From e96ceabc701fdf49b0f0954c7e7edc2d9119035a Mon Sep 17 00:00:00 2001 From: makefu Date: Fri, 25 Nov 2016 01:47:12 +0100 Subject: m 5 elchhub: bump --- makefu/5pkgs/elchhub/default.nix | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 makefu/5pkgs/elchhub/default.nix diff --git a/makefu/5pkgs/elchhub/default.nix b/makefu/5pkgs/elchhub/default.nix new file mode 100644 index 00000000..a4fb8604 --- /dev/null +++ b/makefu/5pkgs/elchhub/default.nix @@ -0,0 +1,35 @@ +{ lib, pkgs, fetchFromGitHub, ... }: + +with pkgs.python3Packages; +let + ftputil = buildPythonPackage rec { + version = "3.3.1"; + name = "ftputil-${version}"; + doCheck = false; + src = pkgs.fetchurl { + url = "mirror://pypi/f/ftputil/${name}.tar.gz"; + sha256 = "bc88f35cc7f5f292ec4b56e99c8b05d361de1cc8b330050e32b0c4ecaa2d2b01"; + }; +}; +in buildPythonPackage rec { + name = "elchhub-${version}"; + version = "1.0.5"; + propagatedBuildInputs = [ + flask + requests2 + ftputil + redis + ]; + doCheck = false; + src = fetchFromGitHub { + owner = "krebscode"; + repo = "elchhub"; + rev = "2f499c1"; + sha256 = "1lbql3lx7i3ynsjanfy9vln6795rb56n9xq9vkb7xbml60gmn1wg"; + }; + meta = { + homepage = https://github.com/krebscode/elchhub; + description = "elchhub"; + license = lib.licenses.wtfpl; + }; +} -- cgit v1.2.3 From bcc2b327c4dbd34162db8cf81fbbc7688feafd9a Mon Sep 17 00:00:00 2001 From: makefu Date: Fri, 25 Nov 2016 01:47:56 +0100 Subject: m 2 elchos/search.nix: init --- makefu/2configs/elchos/search.nix | 211 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 211 insertions(+) create mode 100644 makefu/2configs/elchos/search.nix diff --git a/makefu/2configs/elchos/search.nix b/makefu/2configs/elchos/search.nix new file mode 100644 index 00000000..5adaa0c6 --- /dev/null +++ b/makefu/2configs/elchos/search.nix @@ -0,0 +1,211 @@ +{ config, lib, pkgs, ... }: + +# graphite-web on port 8080 +# carbon cache on port 2003 (tcp/udp) +with import ; +let + #primary-itf = "eth0"; + primary-itf = "wlp2s0"; + elch-sock = "${config.services.uwsgi.runDir}/uwsgi-elch.sock"; + ddclientUser = "ddclient"; + sec = toString ; + nsupdate = import "${sec}/nsupdate-search.nix"; + stateDir = "/var/spool/ddclient"; + cfg = "${stateDir}/cfg"; + ddclientPIDFile = "${stateDir}/ddclient.pid"; + + acmepath = "/var/lib/acme/"; + acmechall = acmepath + "/challenges/"; + # TODO: correct cert generation requires a `real` internet ip address + stats-dom = "stats.nsupdate.info"; + search-dom = "search.nsupdate.info"; + search_ssl_cert = "${acmepath}/${search-dom}/fullchain.pem"; + search_ssl_key = "${acmepath}/${search-dom}/key.pem"; + stats_ssl_cert = "${acmepath}/${stats-dom}/fullchain.pem"; + stats_ssl_key = "${acmepath}/${stats-dom}/key.pem"; + + gen-cfg = dict: '' + ssl=yes + cache=${stateDir}/ddclient.cache + pid=${ddclientPIDFile} + ${concatStringsSep "\n" (mapAttrsToList (user: pass: '' + + use=if, if=${primary-itf} + protocol=dyndns2, server=ipv4.nsupdate.info, login=${user}, password='${pass}' ${user} + #usev6=if, if=${primary-itf} + #protocol=dyndns2, server=ipv6.nsupdate.info, login=${user}, password='${pass}' ${user} + '') dict)} + ''; + +in { + users.extraUsers = singleton { + name = ddclientUser; + uid = genid "ddclient"; + description = "ddclient daemon user"; + home = stateDir; + createHome = true; + }; + services.redis.enable = mkForce true; + services.redis.bind = "127.0.0.1"; + + services.uwsgi = { + enable = true; + user = "nginx"; + plugins = [ "python3" ]; + instance = { + type = "emperor"; + vassals = { + elchhub = { + type = "normal"; + pythonPackages = self: with self; [ pkgs.elchhub ]; + socket = elch-sock; + }; + }; + }; + }; + + security.acme.certs = { + "${stats-dom}" = { + email = "acme@syntax-fehler.de"; + webroot = "${acmechall}/${stats-dom}/"; + group = "nginx"; + allowKeysForGroup = true; + postRun = "systemctl reload nginx.service"; + extraDomains = { + "${stats-dom}" = null ; + }; + }; + "${search-dom}" = { + email = "acme@syntax-fehler.de"; + webroot = "${acmechall}/${search-dom}/"; + group = "nginx"; + allowKeysForGroup = true; + postRun = "systemctl reload nginx.service"; + extraDomains = { + "${stats-dom}" = null ; + }; + }; + }; + + krebs.nginx = { + enable = mkDefault true; + servers = { + elch-stats = { + server-names = [ stats-dom ]; + # listen = [ "80" "443 ssl" ]; + ssl = { + enable = true; + certificate = stats_ssl_cert; + certificate_key = stats_ssl_key; + force_encryption = true; + }; + + locations = [ + (nameValuePair "/" '' + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_pass http://localhost:3000/; + '') + (nameValuePair "/.well-known/acme-challenge" '' + root ${acmechall}/${search-dom}/; + '') + ]; + }; + elchhub = { + server-names = [ "search.nsupdate.info" ]; + # listen = [ "80" "443 ssl" ]; + ssl = { + enable = true; + certificate = search_ssl_cert; + certificate_key = search_ssl_key; + force_encryption = true; + }; + locations = [ (nameValuePair "/" '' + uwsgi_pass unix://${elch-sock}; + uwsgi_param UWSGI_CHDIR ${pkgs.elchhub}/${pkgs.python3.sitePackages}; + uwsgi_param UWSGI_MODULE elchhub.wsgi; + uwsgi_param UWSGI_CALLABLE app; + + include ${pkgs.nginx}/conf/uwsgi_params; + '') + (nameValuePair "/.well-known/acme-challenge" '' + root ${acmechall}/${search-dom}/; + '') + ]; + }; + }; + }; + + systemd.services = { + redis.serviceConfig.LimitNOFILE=10032; + elchos-ftp-scanner = { + wantedBy = [ "multi-user.target" ]; + after = [ "ip-up.target" ]; + serviceConfig = { + User = "nginx"; + ExecStart = "${pkgs.elchhub}/bin/elch-manager"; + }; + }; + register-elchos-nsupdate = { + wantedBy = [ "multi-user.target" ]; + after = [ "ip-up.target" ]; + serviceConfig = { + Type = "forking"; + User = ddclientUser; + PIDFile = ddclientPIDFile; + ExecStartPre = pkgs.writeDash "init-nsupdate" '' + cp -vf ${pkgs.writeText "ddclient-config" (gen-cfg nsupdate)} ${cfg} + chmod 700 ${cfg} + ''; + ExecStart = "${pkgs.ddclient}/bin/ddclient -verbose -daemon 1 -noquiet -file ${cfg}"; + }; + }; + }; + + services.grafana = { + enable = true; + addr = "127.0.0.1"; + users.allowSignUp = false; + users.allowOrgCreate = false; + users.autoAssignOrg = false; + auth.anonymous.enable = true; + security = import ; # { AdminUser = ""; adminPassword = ""} + }; + + services.graphite = { + api = { + enable = true; + listenAddress = "127.0.0.1"; + port = 8080; + }; + carbon = { + enableCache = true; + # save disk usage by restricting to 1 bulk update per second + config = '' + [cache] + MAX_CACHE_SIZE = inf + MAX_UPDATES_PER_SECOND = 1 + MAX_CREATES_PER_MINUTE = 500 + ''; + storageSchemas = '' + [carbon] + pattern = ^carbon\. + retentions = 60:90d + + [elchos] + patterhn = ^elchos\. + retentions = 10s:30d,60s:3y + + [default] + pattern = .* + retentions = 30s:30d,300s:1y + ''; + }; + }; + + networking.firewall = { + allowedTCPPorts = [ 2003 80 443 ]; + allowedUDPPorts = [ 2003 ]; + }; +} -- cgit v1.2.3 From da3022389d1da7ac9c2ca42eb2d16582b96e0074 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 27 Nov 2016 13:20:27 +0100 Subject: l 1 helios: enable pulseaudio --- lass/1systems/helios.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix index 82db8ef7..4472816e 100644 --- a/lass/1systems/helios.nix +++ b/lass/1systems/helios.nix @@ -28,6 +28,9 @@ with import ; services.xserver.enable = true; services.xserver.desktopManager.xfce.enable = true; networking.wireless.enable = true; + hardware.pulseaudio = { + enable = true; + }; users.users.ferret = { uid = genid "ferret"; home = "/home/ferret"; -- cgit v1.2.3 From 2671025d5613f462c2dfa3fe79332fa50cbbcd11 Mon Sep 17 00:00:00 2001 From: makefu Date: Sun, 27 Nov 2016 15:25:25 +0100 Subject: m 1 sdev: init --- makefu/1systems/sdev.nix | 56 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 makefu/1systems/sdev.nix diff --git a/makefu/1systems/sdev.nix b/makefu/1systems/sdev.nix new file mode 100644 index 00000000..233f7cef --- /dev/null +++ b/makefu/1systems/sdev.nix @@ -0,0 +1,56 @@ +{ lib, config, pkgs, ... }: +{ + krebs.build.host = config.krebs.hosts.sdev; + makefu.awesome.modkey = "Mod1"; + imports = + [ # Include the results of the hardware scan. + ../. + (toString ) + (toString ) + ../2configs/main-laptop.nix #< base-gui + # + + # environment + ../2configs/tinc/retiolum.nix + + ]; + # workaround for https://github.com/NixOS/nixpkgs/issues/16641 + services.xserver.videoDrivers = lib.mkOverride 45 [ "virtualbox" "modesetting" ]; + + nixpkgs.config.allowUnfree = true; + + # allow sdev to deploy self + users.extraUsers = { + root = { + openssh.authorizedKeys.keys = [ config.krebs.users.makefu-vbob.pubkey ]; + }; + }; + + environment.systemPackages = with pkgs;[ + ppp xclip + get + passwdqc-utils + docker + gnupg + populate + (pkgs.writeScriptBin "tor-browser" '' + #! /bin/sh + TOR_SKIP_LAUNCH=1 ${torbrowser}/bin/tor-browser + '') + ]; + + virtualisation.docker.enable = true; + + networking.firewall.allowedTCPPorts = [ + 25 + 80 + 8010 + ]; + + fileSystems."/media/share" = { + fsType = "vboxsf"; + device = "share"; + options = [ "rw" "uid=9001" "gid=9001" ]; + }; + +} -- cgit v1.2.3 From 78b4901cdf6bb6bce8c2a7890376734cbbd9291b Mon Sep 17 00:00:00 2001 From: makefu Date: Sun, 27 Nov 2016 15:25:53 +0100 Subject: s 1 wolf: use auth.anonymous.enable instead of extraOptions --- shared/1systems/wolf.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix index 8b097653..ce3c63f2 100644 --- a/shared/1systems/wolf.nix +++ b/shared/1systems/wolf.nix @@ -25,10 +25,10 @@ in services.grafana = { enable = true; addr = "0.0.0.0"; - extraOptions = { "AUTH_ANONYMOUS_ENABLED" = "true"; }; users.allowSignUp = true; users.allowOrgCreate = true; users.autoAssignOrg = true; + auth.anonymous.enable = true; security = import ; }; -- cgit v1.2.3