Merge remote-tracking branch 'prism/master'

11 files changed, 160 insertions, 58 deletions

diff --git a/krebs/0tests/data/secrets/konsens.id_ed25519 b/krebs/0tests/data/secrets/konsens.id_ed25519
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/krebs/0tests/data/secrets/konsens.id_ed25519
diff --git a/krebs/1systems/wolf/config.nix b/krebs/1systems/wolf/config.nix
index 6addb081..914b3805 100644
--- a/krebs/1systems/wolf/config.nix
+++ b/krebs/1systems/wolf/config.nix
@@ -25,6 +25,7 @@ in
     <stockholm/krebs/2configs/shack/muell_caller.nix>
     <stockholm/krebs/2configs/shack/radioactive.nix>
     <stockholm/krebs/2configs/shack/share.nix>
+    <stockholm/krebs/2configs/shack/mobile.mpd.nix>
     {
       systemd.services.telegraf.path = [ pkgs.net_snmp ]; # for snmptranslate
       systemd.services.telegraf.environment = {
@@ -114,7 +115,7 @@ in
   networking = {
     firewall.enable = false;
     firewall.allowedTCPPorts = [ 8088 8086 8083 ];
-    interfaces."${ext-if}".ip4 = [{
+    interfaces."${ext-if}".ipv4.addresses = [{
       address = shack-ip;
       prefixLength = 20;
     }];
diff --git a/krebs/2configs/buildbot-stockholm.nix b/krebs/2configs/buildbot-stockholm.nix
index 62a5f9ab..1ed38f54 100644
--- a/krebs/2configs/buildbot-stockholm.nix
+++ b/krebs/2configs/buildbot-stockholm.nix
@@ -24,7 +24,7 @@ in
       testslave = "lasspass";
     };
     change_source.stockholm = ''
-      stockholm_repo = 'http://cgit.prism.r/stockholm'
+      stockholm_repo = 'http://cgit.hotdog.r/stockholm'
       cs.append(
           changes.GitPoller(
               stockholm_repo,
diff --git a/krebs/2configs/repo-sync.nix b/krebs/2configs/repo-sync.nix
index 13e1217a..3ca94fc1 100644
--- a/krebs/2configs/repo-sync.nix
+++ b/krebs/2configs/repo-sync.nix
@@ -3,6 +3,10 @@
 with import <stockholm/lib>;
 
 let
+  konsens-user = {
+    name = "konsens";
+    pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKKozGNGBAzHnyj6xUlsjGxxknyChXvuyrddkWVVnz7";
+  };
   mirror = "git@${config.networking.hostName}:";
 
   defineRepo = {
@@ -42,6 +46,13 @@ let
         perm = push ''refs/*'' [ non-fast-forward create delete merge ];
       }
       {
+        user = [
+          konsens-user
+        ];
+        repo = [ repo ];
+        perm = push ''refs/heads/master'' [ create merge ];
+      }
+      {
         user = attrValues config.krebs.users;
         repo = [ repo ];
         perm = fetch;
@@ -112,6 +123,19 @@ in {
   krebs.repo-sync = {
     enable = true;
   };
+  krebs.konsens = {
+    enable = true;
+    repos = {
+      krops = { branchesToCheck = [ "lassulus" "tv" ]; };
+      stockholm = {};
+    };
+  };
+  krebs.secret.files.konsens = {
+    path = "/var/lib/konsens/.ssh/id_ed25519";
+    owner = konsens-user;
+    source-path = "${<secrets/konsens.id_ed25519>}";
+  };
+
   imports = [
     (sync-retiolum { name = "the_playlist"; desc = "Good Music collection + tools"; section = "art"; })
 
diff --git a/krebs/2configs/shack/mobile.mpd.nix b/krebs/2configs/shack/mobile.mpd.nix
new file mode 100644
index 00000000..2dc466ed
--- /dev/null
+++ b/krebs/2configs/shack/mobile.mpd.nix
@@ -0,0 +1,32 @@
+{lib,pkgs, ... }:
+let
+  mpdHost = "mpd.shack";
+  ympd = name: port: let
+    webPort = 10000 + port;
+  in {
+    systemd.services."ympd-${name}" = {
+      description = "mpd for ${name}";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig.ExecStart = "${pkgs.ympd}/bin/ympd --host ${mpdHost} --port ${toString port} --webport ${toString webPort} --user nobody";
+    };
+    services.nginx.virtualHosts."mobile.${name}.mpd.shack" = {
+      serverAliases = [
+        "${name}.mpd.wolf.r"
+        "${name}.mpd.wolf.shack"
+      ];
+      locations."/".proxyPass = "http://localhost:${toString webPort}";
+    };
+  };
+in lib.mkMerge [{
+  services.nginx.enable = true;
+}
+  (ympd "lounge" 6600)
+  (ympd "seminarraum" 6601)
+  (ympd "elab" 6602)
+  (ympd "kueche" 6603)
+  (ympd "crafting" 6604)
+  (ympd "fablab" 6605)
+  (ympd "workshop" 6606)
+  (ympd "klo" 6607)
+
+]
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index afc96e9e..83334976 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -26,6 +26,7 @@ let
       ./iana-etc.nix
       ./iptables.nix
       ./kapacitor.nix
+      ./konsens.nix
       ./monit.nix
       ./newsbot-js.nix
       ./nixpkgs.nix
diff --git a/krebs/3modules/jeschli/default.nix b/krebs/3modules/jeschli/default.nix
index ed9bfad2..ab8fe097 100644
--- a/krebs/3modules/jeschli/default.nix
+++ b/krebs/3modules/jeschli/default.nix
@@ -132,6 +132,7 @@ with import <stockholm/lib>;
           ip6.addr = "42::30";
           aliases = [
             "enklave.r"
+            "cgit.enklave.r"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----
diff --git a/krebs/3modules/konsens.nix b/krebs/3modules/konsens.nix
new file mode 100644
index 00000000..47316d5d
--- /dev/null
+++ b/krebs/3modules/konsens.nix
@@ -0,0 +1,80 @@
+{ config, lib, pkgs, ... }:
+
+with import <stockholm/lib>;
+
+let
+  cfg = config.krebs.konsens;
+
+  out = {
+    options.krebs.konsens = api;
+    config = lib.mkIf cfg.enable imp;
+  };
+
+  api = {
+    enable = mkEnableOption "git konsens finder";
+    repos = mkOption {
+      type = types.attrsOf (types.submodule ({ config, ...}: {
+        options = {
+          url = mkOption {
+            type = types.str;
+            default = "git@localhost:${config._module.args.name}";
+          };
+          branchesToCheck = mkOption {
+            type = types.listOf types.str;
+            default = [ "lassulus" "makefu" "tv" ];
+          };
+          target = mkOption {
+            type = types.str;
+            default = "master";
+          };
+          timerConfig = mkOption {
+            type = types.attrsOf types.str;
+            default = {
+              OnCalendar = "*:00,15,30,45";
+            };
+          };
+        };
+      }));
+    };
+  };
+
+  imp = {
+    users.users.konsens = rec {
+      name = "konsens";
+      uid = genid name;
+      home = "/var/lib/konsens";
+      createHome = true;
+    };
+
+    systemd.timers = mapAttrs' (name: repo:
+      nameValuePair "konsens-${name}" {
+        description = "konsens timer";
+        wantedBy = [ "timers.target" ];
+        timerConfig = repo.timerConfig;
+      }
+    ) cfg.repos;
+
+    systemd.services = mapAttrs' (name: repo:
+      nameValuePair "konsens-${name}" {
+        after = [ "network.target" "secret.service" ];
+        path = [ pkgs.git ];
+        restartIfChanged = false;
+        serviceConfig = {
+          Type = "simple";
+          PermissionsStartOnly = true;
+          ExecStart = pkgs.writeDash "konsens-${name}" ''
+            if ! test -e ${name}; then
+              git clone ${repo.url} ${name}
+            fi
+            cd ${name}
+            git fetch origin
+            git push origin $(git merge-base ${concatMapStringsSep " " (branch: "origin/${branch}") repo.branchesToCheck}):refs/heads/master
+          '';
+          WorkingDirectory = /var/lib/konsens;
+          User = "konsens";
+        };
+      }
+    ) cfg.repos;
+  };
+
+in out
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index c4a5bbb0..7d9ef507 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -11,39 +11,6 @@ with import <stockholm/lib>;
     ci = true;
     monitoring = true;
   }) {
-    dishfire = {
-      cores = 4;
-      nets = rec {
-        internet = {
-          ip4.addr = "144.76.172.188";
-          aliases = [
-            "dishfire.i"
-          ];
-          ssh.port = 45621;
-        };
-        retiolum = {
-          via = internet;
-          ip4.addr = "10.243.133.99";
-          ip6.addr = "42:0000:0000:0000:0000:0000:d15f:1233";
-          aliases = [
-            "dishfire.r"
-          ];
-          tinc.pubkey = ''
-            -----BEGIN RSA PUBLIC KEY-----
-            MIIBCgKCAQEAwKi49fN+0s5Cze6JThM7f7lj4da27PSJ/3w3tDFPvtQco11ksNLs
-            Xd3qPaQIgmcNVCR06aexae3bBeTx9y3qHvKqZVE1nCtRlRyqy1LVKSj15J1D7yz7
-            uS6u/BSZiCzmdZwu3Fq5qqoK0nfzWe/NKEDWNa5l4Mz/BZQyI/hbOpn6UfFD0LpK
-            R4jzc9Dbk/IFNAvwb5yrgEYtwBzlXzeDvHW2JcPq3qQjK2byQYNiIyV3g0GHppEd
-            vDbIPDFhTn3Hv5zz/lX+/We8izzRge7MEd+Vn9Jwb5NAzwDsOHl6ExpqASv9H49U
-            HwgPw5pstabyrsDWXybSYUb+8LcZf+unGwIDAQAB
-            -----END RSA PUBLIC KEY-----
-          '';
-          tinc.port = 993;
-        };
-      };
-      ssh.privkey.path = <secrets/ssh.id_ed25519>;
-      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGv0JMp0y+E5433GRSFKVK3cQmP0AAlS9aH9fk49yFxy";
-    };
     prism = rec {
       cores = 4;
       extraZones = {
@@ -441,7 +408,7 @@ with import <stockholm/lib>;
         };
       };
     };
-    borg = {
+    rock = {
       monitoring = false;
       ci = false;
       external = true;
@@ -449,22 +416,21 @@ with import <stockholm/lib>;
         retiolum = {
           ip4.addr = "10.243.29.171";
           ip6.addr = "42:4992:6a6d:700::2";
-          aliases = [ "borg.r" ];
+          aliases = [ "rock.r" ];
           tinc.pubkey = ''
-            -----BEGIN PUBLIC KEY-----
-            MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHZApTM7Hl4qqNakSwq
-            bt7zJoTVK9ePoC3Mue1VmJ1mCKMaxKdzlO31kPeHtkilAzgyIJdgikyKFlApGsQL
-            aIuU9h55X7TbikoDD6ghbSrAe3Pgc+sJ3OZ7wO7Qb8CKgJvEbkk/u68YiJgyTjYD
-            HNjIQzlsGdpoSke9vwC8qWanfgN7c2MMGtakqfXDjYjCgp7O43i+SMupkMSXIXMA
-            5XUFh/vVp6xgPxBofcw0uQIyZ5v4PPFjnGPm4rnMbFzbhubntHjDadwGd5Niyw4O
-            zNNKNchTLfNiuNGqTZeYd0kJ5fNMKykhpSs+ou34MvexvpuyPlFuotnPXN/nOMml
-            3nwiqzthzPuBZRLswxT0WvlA8wlbeTOKJ0wTIR4dDuAF+euDtoNocVEN5PJNc7yN
-            fmwAV6geESoJbZQMSCtAp1NioaBlRPp1pFfoM/GotHywuFrTIxyoIBiYhkpWyQvq
-            WYw5j13IKqkL7jDchhoBmcardmh+AP5bL3uQ84BgaYNwFzHp04qIRrrdpF0eMaHB
-            /8zaqsNLn4/zQJB5ffkelwoIqfvLPQeCMLzHGHgP5xUnWgmZZGiiDLvhuaMeNq4U
-            EpCKoTL178sPOgNfHfd8mEqx0qKYuPrNQEdlpa5xOZqwx56pfYpGWY+KtF2FHLhS
-            iO64GCJqCi1MKBYx/NhaxKMCAwEAAQ==
-            -----END PUBLIC KEY-----
+            -----BEGIN RSA PUBLIC KEY-----
+            MIICCgKCAgEAsMJbXDhkaLZcEzCIe8G+rHyLulWIqrUAmDT4Vbtv4r0QhPBsqwjM
+            DuvRtX5SNHdjfZWnUZoOlmXrmIo07exPFQvyrnppm6DNx+IZ5mNMNVIFUoojRhF7
+            HS2jubcjTEib56XEYWKly0olrVMbsJk5THJqRQyOQuTPCFToxXVRcT5t/UK6Dzgh
+            mp+suJ7IcmmO80IwfZrQrQslkQ6TdOy1Vs908GacSQJyRxdRxLraU/98iMhFbAQf
+            Ap+qVSUU88iCi+tcoSYzKhqU2N0AhRGcsE073B3Px8CAgPK/juwTrFElKEc17X9M
+            Rh41DvUjrtG4ERPmbwKPtsLagmnZUlU8A5YC8wtV08RI5QBsbbOsKInareV1aLeD
+            91ZVCBPFTz8IM6Mc6H435eMCMC2ynFCDyRGdcue3tBQoaTGe1dbduIZkPGn+7cg4
+            fef1db6SQD4HCwDLv8CTFLACR/jmAapwZEgvJ3u3bpgMGzt+QNvL1cxUr3TBUWRv
+            3f0R+Dj8DCUWTJUE7K5LO7bL4p9Ht0yIsVH+/DucyoMQqRwCwWSr7+H2MAsWviav
+            ZRRfH0RqZPEzCxyLDBtkVrx+GRAUZxy1xlqmN16O/sRHiqq3bv8Jk3dwuRZlFu6q
+            cOFu4g9XsamHkmCuVkvTGjnC2h21MjUUr3PGHzOMtiM/18LcfX730f8CAwEAAQ==
+            -----END RSA PUBLIC KEY-----
           '';
         };
       };
diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix
index 53b06a70..faa3dd71 100644
--- a/krebs/3modules/retiolum-bootstrap.nix
+++ b/krebs/3modules/retiolum-bootstrap.nix
@@ -31,11 +31,8 @@ in
       enable = mkDefault true;
       virtualHosts.retiolum-bootstrap = {
         inherit (cfg) serverName sslCertificate sslCertificateKey;
-        enableSSL = true;
+        forceSSL = true;
         extraConfig =''
-          if ($scheme = http){
-            return 301 https://$server_name$request_uri;
-          }
 
           root ${pkgs.retiolum-bootstrap};
           try_files $uri $uri/retiolum.sh;
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index 13bed8bf..a9a0f663 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
 {
   "url": "https://github.com/NixOS/nixpkgs-channels",
-  "rev": "4df3426f5a5e78cef4835897a43abd9e2a092b74",
-  "date": "2018-08-19T09:20:40+02:00",
-  "sha256": "05k5mssiqxffxi45mss9wjns6k76i248rpasa48akdcriry1mp63",
+  "rev": "a37638d46706610d12c9747614fd1b8f8d35ad48",
+  "date": "2018-08-30T21:03:26+02:00",
+  "sha256": "0rsdkk4z7pkqr2mw0pq7i6fkqs7gbi5kral3c8smm9bw104sn8v7",
   "fetchSubmodules": true
 }