From f893b548531b77cd7f08c02ca9438c7b4b054126 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 20 Sep 2022 11:14:28 +0200 Subject: github-known-hosts: update list --- krebs/3modules/github-known-hosts.nix | 28 ++++++++-------------------- 1 file changed, 8 insertions(+), 20 deletions(-) diff --git a/krebs/3modules/github-known-hosts.nix b/krebs/3modules/github-known-hosts.nix index eec719f2..5de88762 100644 --- a/krebs/3modules/github-known-hosts.nix +++ b/krebs/3modules/github-known-hosts.nix @@ -44,34 +44,22 @@ "143.55.77.*" "143.55.78.*" "143.55.79.*" - "13.114.40.48" - "52.192.72.89" - "52.69.186.44" - "15.164.81.167" - "52.78.231.108" - "13.234.176.102" - "13.234.210.38" - "13.236.229.21" - "13.237.44.5" - "52.64.108.95" "20.201.28.151" "20.205.243.166" "102.133.202.242" "20.248.137.48" - "18.181.13.223" - "54.238.117.237" - "54.168.17.15" - "3.34.26.58" - "13.125.114.27" - "3.7.2.84" - "3.6.106.81" - "52.63.152.235" - "3.105.147.174" - "3.106.158.203" + "20.207.73.82" + "20.27.177.113" + "20.200.245.247" + "20.233.54.53" "20.201.28.152" "20.205.243.160" "102.133.202.246" "20.248.137.50" + "20.207.73.83" + "20.27.177.118" + "20.200.245.248" + "20.233.54.52" ]; publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="; }; -- cgit v1.2.3 From 0c589031c02d6114d05131b249a559e06c802c1f Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 20 Sep 2022 11:17:19 +0200 Subject: krebs: move github modules to subdir --- krebs/3modules/default.nix | 3 +- krebs/3modules/github-hosts-sync.nix | 86 ----------------------------------- krebs/3modules/github-known-hosts.nix | 66 --------------------------- krebs/3modules/github/default.nix | 6 +++ krebs/3modules/github/hosts-sync.nix | 86 +++++++++++++++++++++++++++++++++++ krebs/3modules/github/known-hosts.nix | 66 +++++++++++++++++++++++++++ 6 files changed, 159 insertions(+), 154 deletions(-) delete mode 100644 krebs/3modules/github-hosts-sync.nix delete mode 100644 krebs/3modules/github-known-hosts.nix create mode 100644 krebs/3modules/github/default.nix create mode 100644 krebs/3modules/github/hosts-sync.nix create mode 100644 krebs/3modules/github/known-hosts.nix diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 7f007048..5ba43658 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -25,8 +25,7 @@ let ./exim.nix ./fetchWallpaper.nix ./git.nix - ./github-hosts-sync.nix - ./github-known-hosts.nix + ./github ./go.nix ./hidden-ssh.nix ./hosts.nix diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix deleted file mode 100644 index 71eed6c6..00000000 --- a/krebs/3modules/github-hosts-sync.nix +++ /dev/null @@ -1,86 +0,0 @@ -{ config, lib, pkgs, ... }: - -with import ; -let - cfg = config.krebs.github-hosts-sync; - - out = { - options.krebs.github-hosts-sync = api; - config = lib.mkIf cfg.enable imp; - }; - - api = { - enable = mkEnableOption "krebs.github-hosts-sync"; - dataDir = mkOption { - type = types.str; # TODO path (but not just into store) - default = "/var/lib/github-hosts-sync"; - }; - srcDir = mkOption { - type = types.str; - default = "${config.krebs.tinc.retiolum.confDir}/hosts"; - defaultText = "\${config.krebs.tinc.retiolum.confDir}/hosts"; - }; - ssh-identity-file = mkOption { - type = types.suffixed-str [".ssh.id_ed25519" ".ssh.id_rsa"]; - default = toString ; - defaultText = "‹secrets/github-hosts-sync.ssh.id_ed25519›"; - }; - url = mkOption { - type = types.str; - default = "git@github.com:krebs/hosts.git"; - }; - workTree = mkOption { - type = types.absolute-pathname; - default = "${cfg.dataDir}/cache"; - }; - }; - - imp = { - systemd.services.github-hosts-sync = { - after = [ "network.target" ]; - wantedBy = [ "multi-user.target" ]; - environment = { - GITHUB_HOST_SYNC_USER_MAIL = user.mail; - GITHUB_HOST_SYNC_USER_NAME = user.name; - GITHUB_HOST_SYNC_SRCDIR = cfg.srcDir; - GITHUB_HOST_SYNC_WORKTREE = cfg.workTree; - GITHUB_HOST_SYNC_URL = cfg.url; - }; - serviceConfig = { - PermissionsStartOnly = "true"; - SyslogIdentifier = "github-hosts-sync"; - User = user.name; - Type = "oneshot"; - RemainAfterExit = true; - ExecStartPre = pkgs.writeDash "github-hosts-sync-init" '' - set -euf - install -m 0711 -o ${user.name} -d ${cfg.dataDir} - install -m 0700 -o ${user.name} -d ${cfg.dataDir}/.ssh - install -m 0400 -o ${user.name} \ - ${cfg.ssh-identity-file} \ - ${cfg.dataDir}/.ssh/${fileExtension cfg.ssh-identity-file} - ''; - ExecStart = "${pkgs.github-hosts-sync}/bin/github-hosts-sync"; - }; - }; - - users.users.${user.name} = { - inherit (user) uid; - group = user.name; - home = cfg.dataDir; - isSystemUser = true; - }; - }; - - users.groups.${user.name} = {}; - - user = rec { - mail = "${name}@${config.krebs.build.host.name}"; - name = "github-hosts-sync"; - uid = genid_uint31 name; - }; - - # TODO move to lib? - fileExtension = s: last (splitString "." s); - -in out diff --git a/krebs/3modules/github-known-hosts.nix b/krebs/3modules/github-known-hosts.nix deleted file mode 100644 index 5de88762..00000000 --- a/krebs/3modules/github-known-hosts.nix +++ /dev/null @@ -1,66 +0,0 @@ -{ - services.openssh.knownHosts.github = { - hostNames = [ - "github.com" - # List generated with (IPv6 addresses are currently ignored): - # curl -sS https://api.github.com/meta | jq -r .git[] | grep -v : | nix-shell -p cidr2glob --run cidr2glob | jq -R . - "192.30.252.*" - "192.30.253.*" - "192.30.254.*" - "192.30.255.*" - "185.199.108.*" - "185.199.109.*" - "185.199.110.*" - "185.199.111.*" - "140.82.112.*" - "140.82.113.*" - "140.82.114.*" - "140.82.115.*" - "140.82.116.*" - "140.82.117.*" - "140.82.118.*" - "140.82.119.*" - "140.82.120.*" - "140.82.121.*" - "140.82.122.*" - "140.82.123.*" - "140.82.124.*" - "140.82.125.*" - "140.82.126.*" - "140.82.127.*" - "143.55.64.*" - "143.55.65.*" - "143.55.66.*" - "143.55.67.*" - "143.55.68.*" - "143.55.69.*" - "143.55.70.*" - "143.55.71.*" - "143.55.72.*" - "143.55.73.*" - "143.55.74.*" - "143.55.75.*" - "143.55.76.*" - "143.55.77.*" - "143.55.78.*" - "143.55.79.*" - "20.201.28.151" - "20.205.243.166" - "102.133.202.242" - "20.248.137.48" - "20.207.73.82" - "20.27.177.113" - "20.200.245.247" - "20.233.54.53" - "20.201.28.152" - "20.205.243.160" - "102.133.202.246" - "20.248.137.50" - "20.207.73.83" - "20.27.177.118" - "20.200.245.248" - "20.233.54.52" - ]; - publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="; - }; -} diff --git a/krebs/3modules/github/default.nix b/krebs/3modules/github/default.nix new file mode 100644 index 00000000..2df4ba71 --- /dev/null +++ b/krebs/3modules/github/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./hosts-sync.nix + ./known-hosts.nix + ]; +} diff --git a/krebs/3modules/github/hosts-sync.nix b/krebs/3modules/github/hosts-sync.nix new file mode 100644 index 00000000..71eed6c6 --- /dev/null +++ b/krebs/3modules/github/hosts-sync.nix @@ -0,0 +1,86 @@ +{ config, lib, pkgs, ... }: + +with import ; +let + cfg = config.krebs.github-hosts-sync; + + out = { + options.krebs.github-hosts-sync = api; + config = lib.mkIf cfg.enable imp; + }; + + api = { + enable = mkEnableOption "krebs.github-hosts-sync"; + dataDir = mkOption { + type = types.str; # TODO path (but not just into store) + default = "/var/lib/github-hosts-sync"; + }; + srcDir = mkOption { + type = types.str; + default = "${config.krebs.tinc.retiolum.confDir}/hosts"; + defaultText = "\${config.krebs.tinc.retiolum.confDir}/hosts"; + }; + ssh-identity-file = mkOption { + type = types.suffixed-str [".ssh.id_ed25519" ".ssh.id_rsa"]; + default = toString ; + defaultText = "‹secrets/github-hosts-sync.ssh.id_ed25519›"; + }; + url = mkOption { + type = types.str; + default = "git@github.com:krebs/hosts.git"; + }; + workTree = mkOption { + type = types.absolute-pathname; + default = "${cfg.dataDir}/cache"; + }; + }; + + imp = { + systemd.services.github-hosts-sync = { + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + environment = { + GITHUB_HOST_SYNC_USER_MAIL = user.mail; + GITHUB_HOST_SYNC_USER_NAME = user.name; + GITHUB_HOST_SYNC_SRCDIR = cfg.srcDir; + GITHUB_HOST_SYNC_WORKTREE = cfg.workTree; + GITHUB_HOST_SYNC_URL = cfg.url; + }; + serviceConfig = { + PermissionsStartOnly = "true"; + SyslogIdentifier = "github-hosts-sync"; + User = user.name; + Type = "oneshot"; + RemainAfterExit = true; + ExecStartPre = pkgs.writeDash "github-hosts-sync-init" '' + set -euf + install -m 0711 -o ${user.name} -d ${cfg.dataDir} + install -m 0700 -o ${user.name} -d ${cfg.dataDir}/.ssh + install -m 0400 -o ${user.name} \ + ${cfg.ssh-identity-file} \ + ${cfg.dataDir}/.ssh/${fileExtension cfg.ssh-identity-file} + ''; + ExecStart = "${pkgs.github-hosts-sync}/bin/github-hosts-sync"; + }; + }; + + users.users.${user.name} = { + inherit (user) uid; + group = user.name; + home = cfg.dataDir; + isSystemUser = true; + }; + }; + + users.groups.${user.name} = {}; + + user = rec { + mail = "${name}@${config.krebs.build.host.name}"; + name = "github-hosts-sync"; + uid = genid_uint31 name; + }; + + # TODO move to lib? + fileExtension = s: last (splitString "." s); + +in out diff --git a/krebs/3modules/github/known-hosts.nix b/krebs/3modules/github/known-hosts.nix new file mode 100644 index 00000000..5de88762 --- /dev/null +++ b/krebs/3modules/github/known-hosts.nix @@ -0,0 +1,66 @@ +{ + services.openssh.knownHosts.github = { + hostNames = [ + "github.com" + # List generated with (IPv6 addresses are currently ignored): + # curl -sS https://api.github.com/meta | jq -r .git[] | grep -v : | nix-shell -p cidr2glob --run cidr2glob | jq -R . + "192.30.252.*" + "192.30.253.*" + "192.30.254.*" + "192.30.255.*" + "185.199.108.*" + "185.199.109.*" + "185.199.110.*" + "185.199.111.*" + "140.82.112.*" + "140.82.113.*" + "140.82.114.*" + "140.82.115.*" + "140.82.116.*" + "140.82.117.*" + "140.82.118.*" + "140.82.119.*" + "140.82.120.*" + "140.82.121.*" + "140.82.122.*" + "140.82.123.*" + "140.82.124.*" + "140.82.125.*" + "140.82.126.*" + "140.82.127.*" + "143.55.64.*" + "143.55.65.*" + "143.55.66.*" + "143.55.67.*" + "143.55.68.*" + "143.55.69.*" + "143.55.70.*" + "143.55.71.*" + "143.55.72.*" + "143.55.73.*" + "143.55.74.*" + "143.55.75.*" + "143.55.76.*" + "143.55.77.*" + "143.55.78.*" + "143.55.79.*" + "20.201.28.151" + "20.205.243.166" + "102.133.202.242" + "20.248.137.48" + "20.207.73.82" + "20.27.177.113" + "20.200.245.247" + "20.233.54.53" + "20.201.28.152" + "20.205.243.160" + "102.133.202.246" + "20.248.137.50" + "20.207.73.83" + "20.27.177.118" + "20.200.245.248" + "20.233.54.52" + ]; + publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="; + }; +} -- cgit v1.2.3 From 16cce4be93b242a9a9098f75ebe076dc37d6c705 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 20 Sep 2022 11:21:04 +0200 Subject: github: move known-hosts into separate file --- krebs/3modules/github/known-hosts.json | 58 +++++++++++++++++++++++++++++ krebs/3modules/github/known-hosts.nix | 68 ++++------------------------------ 2 files changed, 65 insertions(+), 61 deletions(-) create mode 100644 krebs/3modules/github/known-hosts.json diff --git a/krebs/3modules/github/known-hosts.json b/krebs/3modules/github/known-hosts.json new file mode 100644 index 00000000..694f9adb --- /dev/null +++ b/krebs/3modules/github/known-hosts.json @@ -0,0 +1,58 @@ +[ + "192.30.252.*", + "192.30.253.*", + "192.30.254.*", + "192.30.255.*", + "185.199.108.*", + "185.199.109.*", + "185.199.110.*", + "185.199.111.*", + "140.82.112.*", + "140.82.113.*", + "140.82.114.*", + "140.82.115.*", + "140.82.116.*", + "140.82.117.*", + "140.82.118.*", + "140.82.119.*", + "140.82.120.*", + "140.82.121.*", + "140.82.122.*", + "140.82.123.*", + "140.82.124.*", + "140.82.125.*", + "140.82.126.*", + "140.82.127.*", + "143.55.64.*", + "143.55.65.*", + "143.55.66.*", + "143.55.67.*", + "143.55.68.*", + "143.55.69.*", + "143.55.70.*", + "143.55.71.*", + "143.55.72.*", + "143.55.73.*", + "143.55.74.*", + "143.55.75.*", + "143.55.76.*", + "143.55.77.*", + "143.55.78.*", + "143.55.79.*", + "20.201.28.151", + "20.205.243.166", + "102.133.202.242", + "20.248.137.48", + "20.207.73.82", + "20.27.177.113", + "20.200.245.247", + "20.233.54.53", + "20.201.28.152", + "20.205.243.160", + "102.133.202.246", + "20.248.137.50", + "20.207.73.83", + "20.27.177.118", + "20.200.245.248", + "20.233.54.52" +] diff --git a/krebs/3modules/github/known-hosts.nix b/krebs/3modules/github/known-hosts.nix index 5de88762..f2705caa 100644 --- a/krebs/3modules/github/known-hosts.nix +++ b/krebs/3modules/github/known-hosts.nix @@ -1,66 +1,12 @@ -{ +{ lib, ... }: { services.openssh.knownHosts.github = { - hostNames = [ - "github.com" + hostNames = + ["github.com"] + ++ # List generated with (IPv6 addresses are currently ignored): - # curl -sS https://api.github.com/meta | jq -r .git[] | grep -v : | nix-shell -p cidr2glob --run cidr2glob | jq -R . - "192.30.252.*" - "192.30.253.*" - "192.30.254.*" - "192.30.255.*" - "185.199.108.*" - "185.199.109.*" - "185.199.110.*" - "185.199.111.*" - "140.82.112.*" - "140.82.113.*" - "140.82.114.*" - "140.82.115.*" - "140.82.116.*" - "140.82.117.*" - "140.82.118.*" - "140.82.119.*" - "140.82.120.*" - "140.82.121.*" - "140.82.122.*" - "140.82.123.*" - "140.82.124.*" - "140.82.125.*" - "140.82.126.*" - "140.82.127.*" - "143.55.64.*" - "143.55.65.*" - "143.55.66.*" - "143.55.67.*" - "143.55.68.*" - "143.55.69.*" - "143.55.70.*" - "143.55.71.*" - "143.55.72.*" - "143.55.73.*" - "143.55.74.*" - "143.55.75.*" - "143.55.76.*" - "143.55.77.*" - "143.55.78.*" - "143.55.79.*" - "20.201.28.151" - "20.205.243.166" - "102.133.202.242" - "20.248.137.48" - "20.207.73.82" - "20.27.177.113" - "20.200.245.247" - "20.233.54.53" - "20.201.28.152" - "20.205.243.160" - "102.133.202.246" - "20.248.137.50" - "20.207.73.83" - "20.27.177.118" - "20.200.245.248" - "20.233.54.52" - ]; + # curl -sS https://api.github.com/meta | jq -r .git[] | grep -v : | nix-shell -p cidr2glob --run cidr2glob | jq -Rs 'split("\n")|map(select(.!=""))' > known-hosts.json + lib.importJSON ./known-hosts.json + ; publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="; }; } -- cgit v1.2.3 From c6aec96a556e56f7faf9eeb53202dd5a1a6cefc8 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 22 Aug 2022 15:11:10 +0200 Subject: tv ejabberd: drop PermissionsStartOnly directive --- tv/3modules/ejabberd/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 935df9a9..67683b18 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -86,7 +86,6 @@ in { LoadCredential = [ "certfile:${cfg.certfile}" ]; - PermissionsStartOnly = true; PrivateTmp = true; SyslogIdentifier = "ejabberd"; StateDirectory = "ejabberd"; -- cgit v1.2.3 From 876fd5404d0bc9f838119505a4b7a9b7bdb60e9e Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 22 Aug 2022 14:58:40 +0200 Subject: tv ejabberd: use dynamic user --- tv/3modules/ejabberd/config.nix | 4 ++-- tv/3modules/ejabberd/default.nix | 42 ++++++++++++++++++---------------------- 2 files changed, 21 insertions(+), 25 deletions(-) diff --git a/tv/3modules/ejabberd/config.nix b/tv/3modules/ejabberd/config.nix index a022bc44..cc4dbcfb 100644 --- a/tv/3modules/ejabberd/config.nix +++ b/tv/3modules/ejabberd/config.nix @@ -62,7 +62,7 @@ in /* yaml */ '' module: ejabberd_c2s shaper: c2s_shaper ciphers: ${toJSON ciphers} - dhfile: /var/lib/ejabberd/dhfile + dhfile: ${config.stateDir}/dhfile protocol_options: ${toJSON protocol_options} starttls: true starttls_required: true @@ -112,7 +112,7 @@ in /* yaml */ '' s2s_access: s2s s2s_ciphers: ${toJSON ciphers} - s2s_dhfile: /var/lib/ejabberd/dhfile + s2s_dhfile: ${config.stateDir}/dhfile s2s_protocol_options: ${toJSON protocol_options} s2s_tls_compression: false s2s_use_starttls: required diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 67683b18..147e53d6 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -33,8 +33,11 @@ in { inherit pkgs; config = cfg; })} \ - --logs ${shell.escape cfg.user.home} \ - --spool ${shell.escape cfg.user.home} \ + --ctl-config ${toFile "ejabberdctl.cfg" /* sh */ '' + ERL_OPTIONS='-setcookie ${cfg.stateDir}/.erlang.cookie' + ''} \ + --logs ${cfg.stateDir} \ + --spool ${cfg.stateDir} \ "$@" '') pkgs.ejabberd @@ -47,12 +50,10 @@ in { config.krebs.users.tv.mail ]; }; - user = mkOption { - type = types.user; - default = { - name = "ejabberd"; - home = "/var/lib/ejabberd"; - }; + stateDir = mkOption { + type = types.absolute-pathname; + default = "/var/lib/ejabberd"; + readOnly = true; }; }; config = lib.mkIf cfg.enable { @@ -61,10 +62,13 @@ in { name = "ejabberd-sudo-wrapper"; paths = [ (pkgs.writeDashBin "ejabberdctl" '' - set -efu - cd ${shell.escape cfg.user.home} - exec /run/wrappers/bin/sudo \ - -u ${shell.escape cfg.user.name} \ + exec ${pkgs.systemd}/bin/systemd-run \ + --unit=ejabberdctl \ + --property=StateDirectory=ejabberd \ + --property=User=ejabberd \ + --collect \ + --pipe \ + --quiet \ ${cfg.pkgs.ejabberd}/bin/ejabberdctl "$@" '') cfg.pkgs.ejabberd @@ -80,7 +84,7 @@ in { serviceConfig = { ExecStart = pkgs.writeDash "ejabberd" '' ${pkgs.coreutils}/bin/ln -s "$CREDENTIALS_DIRECTORY" /tmp/credentials - ${gen-dhparam} /var/lib/ejabberd/dhfile + ${gen-dhparam} ${cfg.stateDir}/dhfile exec ${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground ''; LoadCredential = [ @@ -89,18 +93,10 @@ in { PrivateTmp = true; SyslogIdentifier = "ejabberd"; StateDirectory = "ejabberd"; - User = cfg.user.name; + User = "ejabberd"; + DynamicUser = true; TimeoutStartSec = 60; }; }; - - users.users.${cfg.user.name} = { - inherit (cfg.user) home name uid; - createHome = true; - group = cfg.user.name; - isSystemUser = true; - }; - - users.groups.${cfg.user.name} = {}; }; } -- cgit v1.2.3 From 3f1a9c5375cd06dea30f3deaa36cae7125fad492 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 22 Aug 2022 17:09:53 +0200 Subject: tv ejabberd: sync service with upstream template Incorporate parts from ejabberd 21.04's ejabberd.service.template --- tv/3modules/ejabberd/default.nix | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 147e53d6..15736e18 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -82,20 +82,32 @@ in { wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; serviceConfig = { - ExecStart = pkgs.writeDash "ejabberd" '' - ${pkgs.coreutils}/bin/ln -s "$CREDENTIALS_DIRECTORY" /tmp/credentials - ${gen-dhparam} ${cfg.stateDir}/dhfile - exec ${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground - ''; + ExecStartPre = [ + "${pkgs.coreutils}/bin/ln -s \${CREDENTIALS_DIRECTORY} /tmp/credentials" + "${gen-dhparam} ${cfg.stateDir}/dhfile" + ]; + ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground"; + ExecStop = [ + "${cfg.pkgs.ejabberd}/bin/ejabberdctl stop" + "${cfg.pkgs.ejabberd}/bin/ejabberdctl stopped" + ]; + ExecReload = "${cfg.pkgs.ejabberd}/bin/ejabberdctl reload_config"; LoadCredential = [ "certfile:${cfg.certfile}" ]; + LimitNOFILE = 65536; + PrivateDevices = true; PrivateTmp = true; SyslogIdentifier = "ejabberd"; StateDirectory = "ejabberd"; User = "ejabberd"; DynamicUser = true; - TimeoutStartSec = 60; + TimeoutSec = 60; + RestartSec = 5; + Restart = "on-failure"; + Type = "notify"; + NotifyAccess = "all"; + WatchdogSec = 30; }; }; }; -- cgit v1.2.3 From be14863bcf1ab9207c68dd02bc4bd94708bc3467 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 31 Aug 2022 03:39:12 +0200 Subject: tv ejabberd: admit multiple certfiles --- tv/3modules/ejabberd/config.nix | 3 +-- tv/3modules/ejabberd/default.nix | 24 ++++++++++++++++++------ 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/tv/3modules/ejabberd/config.nix b/tv/3modules/ejabberd/config.nix index cc4dbcfb..e989fc8b 100644 --- a/tv/3modules/ejabberd/config.nix +++ b/tv/3modules/ejabberd/config.nix @@ -48,8 +48,7 @@ in /* yaml */ '' - "::1/128" - "::FFFF:127.0.0.1/128" - certfiles: - - /tmp/credentials/certfile + certfiles: ${toJSON config.credentials.certfiles} hosts: ${toJSON config.hosts} diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 15736e18..d6573ad0 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -15,9 +15,19 @@ in { options.tv.ejabberd = { enable = mkEnableOption "tv.ejabberd"; - certfile = mkOption { - type = types.absolute-pathname; - default = toString + "/ejabberd.pem"; + certfiles = mkOption { + type = types.listOf types.absolute-pathname; + default = [ + (toString + "/ejabberd.pem") + ]; + }; + credentials.certfiles = mkOption { + internal = true; + readOnly = true; + default = + imap + (i: const /* yaml */ "/tmp/credentials/certfile${toJSON i}") + cfg.certfiles; }; hosts = mkOption { type = with types; listOf str; @@ -92,9 +102,11 @@ in { "${cfg.pkgs.ejabberd}/bin/ejabberdctl stopped" ]; ExecReload = "${cfg.pkgs.ejabberd}/bin/ejabberdctl reload_config"; - LoadCredential = [ - "certfile:${cfg.certfile}" - ]; + LoadCredential = + zipListsWith + (dst: src: "${baseNameOf dst}:${src}") + cfg.credentials.certfiles + cfg.certfiles; LimitNOFILE = 65536; PrivateDevices = true; PrivateTmp = true; -- cgit v1.2.3 From 3d821647c1de932f8e527e110ae7735f59866bfd Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 8 Oct 2022 22:13:23 +0200 Subject: tv ejabberd: add structural settings --- tv/3modules/ejabberd/config.nix | 128 ------------------------------- tv/3modules/ejabberd/default.nix | 158 +++++++++++++++++++++++++++++++++++++-- 2 files changed, 151 insertions(+), 135 deletions(-) delete mode 100644 tv/3modules/ejabberd/config.nix diff --git a/tv/3modules/ejabberd/config.nix b/tv/3modules/ejabberd/config.nix deleted file mode 100644 index e989fc8b..00000000 --- a/tv/3modules/ejabberd/config.nix +++ /dev/null @@ -1,128 +0,0 @@ -with import ; -{ config, ... }: let - - # See https://github.com/processone/ejabberd/blob/master/ejabberd.yml.example - - ciphers = concatStringsSep ":" [ - "ECDHE-ECDSA-AES256-GCM-SHA384" - "ECDHE-RSA-AES256-GCM-SHA384" - "ECDHE-ECDSA-CHACHA20-POLY1305" - "ECDHE-RSA-CHACHA20-POLY1305" - "ECDHE-ECDSA-AES128-GCM-SHA256" - "ECDHE-RSA-AES128-GCM-SHA256" - "ECDHE-ECDSA-AES256-SHA384" - "ECDHE-RSA-AES256-SHA384" - "ECDHE-ECDSA-AES128-SHA256" - "ECDHE-RSA-AES128-SHA256" - ]; - - protocol_options = [ - "no_sslv2" - "no_sslv3" - "no_tlsv1" - "no_tlsv1_10" - ]; - -in /* yaml */ '' - - access_rules: - announce: - - allow: admin - local: - - allow: local - configure: - - allow: admin - register: - - allow - s2s: - - allow - trusted_network: - - allow: loopback - - acl: - local: - user_regexp: "" - loopback: - ip: - - "127.0.0.0/8" - - "::1/128" - - "::FFFF:127.0.0.1/128" - - certfiles: ${toJSON config.credentials.certfiles} - - hosts: ${toJSON config.hosts} - - language: "en" - - listen: - - - port: 5222 - ip: "::" - module: ejabberd_c2s - shaper: c2s_shaper - ciphers: ${toJSON ciphers} - dhfile: ${config.stateDir}/dhfile - protocol_options: ${toJSON protocol_options} - starttls: true - starttls_required: true - tls: false - tls_compression: false - max_stanza_size: 65536 - - - port: 5269 - ip: "::" - module: ejabberd_s2s_in - shaper: s2s_shaper - max_stanza_size: 131072 - - loglevel: 4 - - modules: - mod_adhoc: {} - mod_admin_extra: {} - mod_announce: - access: announce - mod_caps: {} - mod_carboncopy: {} - mod_client_state: {} - mod_configure: {} - mod_disco: {} - mod_echo: {} - mod_bosh: {} - mod_last: {} - mod_offline: - access_max_user_messages: max_user_offline_messages - mod_ping: {} - mod_privacy: {} - mod_private: {} - mod_register: - access_from: deny - access: register - ip_access: trusted_network - registration_watchers: ${toJSON config.registration_watchers} - mod_roster: {} - mod_shared_roster: {} - mod_stats: {} - mod_time: {} - mod_vcard: - search: false - mod_version: {} - mod_http_api: {} - - s2s_access: s2s - s2s_ciphers: ${toJSON ciphers} - s2s_dhfile: ${config.stateDir}/dhfile - s2s_protocol_options: ${toJSON protocol_options} - s2s_tls_compression: false - s2s_use_starttls: required - - shaper_rules: - max_user_offline_messages: - - 5000: admin - - 100 - max_user_sessions: 10 - c2s_shaper: - - none: admin - - normal - s2s_shaper: fast -'' diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index d6573ad0..2966a4f6 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -12,6 +12,8 @@ fi ''; + settingsFormat = pkgs.formats.yaml {}; + in { options.tv.ejabberd = { enable = mkEnableOption "tv.ejabberd"; @@ -21,6 +23,25 @@ in { (toString + "/ejabberd.pem") ]; }; + configFile = mkOption { + type = types.either types.package types.absolute-pathname; + default = settingsFormat.generate "ejabberd.yaml" cfg.settings; + }; + ciphers = mkOption { + type = types.listOf types.str; + default = [ + "ECDHE-ECDSA-AES256-GCM-SHA384" + "ECDHE-RSA-AES256-GCM-SHA384" + "ECDHE-ECDSA-CHACHA20-POLY1305" + "ECDHE-RSA-CHACHA20-POLY1305" + "ECDHE-ECDSA-AES128-GCM-SHA256" + "ECDHE-RSA-AES128-GCM-SHA256" + "ECDHE-ECDSA-AES256-SHA384" + "ECDHE-RSA-AES256-SHA384" + "ECDHE-ECDSA-AES128-SHA256" + "ECDHE-RSA-AES128-SHA256" + ]; + }; credentials.certfiles = mkOption { internal = true; readOnly = true; @@ -39,13 +60,8 @@ in { paths = [ (pkgs.writeDashBin "ejabberdctl" '' exec ${pkgs.ejabberd}/bin/ejabberdctl \ - --config ${toFile "ejabberd.yaml" (import ./config.nix { - inherit pkgs; - config = cfg; - })} \ - --ctl-config ${toFile "ejabberdctl.cfg" /* sh */ '' - ERL_OPTIONS='-setcookie ${cfg.stateDir}/.erlang.cookie' - ''} \ + --config /etc/ejabberd/ejabberd.yaml \ + --ctl-config /etc/ejabberd/ejabberdctl.cfg \ --logs ${cfg.stateDir} \ --spool ${cfg.stateDir} \ "$@" @@ -54,12 +70,25 @@ in { ]; }; }; + protocol_options = mkOption { + type = types.listOf types.str; + default = [ + "no_sslv2" + "no_sslv3" + "no_tlsv1" + "no_tlsv1_10" + ]; + }; registration_watchers = mkOption { type = types.listOf types.str; default = [ config.krebs.users.tv.mail ]; }; + settings = mkOption { + type = settingsFormat.type; + default = {}; + }; stateDir = mkOption { type = types.absolute-pathname; default = "/var/lib/ejabberd"; @@ -67,6 +96,13 @@ in { }; }; config = lib.mkIf cfg.enable { + + environment.etc."ejabberd/ejabberd.yaml".source = cfg.configFile; + environment.etc."ejabberd/ejabberdctl.cfg".source = + builtins.toFile "ejabberdctl.cfg" /* sh */ '' + ERL_OPTIONS='-setcookie ${cfg.stateDir}/.erlang.cookie' + ''; + environment.systemPackages = [ (pkgs.symlinkJoin { name = "ejabberd-sudo-wrapper"; @@ -91,6 +127,10 @@ in { systemd.services.ejabberd = { wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; + reloadTriggers = [ + config.environment.etc."ejabberd/ejabberd.yaml".source + config.environment.etc."ejabberd/ejabberdctl.cfg".source + ]; serviceConfig = { ExecStartPre = [ "${pkgs.coreutils}/bin/ln -s \${CREDENTIALS_DIRECTORY} /tmp/credentials" @@ -122,5 +162,109 @@ in { WatchdogSec = 30; }; }; + + # preset config values + tv.ejabberd.settings = { + access_rules = { + announce = mkDefault [{ allow = "admin"; }]; + local = mkDefault [{ allow = "local"; }]; + configure = mkDefault [{ allow = "admin"; }]; + register = mkDefault ["allow"]; + s2s = mkDefault ["allow"]; + trusted_network = mkDefault [{ allow = "loopback"; }]; + }; + + acl = { + local.user_regexp = mkDefault ""; + loopback.ip = mkDefault [ + "127.0.0.0/8" + "::1/128" + "::FFFF:127.0.0.1/128" + ]; + }; + + certfiles = mkDefault cfg.credentials.certfiles; + + hosts = mkDefault cfg.hosts; + + language = mkDefault "en"; + + listen = mkDefault [ + { + port = 5222; + ip = "::"; + module = "ejabberd_c2s"; + shaper = "c2s_shaper"; + ciphers = concatStringsSep ":" cfg.ciphers; + protocol_options = cfg.protocol_options; + starttls = true; + starttls_required = true; + tls = false; + tls_compression = false; + max_stanza_size = 65536; + } + { + port = 5269; + ip = "::"; + module = "ejabberd_s2s_in"; + shaper = "s2s_shaper"; + dhfile = "${cfg.stateDir}/dhfile"; + max_stanza_size = 131072; + } + ]; + + loglevel = mkDefault "4"; + + modules = { + mod_adhoc = mkDefault {}; + mod_admin_extra = mkDefault {}; + mod_announce.access = mkDefault "announce"; + mod_caps = mkDefault {}; + mod_carboncopy = mkDefault {}; + mod_client_state = mkDefault {}; + mod_configure = mkDefault {}; + mod_disco = mkDefault {}; + mod_echo = mkDefault {}; + mod_bosh = mkDefault {}; + mod_last = mkDefault {}; + mod_offline.access_max_user_messages = mkDefault "max_user_offline_messages"; + mod_ping = mkDefault {}; + mod_privacy = mkDefault {}; + mod_private = mkDefault {}; + mod_register = { + access_from = mkDefault "deny"; + access = mkDefault "register"; + ip_access = mkDefault "trusted_network"; + registration_watchers = mkDefault cfg.registration_watchers; + }; + mod_roster = mkDefault {}; + mod_shared_roster = mkDefault {}; + mod_stats = mkDefault {}; + mod_time = mkDefault {}; + mod_vcard.search = mkDefault false; + mod_version = mkDefault {}; + mod_http_api = mkDefault {}; + }; + + s2s_access = mkDefault "s2s"; + s2s_ciphers = concatStringsSep ":" cfg.ciphers; + s2s_dhfile = mkDefault "${cfg.stateDir}/dhfile"; + s2s_protocol_options = mkDefault cfg.protocol_options; + s2s_tls_compression = mkDefault false; + s2s_use_starttls = mkDefault "required"; + + shaper_rules = { + max_user_offline_messages = mkDefault [ + { "5000" = "admin"; } + 100 + ]; + max_user_sessions = mkDefault 10; + c2s_shaper = mkDefault [ + { "none" = "admin"; } + "normal" + ]; + s2s_shaper = mkDefault "fast"; + }; + }; }; } -- cgit v1.2.3 From 1291bb433bb32e4efe320aeb8d422aefbcfbacd1 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 8 Oct 2022 23:12:57 +0200 Subject: tv ejabberd: change YAML formatting style --- tv/3modules/ejabberd/default.nix | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 2966a4f6..2a87b59c 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -25,7 +25,32 @@ in { }; configFile = mkOption { type = types.either types.package types.absolute-pathname; - default = settingsFormat.generate "ejabberd.yaml" cfg.settings; + default = + (settingsFormat.generate "ejabberd.yaml" cfg.settings) + # XXX ejabberd cannot parse MQTT topic filters enclosed in single + # quotes. By changing the YAML formatting style, double quotes will + # be used instead. + # + # Related error message: + # Invalid value of option modules->mod_mqtt->access_publish: + # Malformed topic filter + # + .overrideAttrs (old: { + nativeBuildInputs = + filter + (pkg: (parseDrvName pkg.name).name != "remarshal") + old.nativeBuildInputs + ++ + singleton (pkgs.symlinkJoin { + name = "remarshal"; + paths = [ + (pkgs.writeDashBin "json2yaml" '' + exec ${pkgs.remarshal}/bin/json2yaml --yaml-style \> "$@" + '') + pkgs.remarshal + ]; + }); + }); }; ciphers = mkOption { type = types.listOf types.str; -- cgit v1.2.3 From 8d6727eaae2486e19a461b78667baa05191b6b1c Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 8 Oct 2022 23:15:19 +0200 Subject: tv ejabberd: make stateDir configurable --- tv/3modules/ejabberd/default.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 2a87b59c..ce736f43 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -115,9 +115,14 @@ in { default = {}; }; stateDir = mkOption { - type = types.absolute-pathname; + type = + types.addCheck + types.absolute-pathname + (path: + hasPrefix "/var/lib/" path && + types.filename.check (removePrefix "/var/lib/" path) + ); default = "/var/lib/ejabberd"; - readOnly = true; }; }; config = lib.mkIf cfg.enable { -- cgit v1.2.3 From 2dbfd35f759702b53938b5ca4f1cd9a2fb731317 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 8 Oct 2022 23:39:00 +0200 Subject: tv ejabberd: JSON > YAML --- tv/3modules/ejabberd/default.nix | 31 +++---------------------------- 1 file changed, 3 insertions(+), 28 deletions(-) diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index ce736f43..edc5296b 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -12,7 +12,7 @@ fi ''; - settingsFormat = pkgs.formats.yaml {}; + settingsFormat = pkgs.formats.json {}; in { options.tv.ejabberd = { @@ -25,32 +25,7 @@ in { }; configFile = mkOption { type = types.either types.package types.absolute-pathname; - default = - (settingsFormat.generate "ejabberd.yaml" cfg.settings) - # XXX ejabberd cannot parse MQTT topic filters enclosed in single - # quotes. By changing the YAML formatting style, double quotes will - # be used instead. - # - # Related error message: - # Invalid value of option modules->mod_mqtt->access_publish: - # Malformed topic filter - # - .overrideAttrs (old: { - nativeBuildInputs = - filter - (pkg: (parseDrvName pkg.name).name != "remarshal") - old.nativeBuildInputs - ++ - singleton (pkgs.symlinkJoin { - name = "remarshal"; - paths = [ - (pkgs.writeDashBin "json2yaml" '' - exec ${pkgs.remarshal}/bin/json2yaml --yaml-style \> "$@" - '') - pkgs.remarshal - ]; - }); - }); + default = settingsFormat.generate "ejabberd.yaml" cfg.settings; }; ciphers = mkOption { type = types.listOf types.str; @@ -72,7 +47,7 @@ in { readOnly = true; default = imap - (i: const /* yaml */ "/tmp/credentials/certfile${toJSON i}") + (i: const "/tmp/credentials/certfile${toJSON i}") cfg.certfiles; }; hosts = mkOption { -- cgit v1.2.3 From b5f7882fcada26d968b643765f32fd1ac23613ff Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 18 Oct 2022 21:37:26 +0200 Subject: reaktor2: give bedger its real name and logo --- krebs/2configs/reaktor2.nix | 81 ++++++++++++++++++++++++--------------------- 1 file changed, 44 insertions(+), 37 deletions(-) diff --git a/krebs/2configs/reaktor2.nix b/krebs/2configs/reaktor2.nix index 233fe2fd..f76bc646 100644 --- a/krebs/2configs/reaktor2.nix +++ b/krebs/2configs/reaktor2.nix @@ -9,6 +9,48 @@ let hooks = pkgs.reaktor2-plugins.hooks; commands = pkgs.reaktor2-plugins.commands; + # bedger - the bier ledger + # + # logo: http://c.r/bedger2 + # + bedger-add = { + pattern = ''^([\H-]*?):?\s+([+-][1-9][0-9]*)\s+(\S+)$''; + activate = "match"; + arguments = [1 2 3]; + command = { + env = { + # TODO; get state as argument + state_file = "${stateDir}/ledger"; + }; + filename = pkgs.writeDash "bedger-add" '' + set -x + tonick=$1 + amt=$2 + unit=$3 + printf '%s\n %s %d %s\n %s %d %s\n' "$(date -Id)" "$tonick" "$amt" "$unit" "$_from" "$(expr 0 - "''${amt#+}")" "$unit" >> $state_file + ${pkgs.hledger}/bin/hledger -f $state_file bal -N -O csv \ + | ${pkgs.coreutils}/bin/tail +2 \ + | ${pkgs.miller}/bin/mlr --icsv --opprint cat \ + | ${pkgs.gnugrep}/bin/grep "$_from" + ''; + }; + }; + bedger-balance = { + pattern = "^bier (ballern|bal(an(ce)?)?)$"; + activate = "match"; + command = { + env = { + state_file = "${stateDir}/ledger"; + }; + filename = pkgs.writeDash "bedger-balance" '' + ${pkgs.hledger}/bin/hledger -f $state_file bal -N -O csv \ + | ${pkgs.coreutils}/bin/tail +2 \ + | ${pkgs.miller}/bin/mlr --icsv --opprint cat \ + | ${pkgs.gnused}/bin/sed 's/^\(.\)/\1‍/' + ''; + }; + }; + taskRcFile = builtins.toFile "taskrc" '' confirmation=no ''; @@ -60,43 +102,8 @@ let } ]; hooks.PRIVMSG = [ - { - pattern = "^bier (ballern|bal(an(ce)?)?)$"; - activate = "match"; - command = { - env = { - state_file = "${stateDir}/ledger"; - }; - filename = pkgs.writeDash "bier-balance" '' - ${pkgs.hledger}/bin/hledger -f $state_file bal -N -O csv \ - | ${pkgs.coreutils}/bin/tail +2 \ - | ${pkgs.miller}/bin/mlr --icsv --opprint cat \ - | ${pkgs.gnused}/bin/sed 's/^\(.\)/\1‍/' - ''; - }; - } - { - pattern = ''^([\H-]*?):?\s+([+-][1-9][0-9]*)\s+(\S+)$''; - activate = "match"; - arguments = [1 2 3]; - command = { - env = { - # TODO; get state as argument - state_file = "${stateDir}/ledger"; - }; - filename = pkgs.writeDash "ledger-add" '' - set -x - tonick=$1 - amt=$2 - unit=$3 - printf '%s\n %s %d %s\n %s %d %s\n' "$(date -Id)" "$tonick" "$amt" "$unit" "$_from" "$(expr 0 - "''${amt#+}")" "$unit" >> $state_file - ${pkgs.hledger}/bin/hledger -f $state_file bal -N -O csv \ - | ${pkgs.coreutils}/bin/tail +2 \ - | ${pkgs.miller}/bin/mlr --icsv --opprint cat \ - | ${pkgs.gnugrep}/bin/grep "$_from" - ''; - }; - } + bedger-add + bedger-balance hooks.sed (generators.command_hook { inherit (commands) dance random-emoji nixos-version; -- cgit v1.2.3