Merge branch 'master' of prism:stockholm

13 files changed, 157 insertions, 155 deletions

diff --git a/krebs/2configs/reaktor2.nix b/krebs/2configs/reaktor2.nix
index 4d90ae3d5..b52125ae8 100644
--- a/krebs/2configs/reaktor2.nix
+++ b/krebs/2configs/reaktor2.nix
@@ -115,6 +115,11 @@ let
 
 in {
 
+  users.users.reaktor2 = {
+    uid = genid_uint31 "reaktor2";
+    home = stateDir;
+  };
+
   krebs.reaktor2 = {
     freenode = {
       hostname = "irc.freenode.org";
diff --git a/krebs/3modules/permown.nix b/krebs/3modules/permown.nix
index 7a86013e1..63adb2236 100644
--- a/krebs/3modules/permown.nix
+++ b/krebs/3modules/permown.nix
@@ -2,8 +2,8 @@ with import <stockholm/lib>;
 { config, pkgs, ... }: {
 
   options.krebs.permown = mkOption {
-    default = [];
-    type = types.listOf (types.submodule {
+    default = {};
+    type = types.attrsOf (types.submodule ({ config, ... }: {
       options = {
         directory-mode = mkOption {
           default = "=rwx";
@@ -22,6 +22,7 @@ with import <stockholm/lib>;
           type = types.username;
         };
         path = mkOption {
+          default = config._module.args.name;
           type = types.absolute-pathname;
         };
         umask = mkOption {
@@ -29,46 +30,73 @@ with import <stockholm/lib>;
           type = types.file-mode;
         };
       };
-    });
+    }));
   };
 
-  config.systemd.services = genAttrs' config.krebs.permown (plan: {
-    name = "permown.${replaceStrings ["/"] ["_"] plan.path}";
-    value = {
-      environment = {
-        DIR_MODE = plan.directory-mode;
-        FILE_MODE = plan.file-mode;
-        OWNER_GROUP = "${plan.owner}:${plan.group}";
-        ROOT_PATH = plan.path;
-      };
-      path = [
-        pkgs.coreutils
-        pkgs.findutils
-        pkgs.inotifyTools
-      ];
-      serviceConfig = {
-        ExecStart = pkgs.writeDash "permown" ''
-          set -efu
+  config = let
+    plans = attrValues config.krebs.permown;
+  in mkIf (plans != []) {
+
+    system.activationScripts.permown = let
+      mkdir = plan: /* sh */ ''
+        ${pkgs.coreutils}/bin/mkdir -p ${shell.escape plan.path}
+      '';
+    in concatMapStrings mkdir plans;
+
+    systemd.services = genAttrs' plans (plan: {
+      name = "permown.${replaceStrings ["/"] ["_"] plan.path}";
+      value = {
+        environment = {
+          DIR_MODE = plan.directory-mode;
+          FILE_MODE = plan.file-mode;
+          OWNER_GROUP = "${plan.owner}:${plan.group}";
+          ROOT_PATH = plan.path;
+        };
+        path = [
+          pkgs.coreutils
+          pkgs.findutils
+          pkgs.inotifyTools
+        ];
+        serviceConfig = {
+          ExecStart = pkgs.writeDash "permown" ''
+            set -efu
+
+            find "$ROOT_PATH" -exec chown -h "$OWNER_GROUP" {} +
+            find "$ROOT_PATH" -type d -exec chmod "$DIR_MODE" {} +
+            find "$ROOT_PATH" -type f -exec chmod "$FILE_MODE" {} +
 
-          find "$ROOT_PATH" -exec chown "$OWNER_GROUP" {} +
-          find "$ROOT_PATH" -type d -exec chmod "$DIR_MODE" {} +
-          find "$ROOT_PATH" -type f -exec chmod "$FILE_MODE" {} +
+            paths=/tmp/paths
+            rm -f "$paths"
+            mkfifo "$paths"
 
-          inotifywait -mrq -e CREATE --format %w%f "$ROOT_PATH" |
-          while read -r path; do
-            if test -d "$path"; then
-              exec "$0" "$@"
-            fi
-            chown "$OWNER_GROUP" "$path"
-            chmod "$FILE_MODE" "$path"
-          done
-        '';
-        Restart = "always";
-        RestartSec = 10;
-        UMask = plan.umask;
+            inotifywait -mrq -e CREATE --format %w%f "$ROOT_PATH" > "$paths" &
+            inotifywaitpid=$!
+
+            trap cleanup EXIT
+            cleanup() {
+              kill "$inotifywaitpid"
+            }
+
+            while read -r path; do
+              if test -d "$path"; then
+                cleanup
+                exec "$0" "$@"
+              fi
+              chown -h "$OWNER_GROUP" "$path"
+              if test -f "$path"; then
+                chmod "$FILE_MODE" "$path"
+              fi
+            done < "$paths"
+          '';
+          PrivateTemp = true;
+          Restart = "always";
+          RestartSec = 10;
+          UMask = plan.umask;
+        };
+        wantedBy = [ "multi-user.target" ];
       };
-      wantedBy = [ "multi-user.target" ];
-    };
-  });
+    });
+
+  };
 
 }
diff --git a/krebs/3modules/syncthing.nix b/krebs/3modules/syncthing.nix
index bfbac1db9..897ba1e7f 100644
--- a/krebs/3modules/syncthing.nix
+++ b/krebs/3modules/syncthing.nix
@@ -10,7 +10,7 @@ let
     addresses = peer.addresses;
   }) cfg.peers;
 
-  folders = map (folder: {
+  folders = mapAttrsToList ( _: folder: {
     inherit (folder) path id type;
     devices = map (peer: { deviceId = cfg.peers.${peer}.id; }) folder.peers;
     rescanIntervalS = folder.rescanInterval;
@@ -81,17 +81,18 @@ in
     };
 
     folders = mkOption {
-      default = [];
-      type = types.listOf (types.submodule ({ config, ... }: {
+      default = {};
+      type = types.attrsOf (types.submodule ({ config, ... }: {
         options = {
 
           path = mkOption {
             type = types.absolute-pathname;
+            default = config._module.args.name;
           };
 
           id = mkOption {
             type = types.str;
-            default = config.path;
+            default = config._module.args.name;
           };
 
           peers = mkOption {
diff --git a/krebs/5pkgs/simple/qrscan.nix b/krebs/5pkgs/simple/qrscan.nix
new file mode 100644
index 000000000..7d99dcee7
--- /dev/null
+++ b/krebs/5pkgs/simple/qrscan.nix
@@ -0,0 +1,27 @@
+{ coreutils, gnused, writeDashBin, zbar }:
+
+writeDashBin "qrscan" ''
+  set -efu
+
+  tmpdir=$(${coreutils}/bin/mktemp --tmpdir -d qrscan.XXXXXXXX)
+  codefile=$tmpdir/code
+
+  cleanup() {
+    ${coreutils}/bin/rm "$codefile"
+    ${coreutils}/bin/rmdir "$tmpdir"
+  }
+
+  ${coreutils}/bin/mkfifo "$codefile"
+
+  ${zbar}/bin/zbarcam > "$codefile" &
+  zbarcampid=$!
+
+  exec < "$codefile"
+  while read -r code; do
+    code=$(printf %s "$code" | ${gnused}/bin/sed -n 's/^QR-Code://p')
+    if test -n "$code"; then
+      ${coreutils}/bin/kill "$zbarcampid"
+      echo "$code"
+    fi
+  done
+''
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index de6403bd0..d5ca0e21f 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
 {
   "url": "https://github.com/NixOS/nixpkgs-channels",
-  "rev": "5c52b25283a6cccca443ffb7a358de6fe14b4a81",
-  "date": "2019-04-09T21:48:56+02:00",
-  "sha256": "0fhbl6bgabhi1sw1lrs64i0hibmmppy1bh256lq8hxy3a2p1haip",
+  "rev": "8ea36d732567c80b2d11eb029e10400fe85ca786",
+  "date": "2019-04-18T22:37:03+01:00",
+  "sha256": "1d59i55qwqd76n2d0hr1si26q333ydizkd91h8lfczb00xnr5pqn",
   "fetchSubmodules": false
 }
diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index 7e183f40f..f911b79d6 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -49,12 +49,15 @@ with import <stockholm/lib>;
       ];
     }
     {
-      krebs.syncthing.folders = [
-        { id = "the_playlist"; path = "/home/lass/tmp/the_playlist"; peers = [ "mors" "phone" "prism" ]; }
-      ];
-      lass.ensure-permissions = [
-        { folder = "/home/lass/tmp/the_playlist"; owner = "lass"; group = "syncthing"; }
-      ];
+      krebs.syncthing.folders."the_playlist" = {
+        path = "/home/lass/tmp/the_playlist";
+        peers = [ "mors" "phone" "prism" ];
+      };
+      krebs.permown."/home/lass/tmp/the_playlist" = {
+        owner = "lass";
+        group = "syncthing";
+        umask = "0007";
+      };
     }
     {
       lass.umts = {
diff --git a/lass/2configs/green-host.nix b/lass/2configs/green-host.nix
index 860d7c113..1421eede7 100644
--- a/lass/2configs/green-host.nix
+++ b/lass/2configs/green-host.nix
@@ -20,13 +20,12 @@ with import <stockholm/lib>;
     }
   ];
 
-  lass.ensure-permissions = [
-    { folder = "/var/lib/sync-containers"; owner = "root"; group = "syncthing"; }
-  ];
-
-  krebs.syncthing.folders = [
-    { path = "/var/lib/sync-containers"; peers = [ "icarus" "skynet" "littleT" "shodan" ]; }
-  ];
+  krebs.syncthing.folders."/var/lib/sync-containers".peers = [ "icarus" "skynet" "littleT" "shodan" ];
+  krebs.permown."/var/lib/sync-containers" = {
+    owner = "root";
+    group = "syncthing";
+    umask = "0007";
+  };
 
   system.activationScripts.containerPermissions = ''
     mkdir -p /var/lib/containers
diff --git a/lass/2configs/radio.nix b/lass/2configs/radio.nix
index d67d970f8..88899c554 100644
--- a/lass/2configs/radio.nix
+++ b/lass/2configs/radio.nix
@@ -10,7 +10,7 @@ let
   source-password = import <secrets/icecast-source-pw>;
 
   add_random = pkgs.writeDashBin "add_random" ''
-    ${pkgs.mpc_cli}/bin/mpc add "$(${pkgs.mpc_cli}/bin/mpc ls | shuf -n1)"
+    ${pkgs.mpc_cli}/bin/mpc add "$(${pkgs.mpc_cli}/bin/mpc ls the_playlist/music | grep '\.ogg$' | shuf -n1)"
   '';
 
   skip_track = pkgs.writeDashBin "skip_track" ''
@@ -57,7 +57,7 @@ in {
   services.mpd = {
     enable = true;
     group = "radio";
-    musicDirectory = "/home/radio/the_playlist/music";
+    musicDirectory = "/home/radio/music";
     extraConfig = ''
       log_level "default"
       auto_update "yes"
@@ -248,10 +248,13 @@ in {
       alias ${html};
     '';
   };
-  krebs.syncthing.folders = [
-    { id = "the_playlist"; path = "/home/radio/music/the_playlist"; peers = [ "mors" "phone" "prism" ]; }
-  ];
-  lass.ensure-permissions = [
-    { folder = "/home/radio/music/the_playlist"; owner = "radio"; group = "syncthing"; }
-  ];
+  krebs.syncthing.folders."the_playlist" = {
+    path = "/home/radio/music/the_playlist";
+    peers = [ "mors" "phone" "prism" ];
+  };
+  krebs.permown."/home/radio/music/the_playlist" = {
+    owner = "radio";
+    group = "syncthing";
+    umask = "0002";
+  };
 }
diff --git a/lass/2configs/sync/decsync.nix b/lass/2configs/sync/decsync.nix
index 94569c94d..c3f6511c2 100644
--- a/lass/2configs/sync/decsync.nix
+++ b/lass/2configs/sync/decsync.nix
@@ -1,8 +1,11 @@
 {
-  krebs.syncthing.folders = [
-    { id = "decsync"; path = "/home/lass/decsync"; peers = [ "mors" "blue" "green" "phone" ]; }
-  ];
-  lass.ensure-permissions = [
-    { folder = "/home/lass/decsync"; owner = "lass"; group = "syncthing"; }
-  ];
+  krebs.syncthing.folders.decsync = {
+    path = "/home/lass/decsync";
+    peers = [ "mors" "blue" "green" "phone" ];
+  };
+  krebs.permown."/home/lass/decsync" = {
+    owner = "lass";
+    group = "syncthing";
+    umask = "0007";
+  };
 }
diff --git a/lass/2configs/sync/weechat.nix b/lass/2configs/sync/weechat.nix
index d10177b1d..30c7b262b 100644
--- a/lass/2configs/sync/weechat.nix
+++ b/lass/2configs/sync/weechat.nix
@@ -1,8 +1,8 @@
 {
-  krebs.syncthing.folders = [
-    { path = "/home/lass/.weechat"; peers = [ "blue" "green" "mors" ]; }
-  ];
-  lass.ensure-permissions = [
-    { folder = "/home/lass/.weechat"; owner = "lass"; group = "syncthing"; }
-  ];
+  krebs.syncthing.folders."/home/lass/.weechat".peers = [ "blue" "green" "mors" ];
+  krebs.permown."/home/lass/.weechat" = {
+    owner = "lass";
+    group = "syncthing";
+    umask = "0007";
+  };
 }
diff --git a/lass/2configs/syncthing.nix b/lass/2configs/syncthing.nix
index fc10b2cb4..48f2625c1 100644
--- a/lass/2configs/syncthing.nix
+++ b/lass/2configs/syncthing.nix
@@ -1,6 +1,6 @@
-{ config, pkgs, ... }:
-with import <stockholm/lib>;
-{
+{ config, pkgs, ... }: with import <stockholm/lib>; let
+  peers = mapAttrs (n: v: { id = v.syncthing.id; }) (filterAttrs (n: v: v.syncthing.id != null) config.krebs.hosts);
+in {
   services.syncthing = {
     enable = true;
     group = "syncthing";
@@ -14,17 +14,17 @@ with import <stockholm/lib>;
     enable = true;
     cert = toString <secrets/syncthing.cert>;
     key = toString <secrets/syncthing.key>;
-    peers = mapAttrs (n: v: { id = v.syncthing.id; }) (filterAttrs (n: v: v.syncthing.id != null) config.krebs.hosts);
-    folders = [
-      { path = "/home/lass/sync"; peers = [ "icarus" "mors" "skynet" "blue" "green" "littleT" "prism" "shodan" ]; }
-    ];
+    peers = peers;
+    folders."/home/lass/sync".peers = attrNames peers;
   };
 
   system.activationScripts.syncthing-home = ''
     ${pkgs.coreutils}/bin/chmod a+x /home/lass
   '';
 
-  lass.ensure-permissions = [
-    { folder = "/home/lass/sync"; owner = "lass"; group = "syncthing"; }
-  ];
+  krebs.permown."/home/lass/sync" = {
+    owner = "lass";
+    group = "syncthing";
+    umask = "0007";
+  };
 }
diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix
index 59043aeb1..613c7c8ac 100644
--- a/lass/3modules/default.nix
+++ b/lass/3modules/default.nix
@@ -3,7 +3,6 @@ _:
   imports = [
     ./dnsmasq.nix
     ./ejabberd
-    ./ensure-permissions.nix
     ./folderPerms.nix
     ./hosts.nix
     ./mysql-backup.nix
diff --git a/lass/3modules/ensure-permissions.nix b/lass/3modules/ensure-permissions.nix
deleted file mode 100644
index 36edc1127..000000000
--- a/lass/3modules/ensure-permissions.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-{ config, pkgs, ... }: with import <stockholm/lib>;
-
-let
-
-  cfg = config.lass.ensure-permissions;
-
-in
-
-{
-  options.lass.ensure-permissions = mkOption {
-    default = [];
-    type = types.listOf (types.submodule ({
-      options = {
-
-        folder = mkOption {
-          type = types.absolute-pathname;
-        };
-
-        owner = mkOption {
-          # TODO user type
-          type = types.str;
-          default = "root";
-        };
-
-        group = mkOption {
-          # TODO group type
-          type = types.str;
-          default = "root";
-        };
-
-        permission = mkOption {
-          # TODO permission type
-          type = types.str;
-          default = "u+rw,g+rw";
-        };
-
-      };
-    }));
-  };
-
-  config = mkIf (cfg != []) {
-
-  system.activationScripts.ensure-permissions = concatMapStringsSep "\n" (plan: ''
-    ${pkgs.coreutils}/bin/mkdir -p ${plan.folder}
-    ${pkgs.coreutils}/bin/chmod -R ${plan.permission} ${plan.folder}
-    ${pkgs.coreutils}/bin/chown -R ${plan.owner}:${plan.group} ${plan.folder}
-  '') cfg;
-    systemd.services =
-      listToAttrs (map (plan: nameValuePair "ensure-permisson.${replaceStrings ["/"] ["_"] plan.folder}" {
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          Restart = "always";
-          RestartSec = 10;
-          ExecStart = pkgs.writeDash "ensure-perms" ''
-            ${pkgs.inotifyTools}/bin/inotifywait -mrq -e CREATE --format %w%f ${plan.folder} \
-              | while IFS= read -r FILE; do
-                ${pkgs.coreutils}/bin/chmod -R ${plan.permission} "$FILE" 2>/dev/null
-                ${pkgs.coreutils}/bin/chown -R ${plan.owner}:${plan.group} "$FILE" 2>/dev/null
-              done
-          '';
-        };
-      }) cfg)
-    ;
-
-  };
-}