValuePair ("bepasty-server-${name}")
-        ({
-          description = "Bepasty Server ${name}";
-          wantedBy = [ "multi-user.target" ];
-          after = [ "network.target" ];
-          restartIfChanged = true;
-          environment = {
-            BEPASTY_CONFIG = "${server.workDir}/bepasty-${name}.conf";
-            PYTHONPATH= "${bepasty}/lib/${python.libPrefix}/site-packages:${gevent}/lib/${python.libPrefix}/site-packages";
-          };
-          serviceConfig = {
-            Type = "simple";
-            PrivateTmp = true;
-
-            ExecStartPre = assert server.secretKey != ""; pkgs.writeScript "bepasty-server.${name}-init" ''
-              #!/bin/sh
-              mkdir -p "${server.dataDir}" "${server.workDir}"
-              chown bepasty:bepasty "${server.workDir}" "${server.dataDir}"
-              cat > "${server.workDir}/bepasty-${name}.conf" <<EOF
-              SITENAME="${name}"
-              STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
-              SECRET_KEY="${server.secretKey}"
-              DEFAULT_PERMISSIONS="${server.defaultPermissions}"
-              ${server.extraConfig}
-              EOF
-            '';
-            ExecStart = ''${gunicorn}/bin/gunicorn bepasty.wsgi --name ${name} \
-              -u bepasty \
-              -g bepasty \
-              --workers 3 --log-level=info \
-              --bind=unix:${server.workDir}/gunicorn-${name}.sock \
-              --pid ${server.workDir}/gunicorn-${name}.pid \
-              -k gevent
-            '';
-          };
-        })
-    ) cfg.servers;
-
-    users.extraUsers.bepasty = {
-      uid = 2796546855; #genid bepasty
-      group = "bepasty";
-      home = "/var/lib/bepasty-server";
-    };
-    users.extraGroups.bepasty = {
-      gid = 2796546855; #genid bepasty
-    };
-  };
-
-  nginx-imp = {
-    assertions = [ { assertion = config.krebs.nginx.enable;
-                      message = "krebs.nginx.enable must be true"; }];
-
-    krebs.nginx.servers = mapAttrs' (name: server:
-      nameValuePair("bepasty-server-${name}")
-      (mkMerge [ server.nginx  {
-        extraConfig = ''
-          client_max_body_size 32M;
-          '';
-        locations = [
-          (nameValuePair ("/")
-          (''
-            proxy_set_header Host $http_host;
-            proxy_pass http://unix:${server.workDir}/gunicorn-${name}.sock;
-          ''))
-          (nameValuePair ("/static/")
-          (''
-            alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/;
-          ''))
-          ];
-      }])
-    ) cfg.servers ;
-  };
-in
-out
diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix
index 3ac325b29..598365c39 100644
--- a/makefu/3modules/default.nix
+++ b/makefu/3modules/default.nix
@@ -3,7 +3,6 @@ _:
 {
   imports = [
     ./tinc_graphs.nix
-    ./bepasty-server.nix
   ];
 }
 
-- 
cgit v1.2.3


From 9bb3069f69ed801d98034a2effcb4d88f279a92f Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 22 Oct 2015 15:33:05 +0200
Subject: krebs 3 tinc_graphs: mv from makefu 3 tinc_graphs

---
 makefu/3modules/default.nix     |   1 -
 makefu/3modules/tinc_graphs.nix | 145 ----------------------------------------
 2 files changed, 146 deletions(-)
 delete mode 100644 makefu/3modules/tinc_graphs.nix

(limited to 'makefu/3modules')

diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix
index 598365c39..a8a1f69d0 100644
--- a/makefu/3modules/default.nix
+++ b/makefu/3modules/default.nix
@@ -2,7 +2,6 @@ _:
 
 {
   imports = [
-    ./tinc_graphs.nix
   ];
 }
 
diff --git a/makefu/3modules/tinc_graphs.nix b/makefu/3modules/tinc_graphs.nix
deleted file mode 100644
index 1f87f00cc..000000000
--- a/makefu/3modules/tinc_graphs.nix
+++ /dev/null
@@ -1,145 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-let
-  cfg = config.makefu.tinc_graphs;
-  internal_dir = "${cfg.workingDir}/internal";
-  external_dir = "${cfg.workingDir}/external";
-
-  out = {
-    options.makefu.tinc_graphs = api;
-    config = mkIf cfg.enable imp ;
-  };
-
-  api = {
-    enable = mkEnableOption "tinc graphs";
-
-    geodbPath = mkOption {
-      type = types.str;
-      description = "Path to geocitydb, defaults to geolite-legacy";
-      default = "${pkgs.geolite-legacy}/share/GeoIP/GeoIPCity.dat";
-    };
-
-    nginx = {
-      enable = mkEnableOption "enable tinc_graphs to be served with nginx";
-
-      anonymous = {
-        server-names = mkOption {
-          type = with types; listOf str;
-          description = "hostnames which serve anonymous graphs";
-          default = [ "graphs.${config.krebs.build.host.name}" ];
-        };
-
-        listen = mkOption {
-          # use the type of the nginx listen option
-          type = with types; listOf str;
-          description = "listen address for anonymous graphs";
-          default = [ "80" ];
-        };
-
-      };
-
-      complete = {
-        server-names = mkOption {
-          type = with types; listOf str;
-          description = "hostname which serves complete graphs";
-          default = [ "graphs.${config.krebs.build.host.name}" ];
-        };
-
-        listen = mkOption {
-          type = with types; listOf str;
-          description = "listen address for complete graphs";
-          default = [ "127.0.0.1:80" ];
-        };
-
-      };
-    };
-
-    workingDir = mkOption {
-      type = types.str;
-      description = ''
-        Path to working dir, will create interal and external/.
-        Defaults to the new users home dir which defaults to
-        /var/cache/tinc_graphs'';
-      default = config.users.extraUsers.tinc_graphs.home;
-    };
-
-    timerConfig = mkOption {
-      type = with types; attrsOf str;
-      default = {
-        OnCalendar = "*:0/15";
-      };
-    };
-  };
-
-  imp = {
-    environment.systemPackages = [ pkgs.tinc_graphs];
-    systemd.timers.tinc_graphs = {
-      description = "Build Tinc Graphs via via timer";
-      wantedBy = [ "timers.target"];
-      timerConfig = cfg.timerConfig;
-    };
-    systemd.services.tinc_graphs = {
-      description = "Build Tinc Graphs";
-      environment = {
-        EXTERNAL_FOLDER = external_dir;
-        INTERNAL_FOLDER = internal_dir;
-        GEODB = cfg.geodbPath;
-        TINC_HOSTPATH=config.krebs.retiolum.hosts;
-      };
-
-      restartIfChanged = true;
-
-      serviceConfig = {
-        Type = "simple";
-
-        ExecStartPre = pkgs.writeScript "tinc_graphs-init" ''
-          #!/bin/sh
-          if ! test -e "${cfg.workingDir}/internal/index.html"; then
-            cp -fr "$(${pkgs.tinc_graphs}/bin/tincstats-static-dir)/internal/" "${internal_dir}"
-          fi
-        '';
-
-        ExecStart = "${pkgs.tinc_graphs}/bin/all-the-graphs";
-
-        ExecStartPost = pkgs.writeScript "tinc_graphs-post" ''
-          #!/bin/sh
-          # TODO: this may break if workingDir is set to something stupid
-          # this is needed because homedir is created with 700
-          chmod 755  "${cfg.workingDir}"
-        '';
-        PrivateTmp = "yes";
-
-        User = "root"; # tinc cannot be queried as user,
-                       #  seems to be a tinc-pre issue
-      };
-    };
-
-    users.extraUsers.tinc_graphs = {
-      uid = 3925439960; #genid tinc_graphs
-      home = "/var/spool/tinc_graphs";
-      createHome = true;
-    };
-
-    krebs.nginx.servers = mkIf cfg.nginx.enable {
-      tinc_graphs_complete = mkMerge [ cfg.nginx.complete  {
-        locations = [
-          (nameValuePair "/" ''
-            autoindex on;
-            root ${internal_dir};
-          '')
-        ];
-      }] ;
-      tinc_graphs_anonymous = mkMerge [ cfg.nginx.anonymous {
-        locations = [
-          (nameValuePair "/" ''
-            autoindex on;
-            root ${external_dir};
-          '')
-        ];
-      }];
-    };
-  };
-
-in
-out
-- 
cgit v1.2.3