summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJeschli <jeschli@gmail.com>2019-12-20 08:56:54 +0100
committerJeschli <jeschli@gmail.com>2019-12-20 08:56:54 +0100
commitea5522e2e048cbdac5184803040e314f84472f4f (patch)
tree52cd5a95d9a3d3c276b485f970b0d1cebf2d26ec
parent555e4f0825da1b06be97e1d487c800145c51c9f6 (diff)
parente2a43e1e30b635b85a79bedb3d40cd8a888a1d49 (diff)
Merge branch 'master' of https://cgit.lassul.us/stockholm
-rw-r--r--.gitlab-ci.yml18
-rw-r--r--.gitmodules3
-rw-r--r--krebs/1systems/puyak/config.nix7
-rw-r--r--krebs/1systems/wolf/config.nix10
-rw-r--r--krebs/2configs/exim-smarthost.nix3
-rw-r--r--krebs/2configs/shack/prometheus/alert-rules.nix102
-rw-r--r--krebs/2configs/shack/prometheus/server.nix90
-rw-r--r--krebs/2configs/shack/ssh-keys.nix10
-rw-r--r--krebs/3modules/bepasty-server.nix8
-rw-r--r--krebs/3modules/ci.nix1
-rw-r--r--krebs/3modules/default.nix1
-rw-r--r--krebs/3modules/external/default.nix8
-rw-r--r--krebs/3modules/iana-etc.nix40
-rw-r--r--krebs/3modules/lass/default.nix38
-rw-r--r--krebs/3modules/mb/default.nix151
-rw-r--r--krebs/3modules/realwallpaper.nix2
-rw-r--r--krebs/5pkgs/simple/newsbot-js/default.nix8
-rw-r--r--krebs/5pkgs/simple/newsbot-js/node-packages.nix461
-rwxr-xr-xkrebs/5pkgs/simple/newsbot-js/update.sh4
-rw-r--r--krebs/5pkgs/simple/tinc_graphs/default.nix6
-rw-r--r--krebs/nixpkgs-unstable.json6
-rw-r--r--krebs/nixpkgs.json6
-rwxr-xr-xkrebs/update-nixpkgs-unstable.sh2
-rw-r--r--lass/1systems/blue/source.nix3
-rw-r--r--lass/1systems/hilum/config.nix1
-rw-r--r--lass/1systems/icarus/config.nix13
-rw-r--r--lass/1systems/prism/config.nix24
-rw-r--r--lass/1systems/shodan/config.nix79
-rw-r--r--lass/1systems/shodan/physical.nix1
-rw-r--r--lass/2configs/br.nix2
-rw-r--r--lass/2configs/codimd.nix3
-rw-r--r--lass/2configs/gg23.nix134
m---------lass/5pkgs/autowifi0
-rw-r--r--lass/5pkgs/autowifi/autowifi.py228
-rw-r--r--lass/5pkgs/autowifi/default.nix1
-rw-r--r--makefu/1systems/iso/config.nix30
-rw-r--r--makefu/1systems/iso/justdoit.nix128
-rw-r--r--makefu/1systems/iso/target-config.nix40
-rw-r--r--makefu/2configs/nginx/dl.euer.krebsco.de.nix (renamed from makefu/2configs/nginx/share-download.nix)0
-rw-r--r--mb/1systems/gr33n/configuration.nix144
-rw-r--r--mb/1systems/gr33n/hardware-configuration.nix37
-rw-r--r--mb/1systems/orange/configuration.nix238
-rw-r--r--mb/1systems/orange/hardware-configuration.nix28
-rw-r--r--mb/1systems/p1nk/configuration.nix227
-rw-r--r--mb/1systems/p1nk/hardware-configuration.nix29
-rw-r--r--mb/1systems/rofl/configuration.nix103
-rw-r--r--mb/1systems/sunsh1n3/configuration.nix181
-rw-r--r--mb/1systems/sunsh1n3/hardware-configuration.nix29
-rw-r--r--mb/2configs/default.nix222
-rw-r--r--mb/2configs/google-compute-config.nix231
-rw-r--r--mb/2configs/headless.nix25
-rw-r--r--mb/2configs/neovimrc446
-rw-r--r--mb/2configs/nvim.nix70
-rw-r--r--mb/2configs/qemu-guest.nix19
-rw-r--r--mb/2configs/retiolum.nix33
-rw-r--r--mb/2configs/tests/dummy-secrets/retiolum.rsa4
-rw-r--r--mb/3modules/default.nix6
-rw-r--r--mb/3modules/hosts.nix12
-rw-r--r--mb/5pkgs/default.nix11
-rw-r--r--mb/default.nix14
-rw-r--r--mb/krops.nix54
m---------submodules/krops0
-rw-r--r--tv/1systems/nomic/config.nix1
-rw-r--r--tv/2configs/im.nix24
-rw-r--r--tv/3modules/default.nix1
-rw-r--r--tv/3modules/im.nix110
66 files changed, 854 insertions, 3117 deletions
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index fb273c932..3ff991aa4 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -11,13 +11,14 @@ before_script:
- ssh-keyscan -H 'ssh.git.shackspace.de' >> ~/.ssh/known_hosts
# import secret key for secrets
- echo "$secrets_gpg_key" | gpg --import
-wolf deployment test:
+deployment test:
stage: test
script:
- GIT_SSH_COMMAND="ssh -i ~/.ssh/gitlab_deploy.key" git clone git@ssh.git.shackspace.de:rz/secrets.git ~/brain
- test $(PASSWORD_STORE_DIR=~/brain pass smoke) == 1337
- git submodule update --init
- $(nix-build krebs/krops.nix --no-out-link --argstr name wolf --argstr target /tmp -A test)
+ - $(nix-build krebs/krops.nix --no-out-link --argstr name puyak --argstr target /tmp -A test)
nix-shell test:
stage: test
script:
@@ -34,7 +35,6 @@ wolf deployment:
- git clone git@ssh.git.shackspace.de:rz/secrets.git ~/brain
- git submodule update --init
- ssh-keyscan -H 'wolf.shack' >> ~/.ssh/known_hosts
- # TODO, hostname wolf cannot be resolved
- $(nix-build krebs/krops.nix --no-out-link --argstr name wolf --argstr target wolf.shack -A deploy)
only:
changes:
@@ -42,6 +42,20 @@ wolf deployment:
- krebs/**/*
- lib/**/*
- .gitmodules
+puyak deployment:
+ stage: deploy
+ script:
+ - cp ~/.ssh/gitlab_deploy.key ~/.ssh/id_rsa
+ - git clone git@ssh.git.shackspace.de:rz/secrets.git ~/brain
+ - git submodule update --init
+ - ssh-keyscan -H 'puyak.shack' >> ~/.ssh/known_hosts
+ - $(nix-build krebs/krops.nix --no-out-link --argstr name puyak --argstr target puyak.shack -A deploy)
+ only:
+ changes:
+ - .gitlab-ci.yml
+ - krebs/**/*
+ - lib/**/*
+ - .gitmodules
nur-packages makefu:
stage: deploy
script:
diff --git a/.gitmodules b/.gitmodules
index f35a9250d..5b4336510 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -4,3 +4,6 @@
[submodule "submodules/krops"]
path = submodules/krops
url = https://cgit.krebsco.de/krops
+[submodule "lass/5pkgs/autowifi"]
+ path = lass/5pkgs/autowifi
+ url = https://github.com/Lassulus/autowifi
diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix
index 6493c6df4..a20f6929e 100644
--- a/krebs/1systems/puyak/config.nix
+++ b/krebs/1systems/puyak/config.nix
@@ -13,6 +13,7 @@
<stockholm/krebs/2configs/ircd.nix>
<stockholm/krebs/2configs/news.nix>
<stockholm/krebs/2configs/news-spam.nix>
+ <stockholm/krebs/2configs/shack/ssh-keys.nix>
<stockholm/krebs/2configs/shack/prometheus/node.nix>
<stockholm/krebs/2configs/shack/prometheus/server.nix>
<stockholm/krebs/2configs/shack/prometheus/unifi.nix>
@@ -81,12 +82,6 @@
echo level disengaged > /proc/acpi/ibm/fan
'';
- # to access vorstand vm
- users.users.root.openssh.authorizedKeys.keys = [
- config.krebs.users.ulrich.pubkey
- config.krebs.users.raute.pubkey
- ];
-
users.users.joerg = {
openssh.authorizedKeys.keys = [ config.krebs.users.Mic92.pubkey ];
isNormalUser = true;
diff --git a/krebs/1systems/wolf/config.nix b/krebs/1systems/wolf/config.nix
index e87b7bb99..059e09ac1 100644
--- a/krebs/1systems/wolf/config.nix
+++ b/krebs/1systems/wolf/config.nix
@@ -16,6 +16,7 @@ in
# handle the worlddomination map via coap
<stockholm/krebs/2configs/shack/worlddomination.nix>
+ <stockholm/krebs/2configs/shack/ssh-keys.nix>
# drivedroid.shack for shackphone
<stockholm/krebs/2configs/shack/drivedroid.nix>
@@ -117,14 +118,6 @@ in
fileSystems."/" = { device = "/dev/disk/by-label/nixos"; fsType = "ext4"; };
- users.extraUsers.root.openssh.authorizedKeys.keys = [
- config.krebs.users."0x4A6F".pubkey
- config.krebs.users.ulrich.pubkey
- config.krebs.users.raute.pubkey
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDb9NPa2Hf51afcG1H13UPbE5E02J8aC9a1sGCRls592wAVlQbmojYR1jWDPA2m32Bsyv0ztqi81zDyndWWZPQVJVBk00VjYBcgk6D5ifqoAuWLzfuHJPWZGOvBf/U74/LNFNUkj1ywjneK7HYTRPXrRBBfBSQNmQzkvue7s599L2vdueZKyjNsMpx2m6nm2SchaMuDskSQut/168JgU1l4M8BeT68Bo4WdelhBYnhSI1a59FGkgdu2SCjyighLQRy2sOH3ksnkHWENPkA+wwQOlKl7R3DsEybrNd4NU9FSwFDyDmdhfv5gJp8UGSFdjAwx43+8zM5t5ruZ25J0LnVb0PuTuRA00UsW83MkLxFpDQLrQV08tlsY6iGrqxP67C3VJ6t4v6oTp7/vaRLhEFc1PhOLh+sZ18o8MLO+e2rGmHGHQnSKfBOLUvDMGa4jb01XBGjdnIXLOkVo79YR5jZn7jJb2gTZ95OD6bWSDADoURSuwuLa7kh4ti1ItAKuhkIvbuky3rRVvQEc92kJ6aNUswIUXJa0K2ibbIY6ycKAA3Ljksl3Mm9KzOn6yc/i/lSF+SOrTGhabPJigKkIoqKIwnV5IU3gkfsxPQJOBMPqHDGAOeYQe3WpWedEPYuhQEczw4exMb9TkNE96F71PzuQPJDl5sPAWyPLeMKpy5XbfRiF2by4nxN3ZIQvjtoyVkjNV+qM0q0yKBzLxuRAEQOZ2yCEaBudZQkQiwHD97H2vu4SRQ/2aOie1XiOnmdbQRDZSO3BsoDK569K1w+gDfSnqY7zVUMj6tw+uKx6Gstck5lbvYMtdWKsfPv/pDM8eyIVFLL93dKTX+ertcQj6xDwLfOiNubE5ayFXhYkjwImV6NgfBuq+3hLK0URP2rPlOZbbZTQ0WlKD6CCRZPMSZCU9oD2zYfqpvRArBUcdkAwGePezORkfJQLE6mYEJp6pdFkJ/IeFLbO6M0lZVlfnpzAC9kjjkMCRofZUETcFSppyTImCbgo3+ok59/PkNU5oavBXyW80ue2tWHr08HX/QALNte3UITmIIlU6SFMCPMWJqadK1eDPWfJ4H4iDXRNn3D5wqN++iMloKvpaj0wieqXLY4+YfvNTNr177OU48GEWW8DnoEkbpwsCbjPxznGDQhdDqdYyMY/fDgRQReKITvKYGHRzesGysw5cKsp9LEfXD0R6WE2TeiiENla5AWzTgXJB0AyZEcOiIfqOgT9Nr9S8q5gc/BdA7P+jhGGJgEHhV3dVlfIZ7pmZc27Yu7UTQ0lbAKWqcMSTOdne+QL6ILzbvLrQwdvax4tQdm5opfU16SrOox1AMwAbkdq84z6uJqYVx3cUXfMJgTyDNrVv3or root@plattenschwein" # for backup
- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1Lx5MKtVjB/Ef6LpEiIAgVwY5xKQFdHuLQR+odQO4cAgxj1QaIXGN0moixY52DebVQhAtiCNiFZ83uJyOj8kmu30yuXwtSOQeqziA859qMJKZ4ZcYdKvbXwnf2Chm5Ck/0FvtpjTWHIZAogwP1wQto/lcqHOjrTAnZeJfQuHTswYUSnmUU5zdsEZ9HidDPUc2Gv0wkBNd+KMQyOZl0HkaxHWvn0h4KK4hYZisOpeTfXJxD87bo+Eg4LL2vvnHW6dF6Ygrbd/0XRMsRRI8OAReVBUoJn7IE1wwAl/FpblNmhaF9hlL7g7hR1ADvaWMMw0e8SSzW6Y+oIa8qFQL6wR1 gitlab-builder" # for being deployed by gitlab ci
- ];
-
services.udev.extraRules = ''
SUBSYSTEM=="net", ATTR{address}=="${external-mac}", NAME="${ext-if}"
'';
@@ -137,6 +130,7 @@ in
enable = true;
wideArea = false;
};
+
environment.systemPackages = [ pkgs.avahi ];
}
diff --git a/krebs/2configs/exim-smarthost.nix b/krebs/2configs/exim-smarthost.nix
index 698e20da1..224a38ac3 100644
--- a/krebs/2configs/exim-smarthost.nix
+++ b/krebs/2configs/exim-smarthost.nix
@@ -15,13 +15,12 @@ in {
makefu
tv
];
- eloop-ml = spam-ml ++ [ ciko ];
+ eloop-ml = spam-ml;
spam-ml = [
lass
makefu
tv
];
- ciko.mail = "ciko@slash16.net";
in {
"anmeldung@eloop.org" = eloop-ml;
"brain@krebsco.de" = brain-ml;
diff --git a/krebs/2configs/shack/prometheus/alert-rules.nix b/krebs/2configs/shack/prometheus/alert-rules.nix
new file mode 100644
index 000000000..096c551ba
--- /dev/null
+++ b/krebs/2configs/shack/prometheus/alert-rules.nix
@@ -0,0 +1,102 @@
+{ lib }:
+with lib;
+
+let
+ deviceFilter = ''device!="ramfs",device!="rpc_pipefs",device!="lxcfs",device!="nsfs",device!="borgfs"'';
+in mapAttrsToList (name: opts: {
+ alert = name;
+ expr = opts.condition;
+ for = opts.time or "2m";
+ labels = if (opts.page or true) then { severity = "page"; } else {};
+ annotations = {
+ summary = opts.summary;
+ description = opts.description;
+ };
+}) {
+ node_down = {
+ condition = ''up{job="node"} == 0'';
+ summary = "{{$labels.alias}}: Node is down.";
+ description = "{{$labels.alias}} has been down for more than 2 minutes.";
+ };
+ node_systemd_service_failed = {
+ condition = ''node_systemd_unit_state{state="failed"} == 1'';
+ summary = "{{$labels.alias}}: Service {{$labels.name}} failed to start.";
+ description = "{{$labels.alias}} failed to (re)start service {{$labels.name}}.";
+ };
+ node_filesystem_full_80percent = {
+ condition = ''sort(node_filesystem_free_bytes{${deviceFilter}} < node_filesystem_size_bytes{${deviceFilter}} * 0.2) / 1024^3'';
+ time = "10m";
+ summary = "{{$labels.alias}}: Filesystem is running out of space soon.";
+ description = "{{$labels.alias}} device {{$labels.device}} on {{$labels.mountpoint}} got less than 20% space left on its filesystem.";
+ };
+ node_filesystem_full_in_7d = {
+ condition = ''predict_linear(node_filesystem_free_bytes{${deviceFilter}}[2d], 7*24*3600) <= 0'';
+ time = "1h";
+ summary = "{{$labels.alias}}: Filesystem is running out of space in 7 days.";
+ description = "{{$labels.alias}} device {{$labels.device}} on {{$labels.mountpoint}} is running out of space of in approx. 7 days";
+ };
+ node_filesystem_full_in_30d = {
+ condition = ''predict_linear(node_filesystem_free_bytes{${deviceFilter}}[30d], 30*24*3600) <= 0'';
+ time = "1h";
+ summary = "{{$labels.alias}}: Filesystem is running out of space in 30 days.";
+ description = "{{$labels.alias}} device {{$labels.device}} on {{$labels.mountpoint}} is running out of space of in approx. 30 days";
+ };
+ node_filedescriptors_full_in_3h = {
+ condition = ''predict_linear(node_filefd_allocated[3h], 3*3600) >= node_filefd_maximum'';
+ time = "20m";
+ summary = "{{$labels.alias}} is running out of available file descriptors in 3 hours.";
+ description = "{{$labels.alias}} is running out of available file descriptors in approx. 3 hours";
+ };
+ node_filedescriptors_full_in_7d = {
+ condition = ''predict_linear(node_filefd_allocated[7d], 7*24*3600) >= node_filefd_maximum'';
+ time = "1h";
+ summary = "{{$labels.alias}} is running out of available file descriptors in 7 days.";
+ description = "{{$labels.alias}} is running out of available file descriptors in approx. 7 days";
+ };
+ node_load15 = {
+ condition = ''node_load15 / on(alias) count(node_cpu_seconds_total{mode="system"}) by (alias) >= 1.0'';
+ time = "10m";
+ summary = "{{$labels.alias}}: Running on high load: {{$value}}";
+ description = "{{$labels.alias}} is running with load15 > 1 for at least 5 minutes: {{$value}}";
+ };
+ node_ram_using_90percent = {
+ condition = "node_memory_MemFree_bytes + node_memory_Buffers_bytes + node_memory_Cached_bytes < node_memory_MemTotal_bytes * 0.1";
+ time = "1h";
+ summary = "{{$labels.alias}}: Using lots of RAM.";
+ description = "{{$labels.alias}} is using at least 90% of its RAM for at least 1 hour.";
+ };
+ node_swap_using_30percent = {
+ condition = "node_memory_SwapTotal_bytes - (node_memory_SwapFree_bytes + node_memory_SwapCached_bytes) > node_memory_SwapTotal_bytes * 0.3";
+ time = "30m";
+ summary = "{{$labels.alias}}: Using more than 30% of its swap.";
+ description = "{{$labels.alias}} is using 30% of its swap space for at least 30 minutes.";
+ };
+ node_visible_confluence_space = {
+ condition = "node_visible_confluence_space != 0";
+ summary = "crowd prometheus cann see the {{$labels.space_name}} confluence space!";
+ description = "crowd user `prometheus` can see the `{{$labels.space_name}}` confluence space.";
+ };
+ node_hwmon_temp = {
+ condition = "node_hwmon_temp_celsius > node_hwmon_temp_crit_celsius*0.9 OR node_hwmon_temp_celsius > node_hwmon_temp_max_celsius*0.95";
+ time = "5m";
+ summary = "{{$labels.alias}}: Sensor {{$labels.sensor}}/{{$labels.chip}} temp is high: {{$value}} ";
+ description = "{{$labels.alias}} reports hwmon sensor {{$labels.sensor}}/{{$labels.chip}} temperature value is nearly critical: {{$value}}";
+ };
+ node_conntrack_limit = {
+ condition = "node_nf_conntrack_entries_limit - node_nf_conntrack_entries < 1000";
+ time = "5m";
+ summary = "{{$labels.alias}}: Number of tracked connections high";
+ description = "{{$labels.alias}} has only {{$value}} free slots for connection tracking available.";
+ };
+ node_reboot = {
+ condition = "time() - node_boot_time_seconds < 300";
+ summary = "{{$labels.alias}}: Reboot";
+ description = "{{$labels.alias}} just rebooted.";
+ };
+ node_uptime = {
+ condition = "time() - node_boot_time_seconds > 2592000";
+ page = false;
+ summary = "{{$labels.alias}}: Uptime monster";
+ description = "{{$labels.alias}} has been up for more than 30 days.";
+ };
+}
diff --git a/krebs/2configs/shack/prometheus/server.nix b/krebs/2configs/shack/prometheus/server.nix
index 7f6f38610..f5d2e7640 100644
--- a/krebs/2configs/shack/prometheus/server.nix
+++ b/krebs/2configs/shack/prometheus/server.nix
@@ -28,90 +28,12 @@
"-storage.local.index-cache-size.label-name-to-label-values 2097152"
"-storage.local.index-cache-size.label-pair-to-fingerprints 41943040"
];
- rules = [
- ''
- ALERT node_down
- IF up == 0
- FOR 5m
- LABELS {
- severity="page"
- }
- ANNOTATIONS {
- summary = "{{$labels.alias}}: Node is down.",
- description = "{{$labels.alias}} has been down for more than 5 minutes."
- }
- ALERT node_systemd_service_failed
- IF node_systemd_unit_state{state="failed"} == 1
- FOR 4m
- LABELS {
- severity="page"
- }
- ANNOTATIONS {
- summary = "{{$labels.alias}}: Service {{$labels.name}} failed to start.",
- description = "{{$labels.alias}} failed to (re)start service {{$labels.name}}."
- }
- ALERT node_filesystem_full_90percent
- IF sort(node_filesystem_free{device!="ramfs"} < node_filesystem_size{device!="ramfs"} * 0.1) / 1024^3
- FOR 5m
- LABELS {
- severity="page"
- }
- ANNOTATIONS {
- summary = "{{$labels.alias}}: Filesystem is running out of space soon.",
- description = "{{$labels.alias}} device {{$labels.device}} on {{$labels.mountpoint}} got less than 10% space left on its filesystem."
- }
- ALERT node_filesystem_full_in_4h
- IF predict_linear(node_filesystem_free{device!="ramfs"}[1h], 4*3600) <= 0
- FOR 5m
- LABELS {
- severity="page"
- }
- ANNOTATIONS {
- summary = "{{$labels.alias}}: Filesystem is running out of space in 4 hours.",
- description = "{{$labels.alias}} device {{$labels.device}} on {{$labels.mountpoint}} is running out of space of in approx. 4 hours"
- }
- ALERT node_filedescriptors_full_in_3h
- IF predict_linear(node_filefd_allocated[1h], 3*3600) >= node_filefd_maximum
- FOR 20m
- LABELS {
- severity="page"
- }
- ANNOTATIONS {
- summary = "{{$labels.alias}} is running out of available file descriptors in 3 hours.",
- description = "{{$labels.alias}} is running out of available file descriptors in approx. 3 hours"
- }
- ALERT node_load1_90percent
- IF node_load1 / on(alias) count(node_cpu{mode="system"}) by (alias) >= 0.9
- FOR 1h
- LABELS {
- severity="page"
- }
- ANNOTATIONS {
- summary = "{{$labels.alias}}: Running on high load.",
- description = "{{$labels.alias}} is running with > 90% total load for at least 1h."
- }
- ALERT node_cpu_util_90percent
- IF 100 - (avg by (alias) (irate(node_cpu{mode="idle"}[5m])) * 100) >= 90
- FOR 1h
- LABELS {
- severity="page"
- }
- ANNOTATIONS {
- summary = "{{$labels.alias}}: High CPU utilization.",
- description = "{{$labels.alias}} has total CPU utilization over 90% for at least 1h."
- }
- ALERT node_ram_using_90percent
- IF node_memory_MemFree + node_memory_Buffers + node_memory_Cached < node_memory_MemTotal * 0.1
- FOR 30m
- LABELS {
- severity="page"
- }
- ANNOTATIONS {
- summary="{{$labels.alias}}: Using lots of RAM.",
- description="{{$labels.alias}} is using at least 90% of its RAM for at least 30 minutes now.",
- }
- ''
- ];
+ ruleFiles = lib.singleton (pkgs.writeText "prometheus-rules.yml" (builtins.toJSON {
+ groups = lib.singleton {
+ name = "mf-alerting-rules";
+ rules = import ./alert-rules.nix { inherit lib; };
+ };
+ }));
scrapeConfigs = [
{
job_name = "node";
diff --git a/krebs/2configs/shack/ssh-keys.nix b/krebs/2configs/shack/ssh-keys.nix
new file mode 100644
index 000000000..9c7f507f1
--- /dev/null
+++ b/krebs/2configs/shack/ssh-keys.nix
@@ -0,0 +1,10 @@
+{ config, ... }:
+{
+ users.users.root.openssh.authorizedKeys.keys = [
+ config.krebs.users."0x4A6F".pubkey
+ config.krebs.users.ulrich.pubkey
+ config.krebs.users.raute.pubkey
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDb9NPa2Hf51afcG1H13UPbE5E02J8aC9a1sGCRls592wAVlQbmojYR1jWDPA2m32Bsyv0ztqi81zDyndWWZPQVJVBk00VjYBcgk6D5ifqoAuWLzfuHJPWZGOvBf/U74/LNFNUkj1ywjneK7HYTRPXrRBBfBSQNmQzkvue7s599L2vdueZKyjNsMpx2m6nm2SchaMuDskSQut/168JgU1l4M8BeT68Bo4WdelhBYnhSI1a59FGkgdu2SCjyighLQRy2sOH3ksnkHWENPkA+wwQOlKl7R3DsEybrNd4NU9FSwFDyDmdhfv5gJp8UGSFdjAwx43+8zM5t5ruZ25J0LnVb0PuTuRA00UsW83MkLxFpDQLrQV08tlsY6iGrqxP67C3VJ6t4v6oTp7/vaRLhEFc1PhOLh+sZ18o8MLO+e2rGmHGHQnSKfBOLUvDMGa4jb01XBGjdnIXLOkVo79YR5jZn7jJb2gTZ95OD6bWSDADoURSuwuLa7kh4ti1ItAKuhkIvbuky3rRVvQEc92kJ6aNUswIUXJa0K2ibbIY6ycKAA3Ljksl3Mm9KzOn6yc/i/lSF+SOrTGhabPJigKkIoqKIwnV5IU3gkfsxPQJOBMPqHDGAOeYQe3WpWedEPYuhQEczw4exMb9TkNE96F71PzuQPJDl5sPAWyPLeMKpy5XbfRiF2by4nxN3ZIQvjtoyVkjNV+qM0q0yKBzLxuRAEQOZ2yCEaBudZQkQiwHD97H2vu4SRQ/2aOie1XiOnmdbQRDZSO3BsoDK569K1w+gDfSnqY7zVUMj6tw+uKx6Gstck5lbvYMtdWKsfPv/pDM8eyIVFLL93dKTX+ertcQj6xDwLfOiNubE5ayFXhYkjwImV6NgfBuq+3hLK0URP2rPlOZbbZTQ0WlKD6CCRZPMSZCU9oD2zYfqpvRArBUcdkAwGePezORkfJQLE6mYEJp6pdFkJ/IeFLbO6M0lZVlfnpzAC9kjjkMCRofZUETcFSppyTImCbgo3+ok59/PkNU5oavBXyW80ue2tWHr08HX/QALNte3UITmIIlU6SFMCPMWJqadK1eDPWfJ4H4iDXRNn3D5wqN++iMloKvpaj0wieqXLY4+YfvNTNr177OU48GEWW8DnoEkbpwsCbjPxznGDQhdDqdYyMY/fDgRQReKITvKYGHRzesGysw5cKsp9LEfXD0R6WE2TeiiENla5AWzTgXJB0AyZEcOiIfqOgT9Nr9S8q5gc/BdA7P+jhGGJgEHhV3dVlfIZ7pmZc27Yu7UTQ0lbAKWqcMSTOdne+QL6ILzbvLrQwdvax4tQdm5opfU16SrOox1AMwAbkdq84z6uJqYVx3cUXfMJgTyDNrVv3or root@plattenschwein" # for backup
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1Lx5MKtVjB/Ef6LpEiIAgVwY5xKQFdHuLQR+odQO4cAgxj1QaIXGN0moixY52DebVQhAtiCNiFZ83uJyOj8kmu30yuXwtSOQeqziA859qMJKZ4ZcYdKvbXwnf2Chm5Ck/0FvtpjTWHIZAogwP1wQto/lcqHOjrTAnZeJfQuHTswYUSnmUU5zdsEZ9HidDPUc2Gv0wkBNd+KMQyOZl0HkaxHWvn0h4KK4hYZisOpeTfXJxD87bo+Eg4LL2vvnHW6dF6Ygrbd/0XRMsRRI8OAReVBUoJn7IE1wwAl/FpblNmhaF9hlL7g7hR1ADvaWMMw0e8SSzW6Y+oIa8qFQL6wR1 gitlab-builder" # for being deployed by gitlab ci
+ ];
+}
diff --git a/krebs/3modules/bepasty-server.nix b/krebs/3modules/bepasty-server.nix
index 4892a8723..ffa9a29e9 100644
--- a/krebs/3modules/bepasty-server.nix
+++ b/krebs/3modules/bepasty-server.nix
@@ -2,10 +2,10 @@
with import <stockholm/lib>;
let
- gunicorn = pkgs.python27Packages.gunicorn;
- bepasty = pkgs.bepasty.override { python3Packages = pkgs.python27Packages; };
- gevent = pkgs.python27Packages.gevent;
- python = pkgs.python27Packages.python;
+ gunicorn = pkgs.python3Packages.gunicorn;
+ bepasty = pkgs.bepasty;
+ gevent = pkgs.python3Packages.gevent;
+ python = pkgs.python3Packages.python;
cfg = config.krebs.bepasty;
out = {
diff --git a/krebs/3modules/ci.nix b/krebs/3modules/ci.nix
index cbf24effe..7695667fd 100644
--- a/krebs/3modules/ci.nix
+++ b/krebs/3modules/ci.nix
@@ -135,6 +135,7 @@ let
f_${name} = util.BuildFactory()
f_${name}.addStep(steps.Git(
repourl=util.Property('repository', '${head repo.urls}'),
+ method='clobber',
mode='full',
submodules=True,
))
diff --git