From 271c7843120dc079c6507fc2d7d08fff9105e3a5 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 25 Feb 2016 13:45:23 +0100
Subject: tv: sudoers env_keep += SSH_CLIENT

---
 tv/2configs/default.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'tv/2configs/default.nix')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 5a1e90bc4..9b83997bb 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -49,6 +49,7 @@ with config.krebs.lib;
     }
     {
       security.sudo.extraConfig = ''
+        Defaults env_keep+="SSH_CLIENT"
         Defaults mailto="${config.krebs.users.tv.mail}"
         Defaults !lecture
       '';
-- 
cgit v1.2.3


From cc395214f58e4ac1d95e9855d4cf4784fa75d17e Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 12:39:29 +0100
Subject: tv nixpkgs: 77f8f35 -> 40c586b

---
 tv/2configs/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

(limited to 'tv/2configs/default.nix')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 9b83997bb..02b3b61cf 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -14,8 +14,7 @@ with config.krebs.lib;
       stockholm = "/home/tv/stockholm";
       nixpkgs = {
         url = https://github.com/NixOS/nixpkgs;
-        rev = "77f8f35d57618c1ba456d968524f2fb2c3448295";
-        dev = "/home/tv/nixpkgs";
+        rev = "40c586b7ce2c559374df435f46d673baf711c543";
       };
     } // optionalAttrs config.krebs.build.host.secure {
       secrets-master = "/home/tv/secrets/master";
-- 
cgit v1.2.3


From 7cff3c0650acc6c1c07d578faa9bb35ff61266bc Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 13:10:21 +0100
Subject: tv sendmail: setuid in exim-*

---
 tv/2configs/default.nix | 6 ------
 1 file changed, 6 deletions(-)

(limited to 'tv/2configs/default.nix')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 02b3b61cf..1e0da8da4 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -177,12 +177,6 @@ with config.krebs.lib;
       tv.iptables.input-internet-accept-new-tcp = singleton "ssh";
     }
 
-    {
-      # TODO: exim
-      security.setuidPrograms = [
-        "sendmail"  # for sudo
-      ];
-    }
     {
       environment.systemPackages = [
         pkgs.get
-- 
cgit v1.2.3


From 35d7bc99463590c54e55b39e2bca5cb9083e9e76 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 27 Feb 2016 15:13:44 +0100
Subject: tv: nix.requireSignedBinaryCaches = true

---
 tv/2configs/default.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

(limited to 'tv/2configs/default.nix')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 1e0da8da4..0a3e40a5c 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -54,15 +54,14 @@ with config.krebs.lib;
       '';
       time.timeZone = "Europe/Berlin";
     }
+
     {
       # TODO check if both are required:
       nix.chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ];
 
-      nix.trustedBinaryCaches = [
-        "https://cache.nixos.org"
-        "http://cache.nixos.org"
-        "http://hydra.nixos.org"
-      ];
+      nix.requireSignedBinaryCaches = true;
+
+      nix.binaryCaches = ["https://cache.nixos.org"];
 
       nix.useChroot = true;
     }
-- 
cgit v1.2.3