From 9ea2bb798657f8fdcb7b0291309a6e9fa315b529 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 22 Jul 2017 12:33:38 +0200 Subject: shell: drop unused config variable --- shell.nix | 4 ---- 1 file changed, 4 deletions(-) diff --git a/shell.nix b/shell.nix index 8c224a5f..5ea9ff3b 100644 --- a/shell.nix +++ b/shell.nix @@ -47,10 +47,8 @@ let ''; init.env = pkgs.writeText "init.env" /* sh */ '' - config=''${config-$user/1systems/$system/config.nix} source=''${source-$user/1systems/$system/source.nix} - export config export source export system export target @@ -98,7 +96,6 @@ let --readonly-mode \ --show-trace \ --strict \ - -I nixos-config="$config" \ "$source") echo $_source | ${pkgs.populate}/bin/populate \ @@ -118,7 +115,6 @@ let STOCKHOLM_VERSION=$STOCKHOLM_VERSION \ nix-shell \ --run $(q \ - config=$config \ system=$system \ target=$target \ using_proxy=true \ -- cgit v1.2.3 From 0aced4798237fb80690f13ea49922ad45762c91f Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 14:50:01 +0200 Subject: krebs buildbot: hostname agnostic --- krebs/2configs/shared-buildbot.nix | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/krebs/2configs/shared-buildbot.nix b/krebs/2configs/shared-buildbot.nix index dd430b7c..99710070 100644 --- a/krebs/2configs/shared-buildbot.nix +++ b/krebs/2configs/shared-buildbot.nix @@ -1,16 +1,18 @@ { lib, config, pkgs, ... }: -# The buildbot config is self-contained and currently provides a way +# The buildbot config is self-contained and currently provides a way # to test "krebs" configuration (infrastructure to be used by every krebsminister). # You can add your own test, test steps as required. Deploy the config on a # krebs host like wolf and everything should be fine. # TODO for all users schedule a build for fast tests -{ +let + hostname = config.networking.hostName; +in { # due to the fact that we actually build stuff on the box via the daemon, # /nix/store should be cleaned up automatically as well services.nginx.virtualHosts.build = { - serverAliases = [ "build.wolf.r" ]; + serverAliases = [ "build.${hostname}.r" ]; locations."/".extraConfig = '' proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; @@ -22,7 +24,7 @@ nix.gc.dates = "05:23"; networking.firewall.allowedTCPPorts = [ 8010 9989 ]; krebs.buildbot.master = let - stockholm-mirror-url = http://cgit.wolf.r/stockholm-mirror ; + stockholm-mirror-url = "http://cgit.${hostname}.r/stockholm" ; in { secrets = [ "retiolum-ci.rsa_key.priv" "cac.json" ]; workers = { @@ -155,13 +157,13 @@ }; irc = { enable = true; - nick = "wolfbot"; + nick = "${hostname}bot"; server = "ni.r"; channels = [ { channel = "retiolum"; } ]; allowForce = true; }; extraConfig = '' - c['buildbotURL'] = "http://build.wolf.r/" + c['buildbotURL'] = "http://build.${hostname}.r/" ''; }; @@ -173,6 +175,6 @@ packages = with pkgs; [ gnumake jq nix populate ]; # all nix commands will need a working nixpkgs installation extraEnviron = { - NIX_PATH="nixpkgs=/var/src/nixpkgs:nixos-config=./krebs/1systems/wolf/config.nix:stockholm=./"; }; + NIX_PATH="nixpkgs=/var/src/nixpkgs:nixos-config=./krebs/1systems/${hostname}/config.nix:stockholm=./"; }; }; } -- cgit v1.2.3 From 248d405f6171e134812a4cbd51b3fa2663e616b0 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 14:52:51 +0200 Subject: krebs buildbot: start nginx by default --- krebs/2configs/shared-buildbot.nix | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/krebs/2configs/shared-buildbot.nix b/krebs/2configs/shared-buildbot.nix index 99710070..135fcd65 100644 --- a/krebs/2configs/shared-buildbot.nix +++ b/krebs/2configs/shared-buildbot.nix @@ -11,18 +11,21 @@ let in { # due to the fact that we actually build stuff on the box via the daemon, # /nix/store should be cleaned up automatically as well - services.nginx.virtualHosts.build = { - serverAliases = [ "build.${hostname}.r" ]; - locations."/".extraConfig = '' - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_pass http://127.0.0.1:${toString config.krebs.buildbot.master.web.port}; - ''; + services.nginx = { + enable = true; + virtualHosts.build = { + serverAliases = [ "build.${hostname}.r" ]; + locations."/".extraConfig = '' + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_pass http://127.0.0.1:${toString config.krebs.buildbot.master.web.port}; + ''; + }; }; nix.gc.automatic = true; nix.gc.dates = "05:23"; - networking.firewall.allowedTCPPorts = [ 8010 9989 ]; + networking.firewall.allowedTCPPorts = [ 80 8010 9989 ]; krebs.buildbot.master = let stockholm-mirror-url = "http://cgit.${hostname}.r/stockholm" ; in { -- cgit v1.2.3 From 8243e53d893c22e9fd4fc852df30e6f2f3cae032 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 14:54:57 +0200 Subject: krebs buildbot: remove deprecated secrets --- krebs/2configs/shared-buildbot.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/krebs/2configs/shared-buildbot.nix b/krebs/2configs/shared-buildbot.nix index 135fcd65..a9e5afc7 100644 --- a/krebs/2configs/shared-buildbot.nix +++ b/krebs/2configs/shared-buildbot.nix @@ -29,7 +29,6 @@ in { krebs.buildbot.master = let stockholm-mirror-url = "http://cgit.${hostname}.r/stockholm" ; in { - secrets = [ "retiolum-ci.rsa_key.priv" "cac.json" ]; workers = { testworker = "krebspass"; }; -- cgit v1.2.3 From f5089ed60f26afba7e4366fabb3f787ab94e0822 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 15:16:28 +0200 Subject: krebs: add wolf-repo-sync user --- krebs/3modules/krebs/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/krebs/3modules/krebs/default.nix b/krebs/3modules/krebs/default.nix index f11b8ef4..c65a132d 100644 --- a/krebs/3modules/krebs/default.nix +++ b/krebs/3modules/krebs/default.nix @@ -38,6 +38,7 @@ in { ip6.addr = "42:0:0:0:0:0:77:2"; aliases = [ "puyak.r" + "build.puyak.r" ]; tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- @@ -94,5 +95,10 @@ in { krebs = { pubkey = "lol"; # TODO krebs.users.krebs.pubkey should be unnecessary }; + wolf-repo-sync = { + name = "wolf-repo-sync"; + mail = "spam@krebsco.de"; + pubkey = ''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwuAZB3wtAvBJFYh+gWdyGaZU4mtqM2dFXmh2rORlbXeh02msu1uv07ck1VKkQ4LgvCBcBsAOeVa1NTz99eLqutwgcqMCytvRNUCibcoEWwHObsK53KhDJj+zotwlFhnPPeK9+EpOP4ngh/tprJikttos5BwBwe2K+lfiid3fmVPZcTTYa77nCwijimMvWEx6CEjq1wiXMUc4+qcEn8Swbwomz/EEQdNE2hgoC3iMW9RqduTFdIJWnjVi0KaxenX9CvQRGbVK5SSu2gwzN59D/okQOCP6+p1gL5r3QRHSLSSRiEHctVQTkpKOifrtLZGSr5zArEmLd/cOVyssHQPCX repo-sync@wolf''; + }; }; } -- cgit v1.2.3 From 657e099f4a42c5fd707872b914d8d84ff939e849 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 15:19:05 +0200 Subject: krebs: add puyak-repo-sync user --- krebs/3modules/krebs/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/krebs/3modules/krebs/default.nix b/krebs/3modules/krebs/default.nix index c65a132d..c18c70e3 100644 --- a/krebs/3modules/krebs/default.nix +++ b/krebs/3modules/krebs/default.nix @@ -95,6 +95,11 @@ in { krebs = { pubkey = "lol"; # TODO krebs.users.krebs.pubkey should be unnecessary }; + puyak-repo-sync = { + name = "puyak-repo-sync"; + mail = "spam@krebsco.de"; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIILKVAxlz6L4yLL/4+MFk0YyzQSK+XI4ayxNQfLKepMj"; + }; wolf-repo-sync = { name = "wolf-repo-sync"; mail = "spam@krebsco.de"; -- cgit v1.2.3 From b4ad7cd86d59fbc003392068f6abec6f96720163 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 15:12:06 +0200 Subject: krebs: merge cgit-mirror into repo-sync --- krebs/1systems/wolf/config.nix | 1 - krebs/2configs/cgit-mirror.nix | 45 ---------------------- krebs/2configs/repo-sync.nix | 84 +++++++++++++++++++++++++++++++----------- 3 files changed, 62 insertions(+), 68 deletions(-) delete mode 100644 krebs/2configs/cgit-mirror.nix diff --git a/krebs/1systems/wolf/config.nix b/krebs/1systems/wolf/config.nix index ba897a26..32e7bd49 100644 --- a/krebs/1systems/wolf/config.nix +++ b/krebs/1systems/wolf/config.nix @@ -11,7 +11,6 @@ in - diff --git a/krebs/2configs/cgit-mirror.nix b/krebs/2configs/cgit-mirror.nix deleted file mode 100644 index c2326a5c..00000000 --- a/krebs/2configs/cgit-mirror.nix +++ /dev/null @@ -1,45 +0,0 @@ -{ config, lib, pkgs, ... }: - -with import ; -let - rules = with git; singleton { - user = [ wolf-repo-sync ]; - repo = [ stockholm-mirror ]; - perm = push ''refs/*'' [ non-fast-forward create delete merge ]; - }; - - stockholm-mirror = { - public = true; - name = "stockholm-mirror"; - cgit.desc = "mirror for all stockholm branches"; - hooks = { - post-receive = pkgs.git-hooks.irc-announce { - nick = config.networking.hostName; - verbose = false; - channel = "#retiolum"; - server = "ni.r"; - }; - }; - }; - - wolf-repo-sync = { - name = "wolf-repo-sync"; - mail = "spam@krebsco.de"; - # TODO put git-sync pubkey somewhere more appropriate - pubkey = ''ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwuAZB3wtAvBJFYh+gWdyGaZU4mtqM2dFXmh2rORlbXeh02msu1uv07ck1VKkQ4LgvCBcBsAOeVa1NTz99eLqutwgcqMCytvRNUCibcoEWwHObsK53KhDJj+zotwlFhnPPeK9+EpOP4ngh/tprJikttos5BwBwe2K+lfiid3fmVPZcTTYa77nCwijimMvWEx6CEjq1wiXMUc4+qcEn8Swbwomz/EEQdNE2hgoC3iMW9RqduTFdIJWnjVi0KaxenX9CvQRGbVK5SSu2gwzN59D/okQOCP6+p1gL5r3QRHSLSSRiEHctVQTkpKOifrtLZGSr5zArEmLd/cOVyssHQPCX repo-sync@wolf''; - }; - -in { - krebs.users.wolf-repo-sync = wolf-repo-sync; - krebs.git = { - enable = true; - cgit = { - settings = { - root-title = "Shared Repos"; - root-desc = "keep on krebsing"; - }; - }; - inherit rules; - repos.stockholm-mirror = stockholm-mirror; - }; -} diff --git a/krebs/2configs/repo-sync.nix b/krebs/2configs/repo-sync.nix index 637a26e3..87a8bd82 100644 --- a/krebs/2configs/repo-sync.nix +++ b/krebs/2configs/repo-sync.nix @@ -1,31 +1,71 @@ { config, lib, pkgs, ... }: -with lib; -{ - krebs.repo-sync = let - # TODO addMirrorURL function - mirror = "git@wolf:stockholm-mirror"; - in { - enable = true; - repos.stockholm = { - branches = { - makefu = { - origin.url = http://cgit.gum/stockholm ; - mirror.url = mirror; +with import ; + +let + mirror = "git@${config.networking.hostName}:"; + + defineRepo = name: announce: let + repo = { + public = true; + name = mkDefault "${name}"; + cgit.desc = mkDefault "mirror for ${name}"; + cgit.section = mkDefault "mirror"; + hooks = mkIf announce (mkDefault { + post-receive = pkgs.git-hooks.irc-announce { + nick = config.networking.hostName; + verbose = false; + channel = "#retiolum"; + server = "ni.r"; + branches = [ "newest" ]; }; - tv = { - origin.url = http://cgit.ni.r/stockholm; - mirror.url = mirror; + }); + }; + in { + rules = with git; singleton { + user = with config.krebs.users; [ + config.krebs.users."${config.networking.hostName}-repo-sync" + ]; + repo = [ repo ]; + perm = push ''refs/*'' [ non-fast-forward create delete merge ]; + }; + repos."${name}" = repo; + }; + + sync-retiolum = name: + { + krebs.repo-sync.repos.${name} = { + branches = { + makefu = { + origin.url = "http://cgit.gum/${name}"; + mirror.url = "${mirror}${name}"; + }; + tv = { + origin.url = "http://cgit.ni.r/${name}"; + mirror.url = "${mirror}${name}"; + }; + nin = { + origin.url = "http://cgit.onondaga.r/${name}"; + mirror.url = "${mirror}${name}"; + }; + lassulus = { + origin.url = "http://cgit.lassul.us/${name}"; + mirror.url = "${mirror}${name}"; + }; }; - lassulus = { - origin.url = http://cgit.prism/stockholm ; - mirror.url = mirror; + latest = { + url = "${mirror}${name}"; + ref = "heads/newest"; }; }; - latest = { - url = mirror; - ref = "heads/master"; - }; + krebs.git = defineRepo name true; }; + +in { + krebs.repo-sync = { + enable = true; }; + imports = [ + (sync-retiolum "stockholm") + ]; } -- cgit v1.2.3 From 4d5e38ba5871bf79bcaf9de838399e01ea982830 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 15:21:29 +0200 Subject: krebs puyak: add repo-sync & buildbot --- krebs/1systems/puyak/config.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix index 5e5f6cdb..f55da019 100644 --- a/krebs/1systems/puyak/config.nix +++ b/krebs/1systems/puyak/config.nix @@ -5,6 +5,9 @@ + + + ]; krebs.build.host = config.krebs.hosts.puyak; -- cgit v1.2.3 From e7915c7d11752e57870aefa2eb711a26ee4f331d Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 22 Jul 2017 19:18:02 +0200 Subject: tv ejabberd: 2.1.13 -> upstream --- tv/3modules/ejabberd/config.nix | 218 +++++++++++++++++++++++---------------- tv/3modules/ejabberd/default.nix | 42 ++++++-- tv/5pkgs/default.nix | 4 - tv/5pkgs/ejabberd/default.nix | 28 ----- 4 files changed, 162 insertions(+), 130 deletions(-) delete mode 100644 tv/5pkgs/ejabberd/default.nix diff --git a/tv/3modules/ejabberd/config.nix b/tv/3modules/ejabberd/config.nix index 29c38fbe..68bcfa34 100644 --- a/tv/3modules/ejabberd/config.nix +++ b/tv/3modules/ejabberd/config.nix @@ -1,93 +1,129 @@ -{ config, ... }: with import ; let - cfg = config.tv.ejabberd; +with import ; +{ config, ... }: let - # XXX this is a placeholder that happens to work the default strings. - toErlang = builtins.toJSON; -in toFile "ejabberd.conf" '' - {loglevel, 3}. - {hosts, ${toErlang cfg.hosts}}. - {listen, - [ - {5222, ejabberd_c2s, [ - starttls, - {certfile, ${toErlang cfg.certfile.path}}, - {access, c2s}, - {shaper, c2s_shaper}, - {max_stanza_size, 65536} - ]}, - {5269, ejabberd_s2s_in, [ - {shaper, s2s_shaper}, - {max_stanza_size, 131072} - ]}, - {5280, ejabberd_http, [ - captcha, - http_bind, - http_poll, - web_admin - ]} - ]}. - {s2s_use_starttls, required}. - {s2s_certfile, ${toErlang cfg.s2s_certfile.path}}. - {auth_method, internal}. - {shaper, normal, {maxrate, 1000}}. - {shaper, fast, {maxrate, 50000}}. - {max_fsm_queue, 1000}. - {acl, local, {user_regexp, ""}}. - {access, max_user_sessions, [{10, all}]}. - {access, max_user_offline_messages, [{5000, admin}, {100, all}]}. - {access, local, [{allow, local}]}. - {access, c2s, [{deny, blocked}, - {allow, all}]}. - {access, c2s_shaper, [{none, admin}, - {normal, all}]}. - {access, s2s_shaper, [{fast, all}]}. - {access, announce, [{allow, admin}]}. - {access, configure, [{allow, admin}]}. - {access, muc_admin, [{allow, admin}]}. - {access, muc_create, [{allow, local}]}. - {access, muc, [{allow, all}]}. - {access, pubsub_createnode, [{allow, local}]}. - {access, register, [{allow, all}]}. - {language, "en"}. - {modules, - [ - {mod_adhoc, []}, - {mod_announce, [{access, announce}]}, - {mod_blocking,[]}, - {mod_caps, []}, - {mod_configure,[]}, - {mod_disco, []}, - {mod_irc, []}, - {mod_http_bind, []}, - {mod_last, []}, - {mod_muc, [ - {access, muc}, - {access_create, muc_create}, - {access_persistent, muc_create}, - {access_admin, muc_admin} - ]}, - {mod_offline, [{access_max_user_messages, max_user_offline_messages}]}, - {mod_ping, []}, - {mod_privacy, []}, - {mod_private, []}, - {mod_pubsub, [ - {access_createnode, pubsub_createnode}, - {ignore_pep_from_offline, true}, - {last_item_cache, false}, - {plugins, ["flat", "hometree", "pep"]} - ]}, - {mod_register, [ - {welcome_message, {"Welcome!", - "Hi.\nWelcome to this XMPP server."}}, - {ip_access, [{allow, "127.0.0.0/8"}, - {deny, "0.0.0.0/0"}]}, - {access, register} - ]}, - {mod_roster, []}, - {mod_shared_roster,[]}, - {mod_stats, []}, - {mod_time, []}, - {mod_vcard, []}, - {mod_version, []} - ]}. + # See https://github.com/processone/ejabberd/blob/master/ejabberd.yml.example + + ciphers = concatStringsSep ":" [ + "ECDHE-ECDSA-AES256-GCM-SHA384" + "ECDHE-RSA-AES256-GCM-SHA384" + "ECDHE-ECDSA-CHACHA20-POLY1305" + "ECDHE-RSA-CHACHA20-POLY1305" + "ECDHE-ECDSA-AES128-GCM-SHA256" + "ECDHE-RSA-AES128-GCM-SHA256" + "ECDHE-ECDSA-AES256-SHA384" + "ECDHE-RSA-AES256-SHA384" + "ECDHE-ECDSA-AES128-SHA256" + "ECDHE-RSA-AES128-SHA256" + ]; + + protocol_options = [ + "no_sslv2" + "no_sslv3" + "no_tlsv1" + "no_tlsv1_10" + ]; + +in /* yaml */ '' + + access_rules: + announce: + - allow: admin + local: + - allow: local + configure: + - allow: admin + register: + - allow + s2s: + - allow + trusted_network: + - allow: loopback + + acl: + local: + user_regexp: "" + loopback: + ip: + - "127.0.0.0/8" + - "::1/128" + - "::FFFF:127.0.0.1/128" + + hosts: ${toJSON config.hosts} + + language: "en" + + listen: + - + port: 5222 + ip: "::" + module: ejabberd_c2s + shaper: c2s_shaper + certfile: ${toJSON config.certfile.path} + ciphers: ${toJSON ciphers} + dhfile: ${toJSON config.dhfile.path} + protocol_options: ${toJSON protocol_options} + starttls: true + starttls_required: true + tls: false + tls_compression: false + max_stanza_size: 65536 + - + port: 5269 + ip: "::" + module: ejabberd_s2s_in + shaper: s2s_shaper + max_stanza_size: 131072 + + loglevel: 4 + + modules: + mod_adhoc: {} + mod_admin_extra: {} + mod_announce: + access: announce + mod_caps: {} + mod_carboncopy: {} + mod_client_state: {} + mod_configure: {} + mod_disco: {} + mod_echo: {} + mod_irc: {} + mod_bosh: {} + mod_last: {} + mod_offline: + access_max_user_messages: max_user_offline_messages + mod_ping: {} + mod_privacy: {} + mod_private: {} + mod_register: + access_from: deny + access: register + ip_access: trusted_network + registration_watchers: ${toJSON config.registration_watchers} + mod_roster: {} + mod_shared_roster: {} + mod_stats: {} + mod_time: {} + mod_vcard: + search: false + mod_version: {} + mod_http_api: {} + + s2s_access: s2s + s2s_certfile: ${toJSON config.s2s_certfile.path} + s2s_ciphers: ${toJSON ciphers} + s2s_dhfile: ${toJSON config.dhfile.path} + s2s_protocol_options: ${toJSON protocol_options} + s2s_tls_compression: false + s2s_use_starttls: required + + shaper_rules: + max_user_offline_messages: + - 5000: admin + - 100 + max_user_sessions: 10 + c2s_shaper: + - none: admin + - normal + s2s_shaper: fast '' diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 4d3493d7..d7b8deb7 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -1,5 +1,17 @@ { config, lib, pkgs, ... }@args: with import ; let + cfg = config.tv.ejabberd; + + gen-dhparam = pkgs.writeDash "gen-dhparam" '' + set -efu + path=$1 + bits=2048 + # TODO regenerate dhfile after some time? + if ! test -e "$path"; then + ${pkgs.openssl}/bin/openssl dhparam "$bits" > "$path" + fi + ''; + in { options.tv.ejabberd = { enable = mkEnableOption "tv.ejabberd"; @@ -11,20 +23,36 @@ in { source-path = toString + "/ejabberd.pem"; }; }; + dhfile = mkOption { + type = types.secret-file; + default = { + path = "${cfg.user.home}/dhparams.pem"; + owner = cfg.user; + source-path = "/dev/null"; + }; + }; hosts = mkOption { type = with types; listOf str; }; pkgs.ejabberdctl = mkOption { type = types.package; default = pkgs.writeDashBin "ejabberdctl" '' - set -efu - export SPOOLDIR=${shell.escape cfg.user.home} - export EJABBERD_CONFIG_PATH=${shell.escape (import ./config.nix args)} exec ${pkgs.ejabberd}/bin/ejabberdctl \ + --config ${toFile "ejabberd.yaml" (import ./config.nix { + inherit pkgs; + config = cfg; + })} \ --logs ${shell.escape cfg.user.home} \ + --spool ${shell.escape cfg.user.home} \ "$@" ''; }; + registration_watchers = mkOption { + type = types.listOf types.str; + default = [ + config.krebs.users.tv.mail + ]; + }; s2s_certfile = mkOption { type = types.secret-file; default = cfg.certfile; @@ -50,12 +78,12 @@ in { requires = [ "secret.service" ]; after = [ "network.target" "secret.service" ]; serviceConfig = { - Type = "oneshot"; - RemainAfterExit = "yes"; - PermissionsStartOnly = "true"; + ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}"; + ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl foreground"; + PermissionsStartOnly = true; SyslogIdentifier = "ejabberd"; User = cfg.user.name; - ExecStart = "${cfg.pkgs.ejabberdctl}/bin/ejabberdctl start"; + TimeoutStartSec = 60; }; }; diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix index 284e42a7..02410e8e 100644 --- a/tv/5pkgs/default.nix +++ b/tv/5pkgs/default.nix @@ -28,10 +28,6 @@ in { "$@" ''; - ejabberd = callPackage ./ejabberd { - erlang = self.erlangR16; - }; - ff = self.writeDashBin "ff" '' exec ${self.firefoxWrapper}/bin/firefox "$@" ''; diff --git a/tv/5pkgs/ejabberd/default.nix b/tv/5pkgs/ejabberd/default.nix deleted file mode 100644 index 3a77c5cd..00000000 --- a/tv/5pkgs/ejabberd/default.nix +++ /dev/null @@ -1,28 +0,0 @@ -{stdenv, fetchurl, expat, erlang, zlib, openssl, pam, lib}: - -stdenv.mkDerivation rec { - version = "2.1.13"; - name = "ejabberd-${version}"; - src = fetchurl { - url = "http://www.process-one.net/downloads/ejabberd/${version}/${name}.tgz"; - sha256 = "0vf8mfrx7vr3c5h3nfp3qcgwf2kmzq20rjv1h9sk3nimwir1q3d8"; - }; - buildInputs = [ expat erlang zlib openssl pam ]; - patchPhase = '' - sed -i \ - -e "s|erl \\\|${erlang}/bin/erl \\\|" \ - -e 's|EXEC_CMD=\"sh -c\"|EXEC_CMD=\"${stdenv.shell} -c\"|' \ - src/ejabberdctl.template - ''; - preConfigure = '' - cd src - ''; - configureFlags = ["--enable-pam"]; - - meta = { - description = "Open-source XMPP application server written in Erlang"; - license = stdenv.lib.licenses.gpl2; - homepage = http://www.ejabberd.im; - maintainers = [ lib.maintainers.sander ]; - }; -} -- cgit v1.2.3 From 0b300dc90e675cb02a50abd88bad66365f5abd93 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 20:37:20 +0200 Subject: krebs repo-sync: activate also git --- krebs/2configs/repo-sync.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/krebs/2configs/repo-sync.nix b/krebs/2configs/repo-sync.nix index 87a8bd82..157a30e6 100644 --- a/krebs/2configs/repo-sync.nix +++ b/krebs/2configs/repo-sync.nix @@ -65,6 +65,15 @@ in { krebs.repo-sync = { enable = true; }; + krebs.git = { + enable = mkDefault true; + cgit = { + settings = { + root-title = "Shared Repos"; + root-desc = "keep on krebsing"; + }; + }; + }; imports = [ (sync-retiolum "stockholm") ]; -- cgit v1.2.3 From 6dd39253a6d3fb833c36ed0a18e484575c2cfb4a Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 20:37:41 +0200 Subject: krebs: add cgit.puyak.r --- krebs/3modules/krebs/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/krebs/3modules/krebs/default.nix b/krebs/3modules/krebs/default.nix index c18c70e3..172e791b 100644 --- a/krebs/3modules/krebs/default.nix +++ b/krebs/3modules/krebs/default.nix @@ -39,6 +39,7 @@ in { aliases = [ "puyak.r" "build.puyak.r" + "cgit.puyak.r" ]; tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- -- cgit v1.2.3 From 8d123b954181aed5f769a4706ba26a3579fd987d Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 20:38:51 +0200 Subject: puyak-repo-sync: rotate pubkey --- krebs/3modules/krebs/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/krebs/3modules/krebs/default.nix b/krebs/3modules/krebs/default.nix index 172e791b..f751b4f9 100644 --- a/krebs/3modules/krebs/default.nix +++ b/krebs/3modules/krebs/default.nix @@ -99,7 +99,7 @@ in { puyak-repo-sync = { name = "puyak-repo-sync"; mail = "spam@krebsco.de"; - pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIILKVAxlz6L4yLL/4+MFk0YyzQSK+XI4ayxNQfLKepMj"; + pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ+18mG/cV1YbR9PXzuu3ScyV9kENy08OXUntpmgh9H2"; }; wolf-repo-sync = { name = "wolf-repo-sync"; -- cgit v1.2.3 From edfd8ca19101e0c5c99fb799f05bd404c6d2287b Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 20:47:05 +0200 Subject: krebs git: fix initial chown --- krebs/3modules/git.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix index 884108eb..93211d9d 100644 --- a/krebs/3modules/git.nix +++ b/krebs/3modules/git.nix @@ -569,7 +569,8 @@ let if ! test -d "$repodir"; then mkdir -m "$mode" "$repodir" git init --bare --template=/var/empty "$repodir" - chown -R git:nogroup "$repodir" + # TODO fix correctly with stringAfter + chown -R ${toString config.users.users.git.uid}:nogroup "$repodir" fi ln -s ${hooks} "$repodir/hooks" '' -- cgit v1.2.3 From a0208307ae1a8069559af39953569275a6d7ee6d Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 20 Jul 2017 19:32:41 +0200 Subject: make install: repair by using source.nix --- Makefile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 0a9b4f29..f2583078 100644 --- a/Makefile +++ b/Makefile @@ -102,7 +102,13 @@ ifneq ($(ssh),) populate: populate-flags += --ssh=$(ssh) endif populate: - $(call evaluate,config.krebs.build.source) --json --strict | \ + nix-instantiate \ + --eval \ + --json \ + --readonly-mode \ + --show-trace \ + --strict \ + $(LOGNAME)/1systems/$(system)/source.nix | \ populate $(populate-target) $(populate-flags) # usage: make pkgs.populate -- cgit v1.2.3 From 67bfd42d630e0d72bbee91931fbfae4f79d309c3 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 20 Jul 2017 20:20:32 +0200 Subject: infest prepare: sed NIX_PATH more lenient --- krebs/4lib/infest/prepare.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/krebs/4lib/infest/prepare.sh b/krebs/4lib/infest/prepare.sh index 50d521e1..d39aca34 100644 --- a/krebs/4lib/infest/prepare.sh +++ b/krebs/4lib/infest/prepare.sh @@ -102,7 +102,7 @@ prepare_nixos_iso() { mkdir -p bin rm -f bin/nixos-install cp "$(type -p nixos-install)" bin/nixos-install - sed -i "s@^NIX_PATH=\"[^\"]*\"@NIX_PATH=$target_path@" bin/nixos-install + sed -i "s@NIX_PATH=\"[^\"]*\"@NIX_PATH=$target_path@" bin/nixos-install } get_nixos_install() { -- cgit v1.2.3 From f4a192f5f83d5e8a88c0e287b45c0fadf12f6907 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 21:59:00 +0200 Subject: krebs: init backup.nix --- krebs/2configs/backup.nix | 21 +++++++++++++++++++++ krebs/2configs/default.nix | 3 +++ 2 files changed, 24 insertions(+) create mode 100644 krebs/2configs/backup.nix diff --git a/krebs/2configs/backup.nix b/krebs/2configs/backup.nix new file mode 100644 index 00000000..7ee43878 --- /dev/null +++ b/krebs/2configs/backup.nix @@ -0,0 +1,21 @@ +{ config, lib, ... }: +with import ; +{ + krebs.backup.plans = { + } // mapAttrs (_: recursiveUpdate { + snapshots = { + daily = { format = "%Y-%m-%d"; retain = 7; }; + weekly = { format = "%YW%W"; retain = 4; }; + monthly = { format = "%Y-%m"; retain = 12; }; + yearly = { format = "%Y"; }; + }; + }) { + wolf-share-puyak = { + method = "pull"; + src = { host = config.krebs.hosts.wolf; path = "/home/share"; }; + dst = { host = config.krebs.hosts.puyak; path = "/bku/wolf-share"; }; + startAt = "03:00"; + }; + }; +} + diff --git a/krebs/2configs/default.nix b/krebs/2configs/default.nix index 901516e5..daf9bd9d 100644 --- a/krebs/2configs/default.nix +++ b/krebs/2configs/default.nix @@ -2,6 +2,9 @@ with import ; { + imports = [ + ./backup.nix + ]; krebs.enable = true; krebs.tinc.retiolum.enable = true; -- cgit v1.2.3 From 54b86a5bcd8931171b31fb15ae5c0bbc1e1756cb Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 22:09:44 +0200 Subject: krebs puyak: add /bku --- krebs/1systems/puyak/config.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix index f55da019..bcf63dc4 100644 --- a/krebs/1systems/puyak/config.nix +++ b/krebs/1systems/puyak/config.nix @@ -30,6 +30,11 @@ "/boot" = { device = "/dev/sda2"; }; + "/bku" = { + device = "/dev/mapper/pool-bku"; + fsType = "btrfs"; + options = ["defaults" "noatime" "ssd" "compress=lzo"]; + }; "/home" = { device = "/dev/mapper/pool-home"; fsType = "btrfs"; -- cgit v1.2.3 From e9f318037c47fc3f588798da5b53b430c47860bd Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 22:15:40 +0200 Subject: l icarus: (re)add /bku --- lass/1systems/icarus/config.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lass/1systems/icarus/config.nix b/lass/1systems/icarus/config.nix index 1d20c081..61837bf3 100644 --- a/lass/1systems/icarus/config.nix +++ b/lass/1systems/icarus/config.nix @@ -36,11 +36,11 @@ "/boot" = { device = "/dev/sda2"; }; - #"/bku" = { - # device = "/dev/mapper/pool-bku"; - # fsType = "btrfs"; - # options = ["defaults" "noatime" "ssd" "compress=lzo"]; - #}; + "/bku" = { + device = "/dev/mapper/pool-bku"; + fsType = "btrfs"; + options = ["defaults" "noatime" "ssd" "compress=lzo"]; + }; "/home" = { device = "/dev/mapper/pool-home"; fsType = "btrfs"; -- cgit v1.2.3 From 04dfdb5ec644cd3786a4e374304fefc275682ef2 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 23:01:39 +0200 Subject: krebs fetchWallpaper: allow everyone to enter dir --- krebs/3modules/fetchWallpaper.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/krebs/3modules/fetchWallpaper.nix b/krebs/3modules/fetchWallpaper.nix index e00c0ec9..cdb9fe70 100644 --- a/krebs/3modules/fetchWallpaper.nix +++ b/krebs/3modules/fetchWallpaper.nix @@ -49,6 +49,7 @@ let set -euf mkdir -p ${cfg.stateDir} + chmod o+rx ${cfg.stateDir} cd ${cfg.stateDir} (curl --max-time ${toString cfg.maxTime} -s -o wallpaper.tmp -z wallpaper ${shell.escape cfg.url} && mv wallpaper.tmp wallpaper) || : feh --no-fehbg --bg-scale ${shell.escape cfg.stateDir}/wallpaper -- cgit v1.2.3 From dc183f8b23242d16bae764f927cf3b22fce5260c Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 23:02:26 +0200 Subject: l backups: don't push to mors --- lass/2configs/backups.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lass/2configs/backups.nix b/lass/2configs/backups.nix index abc55a0e..c4fb8542 100644 --- a/lass/2configs/backups.nix +++ b/lass/2configs/backups.nix @@ -134,7 +134,7 @@ with import ; startAt = "03:55"; }; icarus-home-mors = { - method = "push"; + method = "pull"; src = { host = config.krebs.hosts.icarus; path = "/home"; }; dst = { host = config.krebs.hosts.mors; path = "/bku/icarus-home"; }; startAt = "05:00"; -- cgit v1.2.3 From 54a594dc474255b24bbff80bb6be28e6a1a523d4 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 22 Jul 2017 23:01:18 +0200 Subject: krebs backup: extend api with timerConfig --- krebs/3modules/backup.nix | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix index bfb0ab59..6f015d66 100644 --- a/krebs/3modules/backup.nix +++ b/krebs/3modules/backup.nix @@ -54,6 +54,12 @@ let }; }); }; + timerConfig = mkOption { + type = with types; attrsOf str; + default = optionalAttrs (config.startAt != null) { + OnCalendar = config.startAt; + }; + }; }; })); }; @@ -82,11 +88,19 @@ let SyslogIdentifier = ExecStart.name; Type = "oneshot"; }; - startAt = mkIf (plan.startAt != null) plan.startAt; }) (filter (plan: build-host-is "pull" "dst" plan || build-host-is "push" "src" plan) enabled-plans)); + systemd.timers = + listToAttrs (map (plan: nameValuePair "backup.${plan.name}" { + wantedBy = [ "timers.target" ]; + timerConfig = plan.timerConfig; + }) (filter (plan: plan.timerConfig != {} && ( + build-host-is "pull" "dst" plan || + build-host-is "push" "src" plan)) + enabled-plans)); + users.groups.backup.gid = genid "backup"; users.users.root.openssh.authorizedKeys.keys = map (plan: getAttr plan.method { -- cgit v1.2.3