Merge remote-tracking branch 'prism/master'

33 files changed, 406 insertions, 172 deletions

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index a38d2b22..9af42acc 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -28,6 +28,7 @@ let
       ./on-failure.nix
       ./os-release.nix
       ./per-user.nix
+      ./power-action.nix
       ./Reaktor.nix
       ./realwallpaper.nix
       ./retiolum-bootstrap.nix
@@ -91,6 +92,7 @@ let
   imp = lib.mkMerge [
     { krebs = import ./lass   { inherit config lib; }; }
     { krebs = import ./makefu { inherit config lib; }; }
+    { krebs = import ./mv     { inherit config lib; }; }
     { krebs = import ./shared { inherit config lib; }; }
     { krebs = import ./tv     { inherit config lib; }; }
     {
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index aba6ee0b..cfe2e5f0 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -2,6 +2,7 @@
 
 with config.krebs.lib;
 let
+  indent = replaceChars ["\n"] ["\n  "];
   cfg = config.krebs.exim-smarthost;
 
   out = {
@@ -12,6 +13,11 @@ let
   api = {
     enable = mkEnableOption "krebs.exim-smarthost";
 
+    authenticators = mkOption {
+      type = types.attrsOf types.str;
+      default = {};
+    };
+
     dkim = mkOption {
       type = types.listOf (types.submodule ({ config, ... }: {
         options = {
@@ -80,6 +86,16 @@ let
       default = [];
     };
 
+    ssl_cert = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+    };
+
+    ssl_key = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+    };
+
     system-aliases = mkOption {
       type = types.listOf (types.submodule ({
         options = {
@@ -136,7 +152,9 @@ let
         syslog_timestamp = false
         syslog_duplication = false
 
-        tls_advertise_hosts =
+        ${optionalString (cfg.ssl_cert != null) "tls_certificate = ${cfg.ssl_cert}"}
+        ${optionalString (cfg.ssl_key != null) "tls_privatekey = ${cfg.ssl_key}"}
+        tls_advertise_hosts =${optionalString (cfg.ssl_cert != null) " *"}
 
         begin acl
 
@@ -257,6 +275,10 @@ let
 
         begin rewrite
         begin authenticators
+        ${concatStringsSep "\n" (mapAttrsToList (name: text: ''
+        ${name}:
+          ${indent text}
+        '') cfg.authenticators)}
       '';
     };
   };
diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix
new file mode 100644
index 00000000..dc47d898
--- /dev/null
+++ b/krebs/3modules/mv/default.nix
@@ -0,0 +1,41 @@
+{ config, ... }:
+
+with config.krebs.lib;
+
+{
+  hosts = mapAttrs (_: setAttr "owner" config.krebs.users.mv) {
+    stro = {
+      cores = 4;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.111.111";
+          ip6.addr = "42:0:0:0:0:0:111:111";
+          aliases = [
+            "stro.r"
+            "cgit.stro.r"
+            "stro.retiolum"
+            "cgit.stro.retiolum"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEA0vIzLyoetOyi3R7qOh3gjSvUVjPEdqCvd0NEevDCIhhFy0nIbZ/b
+            vnuk3EUeTb6e384J8fKB4agig0JeR3JjtDvtjy5g9Cdy2nrU71w8wqU0etmv2PTb
+            FjbCFfeBXn0N3U7gXwjZGCvjAXa1a4jGb4R2iYBYGG3aY4reCN8B8Ah81h+S0oLg
+            ZJJfaBmWM5vNRFEI5X4CLaVnwtsoZuXIjYStgNn/9Mg/Y6NQS0H0H+HFeyhigAqG
+            oYGqNar/2QqPU176V/FwrD30F3qJV1uyzuPta7hmdfOxqYjZ/jqdPSRYtlunYYcq
+            XbH5oYmzO9NEeVWzjdac/DiV2OP8HufoYwIDAQAB
+            -----END RSA PUBLIC KEY-----
+          '';
+        };
+      };
+      ssh.privkey.path = <secrets/ssh.ed25519>;
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro";
+    };
+  };
+  users = {
+    mv = {
+      mail = "mv@stro.r";
+      pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDfMqkfXsGRaXJ86Pi5svAx4508ij5kc4cMLGwr1CLvFI5G7EHggiHMZYooibmkZimBF1PvLM1lOdoptJ4nSmc3UGuQaeV9BpZ1dNXexc8wOmVPKzAHYZG/2upcV/xVZQ9lk3UOmDym6fDUXThMx4nXdhOjScgWpKp7+0N3JRCf2UHusZjWFGlhE9l4irLFHCwlZeBQ16DNF4fc03vsfZBB1ZrGGZlaVpkcY+FTC3sm8R0iF5QGaq8PgltJoCNnp3L1g3Yn7Elva7kCHjZfJC1pu5icV8vZMNptPn1b10gPsNwb302FCjvZohzRcMo39L2gwdNWQmflYfYk+NPY9EgqkLtSvZJywYu8oTVLeYBAp0ZGzJR4+uIH9at/WQF499HFMxpF4uwYiQweUcPiHrrOqI5zLQoOvqh9Jv0UMsnFynNrszbCTgwzeW8bcvv8ILcjE9of8GXRCrlIMvt7Z9q8xrb5j1RhKscvusyyNOAL+HMZl6jgSxUBDtzRqPZ62QHJsBEBdRXdJRQLGeHNW9kGPrh/tiKGucuT3/HZC+2Rcemxt3RVT60+lHkghrMLi0/VOWBUKL9J94UK5xIE4Gb3RTW9DcNK53U4ql+N4ORSSEuhk3Rqzx3Bzv7AXpLKQCFKdB7tjxzGN7sCQM3PBUUo6Tk0VG2cIKOjzTRnDJlb7Q== mv@stro";
+    };
+  };
+}
diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix
index 25dfb5d6..214f5501 100644
--- a/krebs/3modules/nginx.nix
+++ b/krebs/3modules/nginx.nix
@@ -31,12 +31,10 @@ let
         options = {
           server-names = mkOption {
             type = with types; listOf str;
-            # TODO use identity
-            default = [
-              "${config.networking.hostName}"
-              "${config.networking.hostName}.r"
-              "${config.networking.hostName}.retiolum"
-            ];
+            default =
+              [config.krebs.build.host.name] ++
+              concatMap (getAttr "aliases")
+                        (attrValues config.krebs.build.host.nets);
           };
           listen = mkOption {
             type = with types; either str (listOf str);
diff --git a/lass/3modules/power-action.nix b/krebs/3modules/power-action.nix
index 30875c9a..4c2533eb 100644
--- a/lass/3modules/power-action.nix
+++ b/krebs/3modules/power-action.nix
@@ -3,10 +3,10 @@
 with config.krebs.lib;
 
 let
-  cfg = config.lass.power-action;
+  cfg = config.krebs.power-action;
 
   out = {
-    options.lass.power-action = api;
+    options.krebs.power-action = api;
     config = lib.mkIf cfg.enable imp;
   };
 
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index d04f1cab..a933cbdd 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -418,7 +418,7 @@ with config.krebs.lib;
     dv = {
       mail = "dv@alnus.r";
     };
-    mv = {
+    mv-cd = {
       mail = "mv@cd.r";
       pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod";
     };
diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix
index 29674833..f62c033b 100644
--- a/krebs/4lib/default.nix
+++ b/krebs/4lib/default.nix
@@ -33,6 +33,7 @@ let out = rec {
   dir.has-default-nix = path: pathExists (path + "/default.nix");
 
   genid = import ./genid.nix { lib = lib // out; };
+  genid_signed = x: ((genid x) + 16777216) / 2;
   git = import ./git.nix { lib = lib // out; };
   shell = import ./shell.nix { inherit lib; };
   tree = import ./tree.nix { inherit lib; };
diff --git a/krebs/5pkgs/exim/default.nix b/krebs/5pkgs/exim/default.nix
index 0918e308..83597055 100644
--- a/krebs/5pkgs/exim/default.nix
+++ b/krebs/5pkgs/exim/default.nix
@@ -1,4 +1,4 @@
-{ coreutils, fetchurl, db, openssl, pcre, perl, pkgconfig, stdenv }:
+{ coreutils, fetchurl, db, openssl, pam, pcre, perl, pkgconfig, stdenv }:
 
 stdenv.mkDerivation rec {
   name = "exim-4.87";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1jbxn13shq90kpn0s73qpjnx5xm8jrpwhcwwgqw5s6sdzw6iwsbl";
   };
 
-  buildInputs = [ coreutils db openssl pcre perl pkgconfig ];
+  buildInputs = [ coreutils db openssl pam pcre perl pkgconfig ];
 
   preBuild = ''
     sed '
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
       s:^# \(SUPPORT_TLS\)=.*:\1=yes:
       s:^# \(USE_OPENSSL_PC=openssl\)$:\1:
       s:^# \(LOG_FILE_PATH=syslog\)$:\1:
+      s:^# \(SUPPORT_PAM\)=.*:\1=yes\nEXTRALIBS=-lpam:
       s:^# \(HAVE_IPV6=yes\)$:\1:
       s:^# \(CHOWN_COMMAND\)=.*:\1=${coreutils}/bin/chown:
       s:^# \(CHGRP_COMMAND\)=.*:\1=${coreutils}/bin/chgrp:
diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix
index 5f161d73..53026a6f 100644
--- a/lass/1systems/helios.nix
+++ b/lass/1systems/helios.nix
@@ -58,7 +58,7 @@ with config.krebs.lib;
     #  };
     #}
     {
-      lass.power-action.battery = "BAT1";
+      krebs.power-action.battery = "BAT1";
     }
   ];
 
diff --git a/lass/2configs/buildbot-standalone.nix b/lass/2configs/buildbot-standalone.nix
index 5afb2368..7c7693ab 100644
--- a/lass/2configs/buildbot-standalone.nix
+++ b/lass/2configs/buildbot-standalone.nix
@@ -3,8 +3,13 @@
 with config.krebs.lib;
 
 let
+  sshHostConfig = pkgs.writeText "ssh-config" ''
+    ControlMaster auto
+    ControlPath /tmp/%u_sshmux_%r@%h:%p
+    ControlPersist 4h
+  '';
   sshWrapper = pkgs.writeDash "ssh-wrapper" ''
-    ${pkgs.openssh}/bin/ssh -i ${shell.escape config.lass.build-ssh-privkey.path} "$@"
+    ${pkgs.openssh}/bin/ssh -F ${sshHostConfig} -i ${shell.escape config.lass.build-ssh-privkey.path} "$@"
   '';
 
 in {
diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix
index cf9b631c..597d2072 100644
--- a/lass/2configs/downloading.nix
+++ b/lass/2configs/downloading.nix
@@ -5,9 +5,6 @@ with config.krebs.lib;
 let
   rpc-password = import <secrets/transmission-pw>;
 in {
-  imports = [
-    ../3modules/folderPerms.nix
-  ];
 
   users.extraUsers = {
     download = {
@@ -64,15 +61,4 @@ in {
       { predicate = "-p udp --dport 51413"; target = "ACCEPT"; }
     ];
   };
-
-  lass.folderPerms = {
-    enable = true;
-    permissions = [
-      {
-        path = "/var/download";
-        permission = "775";
-        owner = "transmission:download";
-      }
-    ];
-  };
 }
diff --git a/lass/2configs/exim-smarthost.nix b/lass/2configs/exim-smarthost.nix
index 1ba99c8c..00a3612f 100644
--- a/lass/2configs/exim-smarthost.nix
+++ b/lass/2configs/exim-smarthost.nix
@@ -27,7 +27,6 @@ with config.krebs.lib;
       { from = "lass@aidsballs.de"; to = lass.mail; }
       { from = "wordpress@ubikmedia.de"; to = lass.mail; }
       { from = "finanzamt@lassul.us"; to = lass.mail; }
-      { from = "dominik@apanowicz.de"; to = "dma@ubikmedia.eu"; }
       { from = "netzclub@lassul.us"; to = lass.mail; }
       { from = "nebenan@lassul.us"; to = lass.mail; }
     ];
diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index 9a1cab17..ab445071 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -80,7 +80,7 @@ let
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
       optional repo.public {
-        user = [ tv makefu ];
+        user = attrValues config.krebs.users;
         repo = [ repo ];
         perm = fetch;
       } ++
diff --git a/lass/2configs/nixpkgs.nix b/lass/2configs/nixpkgs.nix
index 931aabf0..b758bc24 100644
--- a/lass/2configs/nixpkgs.nix
+++ b/lass/2configs/nixpkgs.nix
@@ -3,6 +3,6 @@
 {
   krebs.build.source.nixpkgs.git = {
       url = https://github.com/lassulus/nixpkgs;
-      ref = "11a7899222929b6eb0951f7a1c0182f65b3b4637";
+      ref = "c6ca9c8c8b7eb8f8e68868e36fb90e162adf080f";
     };
 }
diff --git a/lass/2configs/power-action.nix b/lass/2configs/power-action.nix
index 0ff8547c..13396649 100644
--- a/lass/2configs/power-action.nix
+++ b/lass/2configs/power-action.nix
@@ -11,7 +11,7 @@ let
     '';
 
 in {
-  lass.power-action = {
+  krebs.power-action = {
     enable = true;
     plans.low-battery = {
       upperLimit = 30;
@@ -36,6 +36,6 @@ in {
   ];
 
   security.sudo.extraConfig = ''
-    ${config.lass.power-action.user.name} ALL= (root) NOPASSWD: ${suspend}
+    ${config.krebs.power-action.user.name} ALL= (root) NOPASSWD: ${suspend}
   '';
 }
diff --git a/lass/2configs/repo-sync.nix b/lass/2configs/repo-sync.nix
index 45a4e2af..027f31fe 100644
--- a/lass/2configs/repo-sync.nix
+++ b/lass/2configs/repo-sync.nix
@@ -91,12 +91,11 @@ in {
     (sync-remote "repo-sync" "https://github.com/makefu/repo-sync")
     (sync-remote "skytraq-datalogger" "https://github.com/makefu/skytraq-datalogger")
     (sync-remote "xintmap" "https://github.com/4z3/xintmap")
+    (sync-remote "realwallpaper" "https://github.com/lassulus/realwallpaper")
     (sync-remote-silent "nixpkgs" "https://github.com/nixos/nixpkgs")
     (sync-retiolum "go")
     (sync-retiolum "much")
     (sync-retiolum "newsbot-js")
-    (sync-retiolum "painload")
-    (sync-retiolum "realwallpaper")
     (sync-retiolum "stockholm")
     (sync-retiolum "wai-middleware-time")
     (sync-retiolum "web-routes-wai-custom")
diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix
index 07df2e8d..becd1a87 100644
--- a/lass/2configs/websites/domsen.nix
+++ b/lass/2configs/websites/domsen.nix
@@ -110,14 +110,6 @@ in {
     };
   };
 
-  users.users.domsen = {
-    uid = genid "domsen";
-    description = "maintenance acc for domsen";
-    home = "/home/domsen";
-    useDefaultShell = true;
-    extraGroups = [ "nginx" ];
-    createHome = true;
-  };
 
   #services.phpfpm.phpOptions = ''
   #  extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
@@ -133,5 +125,40 @@ in {
     cat ${pkgs.php}/etc/php-recommended.ini > $out
     echo "$options" >> $out
   '';
+
+  # MAIL STUFF
+  # TODO: make into its own module
+    services.dovecot2 = {
+      enable = true;
+      mailLocation = "maildir:~/Mail";
+    };
+    krebs.iptables.tables.filter.INPUT.rules = [
+      { predicate = "-p tcp --dport pop3"; target = "ACCEPT"; }
+      { predicate = "-p tcp --dport imap"; target = "ACCEPT"; }
+    ];
+  krebs.exim-smarthost = {
+    internet-aliases = [
+      { from = "dominik@apanowicz.de"; to = "dma@ubikmedia.eu"; }
+      { from = "mail@jla-trading.com"; to = "jla-trading"; }
+    ];
+    system-aliases = [
+    ];
+  };
+
+  users.users.domsen = {
+    uid = genid "domsen";
+    description = "maintenance acc for domsen";
+    home = "/home/domsen";
+    useDefaultShell = true;
+    extraGroups = [ "nginx" ];
+    createHome = true;
+  };
+
+  users.users.jla-trading = {
+    uid = genid "jla-trading";
+    home = "/home/jla-trading";
+    useDefaultShell = true;
+    createHome = true;
+  };
 }
 
diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix
index 6a3b41ca..60370b23 100644
--- a/lass/3modules/default.nix
+++ b/lass/3modules/default.nix
@@ -4,7 +4,6 @@ _:
     ./ejabberd
     ./folderPerms.nix
     ./mysql-backup.nix
-    ./power-action.nix
     ./umts.nix
     ./urxvtd.nix
     ./wordpress_nginx.nix
diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix
new file mode 100644
index 00000000..c948754d
--- /dev/null
+++ b/mv/1systems/stro.nix
@@ -0,0 +1,172 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+
+{
+  krebs = {
+    enable = true;
+    build = {
+      user = config.krebs.users.mv;
+      host = config.krebs.hosts.stro;
+      source = let
+        HOME = getEnv "HOME";
+        host = config.krebs.build.host;
+      in {
+        nixos-config.symlink = "stockholm/mv/1systems/${host.name}.nix";
+        secrets.file = "${HOME}/secrets/${host.name}";
+        stockholm.file = "${HOME}/stockholm";
+        nixpkgs.git = {
+          url = https://github.com/NixOS/nixpkgs;
+          ref = "8bf31d7d27cae435d7c1e9e0ccb0a320b424066f";
+        };
+      };
+    };
+  };
+
+  imports = [
+    <secrets>
+    <stockholm/krebs>
+    <stockholm/tv/2configs/audit.nix>
+    <stockholm/tv/2configs/bash.nix>
+    <stockholm/tv/2configs/exim-retiolum.nix>
+    <stockholm/tv/2configs/hw/x220.nix>
+    <stockholm/tv/2configs/im.nix>
+    <stockholm/tv/2configs/mail-client.nix>
+    <stockholm/tv/2configs/retiolum.nix>
+    <stockholm/tv/2configs/ssh.nix>
+    <stockholm/tv/2configs/sshd.nix>
+    <stockholm/tv/2configs/vim.nix>
+    <stockholm/tv/2configs/xdg.nix>
+    <stockholm/tv/2configs/xserver>
+    <stockholm/tv/3modules>
+    <stockholm/tv/5pkgs>
+  ];
+
+  boot.kernel.sysctl = {
+    # Enable IPv6 Privacy Extensions
+    "net.ipv6.conf.all.use_tempaddr" = 2;
+    "net.ipv6.conf.default.use_tempaddr" = 2;
+  };
+
+  boot.initrd.luks = {
+    cryptoModules = [ "aes" "sha512" "xts" ];
+    devices = [
+      {
+        name = "luks1";
+        device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part2";
+      }
+    ];
+  };
+
+  environment = {
+    profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
+    shellAliases = mkForce {
+      gp = "${pkgs.pari}/bin/gp -q";
+      df = "df -h";
+      du = "du -h";
+      ls = "ls -h --color=auto --group-directories-first";
+      dmesg = "dmesg -L --reltime";
+      view = "vim -R";
+
+      reload = "systemctl reload";
+      restart = "systemctl restart";
+      start = "systemctl start";
+      status = "systemctl status";
+      stop = "systemctl stop";
+    };
+    systemPackages = with pkgs; [
+      dic
+      htop
+      p7zip
+      q
+
+      pavucontrol
+      rxvt_unicode.terminfo
+
+      # stockholm
+      git
+      gnumake
+      populate
+    ];
+    variables = {
+      NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
+    };
+  };
+
+  fileSystems = {
+    "/boot" = {
+      device = "/dev/disk/by-id/ata-TOSHIBA-TR150_467B50JXK8WU-part1";
+    };
+    "/" = {
+      device = "/dev/mapper/vg1-root";
+      fsType = "btrfs";
+      options = ["defaults" "noatime" "ssd" "compress=lzo"];
+    };
+    "/home" = {
+      device = "/dev/mapper/vg1-home";
+      fsType = "btrfs";
+      options = ["defaults" "noatime" "ssd" "compress=lzo"];
+    };
+    "/tmp" = {
+      device = "tmpfs";
+      fsType = "tmpfs";
+      options = ["nosuid" "nodev" "noatime"];
+    };
+  };
+
+  hardware.pulseaudio = {
+    enable = true;
+    systemWide = true;
+  };
+
+  networking.hostName = config.krebs.build.host.name;
+
+  nix = {
+    binaryCaches = ["https://cache.nixos.org"];
+    # TODO check if both are required:
+    chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ];
+    requireSignedBinaryCaches = true;
+    useChroot = true;
+  };
+
+  nixpkgs.config.allowUnfree = false;
+
+  users = {
+    defaultUserShell = "/run/current-system/sw/bin/bash";
+    mutableUsers = false;
+    users = {
+      mv = {
+        inherit (config.krebs.users.mv) home uid;
+        isNormalUser = true;
+      };
+    };
+  };
+
+  security.setuidPrograms = [
+    "sendmail"
+  ];
+
+  security.sudo.extraConfig = ''
+    Defaults env_keep+="SSH_CLIENT"
+    Defaults mailto="${config.krebs.users.mv.mail}"
+    Defaults !lecture
+  '';
+
+  services.cron.enable = false;
+  services.journald.extraConfig = ''
+    SystemMaxUse=1G
+    RuntimeMaxUse=128M
+  '';
+  services.nscd.enable = false;
+  services.ntp.enable = false;
+  services.timesyncd.enable = true;
+
+  time.timeZone = "Europe/Berlin";
+
+  tv.iptables = {
+    enable = true;
+    accept-echo-request = "internet";
+  };
+
+  system.stateVersion = "16.03";
+}
diff --git a/tv/1systems/alnus.nix b/tv/1systems/alnus.nix
index 360390c0..a9646b58 100644
--- a/tv/1systems/alnus.nix
+++ b/tv/1systems/alnus.nix
@@ -53,7 +53,6 @@ with config.krebs.lib;
   };
 
   hardware = {
-    enableAllFirmware = true;
     opengl.driSupport32Bit = true;
     pulseaudio.enable = true;
   };
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index b832470d..fec0a02c 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -155,11 +155,6 @@ with config.krebs.lib;
 
   nixpkgs.config.chromium.enablePepperFlash = true;
 
-  #hardware.bumblebee.enable = true;
-  #hardware.bumblebee.group = "video";
-  hardware.enableAllFirmware = true;
-  #hardware.opengl.driSupport32Bit = true;
-
   environment.systemPackages = with pkgs; [
     ethtool
     tinc_pre
diff --git a/tv/1systems/zu.nix b/tv/1systems/zu.nix
index bfc018cc..c0d51436 100644
--- a/tv/1systems/zu.nix
+++ b/tv/1systems/zu.nix
@@ -161,11 +161,6 @@ with config.krebs.lib;
 
   nixpkgs.config.chromium.enablePepperFlash = true;
 
-  #hardware.bumblebee.enable = true;
-  #hardware.bumblebee.group = "video";
-  hardware.enableAllFirmware = true;
-  #hardware.opengl.driSupport32Bit = true;
-
   environment.systemPackages = with pkgs; [
     ethtool
     tinc_pre
@@ -194,36 +189,4 @@ with config.krebs.lib;
 
   # The NixOS release to be compatible with for stateful data such as databases.
   system.stateVersion = "15.09";
-
-#/*
-#{ host api.doraemon.sg.zalora.net | awk '{print$4" api.zalora.sg"}';
-#  host bob.live.sg.zalora.net | awk '{print$4" bob.zalora.sg"}';
-#  host www.live.sg.zalora.net | awk '{print$4" www.zalora.sg costa.zalora.sg"}'; }
-#*/
-#  networking.extraHosts = optionalString (1 == 1) ''
-#54.255.133.72 api.zalora.sg
-#52.77.12.194 bob.zalora.sg
-#52.74.232.49 www.zalora.sg costa.zalora.sg
-#  '';
-
-
-  #services.elasticsearch.enable = true;
-  #services.kibana.enable = true;
-  #services.logstash.enable = true;
-
-  environment.etc."ssh/ssh_config".text = mkForce ''
-    AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
-
-    ${optionalString config.programs.ssh.setXAuthLocation ''
-      XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
-    ''}
-
-    ForwardX11 ${if config.programs.ssh.forwardX11 then "yes" else "no"}
-
-    # Allow DSA keys for now. (These were deprecated in OpenSSH 7.0.)
-    #PubkeyAcceptedKeyTypes +ssh-dss
-
-    ${config.programs.ssh.extraConfig}
-  '';
-
 }
diff --git a/tv/2configs/bash.nix b/tv/2configs/bash.nix
new file mode 100644
index 00000000..fe87aa8d
--- /dev/null
+++ b/tv/2configs/bash.nix
@@ -0,0 +1,37 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+
+{
+  programs.bash = {
+    interactiveShellInit = ''
+      HISTCONTROL='erasedups:ignorespace'
+      HISTSIZE=65536
+      HISTFILESIZE=$HISTSIZE
+
+      shopt -s checkhash
+      shopt -s histappend histreedit histverify
+      shopt -s no_empty_cmd_completion
+      complete -d cd
+    '';
+    promptInit = ''
+      case $UID in
+        0)
+          PS1='\[\e[1;31m\]\w\[\e[0m\] '
+          ;;
+        ${toString config.krebs.build.user.uid})
+          PS1='\[\e[1;32m\]\w\[\e[0m\] '
+          ;;
+        *)
+          PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] '
+          ;;
+      esac
+      if test -n "$SSH_CLIENT"; then
+        PS1='\[\e[35m\]\h'" $PS1"
+      fi
+      if test -n "$SSH_AGENT_PID"; then
+        PS1="ssh-agent[$SSH_AGENT_PID] $PS1"
+      fi
+    '';
+  };
+}
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 04009f54..db1bfe5a 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -14,7 +14,7 @@ with config.krebs.lib;
       stockholm.file = "/home/tv/stockholm";
       nixpkgs.git = {
         url = https://github.com/NixOS/nixpkgs;
-        ref = "8bf31d7d27cae435d7c1e9e0ccb0a320b424066f";
+        ref = "2568ee3d73bdebd6bab6739adf8a900f3429c8e6";
       };
     } // optionalAttrs host.secure {
       secrets-master.file = "/home/tv/secrets/master";
@@ -27,8 +27,12 @@ with config.krebs.lib;
     <secrets>
     ./audit.nix
     ./backup.nix
+    ./bash.nix
     ./nginx
+    ./ssh.nix
+    ./sshd.nix
     ./vim.nix
+    ./xdg.nix
     {
       # stockholm dependencies
       environment.systemPackages = with pkgs; [
@@ -104,49 +108,6 @@ with config.krebs.lib;
       environment.variables = {
         NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
       };
-
-      programs.bash = {
-        interactiveShellInit = ''
-          HISTCONTROL='erasedups:ignorespace'
-          HISTSIZE=65536
-          HISTFILESIZE=$HISTSIZE
-
-          shopt -s checkhash
-          shopt -s histappend histreedit histverify
-          shopt -s no_empty_cmd_completion
-          complete -d cd
-
-          ${readFile ./bash_completion.sh}
-
-          # TODO source bridge
-        '';
-        promptInit = ''
-          case $UID in
-            0)
-              PS1='\[\e[1;31m\]\w\[\e[0m\] '
-              ;;
-            ${toString config.krebs.users.tv.uid})
-              PS1='\[\e[1;32m\]\w\[\e[0m\] '
-              ;;
-            *)
-              PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] '
-              ;;
-          esac
-          if test -n "$SSH_CLIENT"; then
-            PS1='\[\e[35m\]\h'" $PS1"
-          fi
-          if test -n "$SSH_AGENT_PID"; then
-            PS1="ssh-agent[$SSH_AGENT_PID] $PS1"
-          fi
-        '';
-      };
-
-      programs.ssh = {
-        extraConfig = ''
-          UseRoaming no
-        '';
-        startAgent = false;
-      };
     }