Merge remote-tracking branch 'prism/master'

62 files changed, 1010 insertions, 444 deletions

diff --git a/default.nix b/default.nix
index 52e8924cd..cab55d40a 100644
--- a/default.nix
+++ b/default.nix
@@ -3,3 +3,20 @@ import <nixpkgs/nixos/lib/eval-config.nix> {
     (import <nixpkgs/nixos/lib/from-env.nix> "NIXOS_CONFIG" <nixos-config>)
   ];
 }
+//
+{
+  lib = import ./lib;
+  systems = with import ./lib; let
+    ns = getEnv "LOGNAME";
+  in
+    genAttrs
+      (attrNames (filterAttrs (_: eq "directory") (readDir (<stockholm> + "/${ns}/1systems"))))
+      (name: let
+        config = import (<stockholm> + "/${ns}/1systems/${name}/config.nix");
+        source = import (<stockholm> + "/${ns}/1systems/${name}/source.nix");
+      in import <nixpkgs/nixos/lib/eval-config.nix> {
+        modules = [ config ];
+      } // {
+        inherit source;
+      });
+}
diff --git a/jeschli/1systems/bln/config.nix b/jeschli/1systems/bln/config.nix
index 8a3090a49..c9a7a34e2 100644
--- a/jeschli/1systems/bln/config.nix
+++ b/jeschli/1systems/bln/config.nix
@@ -1,42 +1,19 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
 { config, lib, pkgs, ... }:
 # bln config file
 {
   imports =
-    [ # Include the results of the hardware scan.
-      <stockholm/jeschli>
+    [ <stockholm/jeschli>
       <stockholm/jeschli/2configs/virtualbox.nix>
       <stockholm/jeschli/2configs/urxvt.nix>
+      <stockholm/jeschli/2configs/emacs.nix>
       ./hardware-configuration.nix
-      # ./dcso-vpn.nix
     ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
   jeschliFontSize = 20;
-  # Use the GRUB 2 boot loader.
-  boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
-  # boot.loader.grub.efiSupport = true;
-  # boot.loader.grub.efiInstallAsRemovable = true;
-  # boot.loader.efi.efiSysMountPoint = "/boot/efi";
-  # Define on which hard drive you want to install Grub.
-  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
-  boot.loader.grub.extraEntries = ''
-    menuentry "Debian GNU/Linux, kernel 4.9.0-4-amd64" {
-      search --set=drive1 --fs-uuid f169fd32-bf96-4da0-bc34-294249ffa606
-      linux ($drive1)/vmlinuz-4.9.0-4-amd64 root=/dev/mapper/pool-debian ro
-      initrd ($drive1)/initrd.img-4.9.0-4-amd64
-    }
-  '';
-  boot.initrd.luks.devices = [
-    {
-      name = "root";
-      device = "/dev/disk/by-uuid/cba5d550-c3c8-423e-a913-14b5210bdd32";
-      preLVM = true;
-      allowDiscards = true;
-    }
-  ];
+
   environment.shellAliases = {
     n = "nix-shell";
     gd = "cd /home/markus/go/src/gitlab.dcso.lolcat";
@@ -46,23 +23,13 @@
       LOGNAME=jeschli exec nix-shell -I stockholm="$PWD" --run 'deploy  --system="bln"'
     '';
   };
-  networking.hostName = lib.mkForce "BLN02NB0154"; # Define your hostname.
+  networking.hostName = lib.mkForce "BLN02NB0232";
   networking.networkmanager.enable = true;
-  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-
-  # Select internationalisation properties.
-  # i18n = {
-  #   consoleFont = "Lat2-Terminus16";
-  #   consoleKeyMap = "us";
-  #   defaultLocale = "en_US.UTF-8";
-  # };
 
   # Set your time zone.
   time.timeZone = "Europe/Berlin";
 
-
-  # List packages installed in system profile. To search by name, run:
-  # $ nix-env -qaP | grep wget
+  # Setup Packages
   nixpkgs.config.allowUnfree = true;
   environment.variables = { GOROOT= [ "${pkgs.go.out}/share/go" ]; };
   environment.systemPackages = with pkgs; [
@@ -85,7 +52,7 @@
     emacs
   # databases
     sqlite
-  # internet 
+  # internet
     thunderbird
     hipchat
     chromium
@@ -114,79 +81,44 @@
   ];
 
 
-
-  # Some programs need SUID wrappers, can be configured further or are
-  # started in user sessions.
   programs.bash.enableCompletion = true;
   programs.vim.defaultEditor = true;
-  # programs.mtr.enable = true;
-  # programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
-
-  # List services that you want to enable:
 
-  # Enable the OpenSSH daemon.
   services.openssh.enable = true;
 
-  # Open ports in the firewall.
-  # networking.firewall.allowedTCPPorts = [ ... ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-  # networking.firewall.enable = false;
-
   # Enable CUPS to print documents.
   services.printing.enable = true;
   services.printing.drivers = [ pkgs.postscript-lexmark ];
+
   # Enable the X11 windowing system.
   services.xserver.enable = true;
-  # services.xserver.xrandrHeads = [
-  #  { output = "eDP1"; }
-  #  { output = "DP-2-2-8"; primary = true; }
-  #  { output = "DP-2-1-8"; monitorConfig = ''Option "Rotate" "left"''; }
-  # ];
-  # services.xserver.layout = "us";
-  # services.xserver.xkbOptions = "eurosign:e";
-
-  # Enable touchpad support.
-  # services.xserver.libinput.enable = true;
-
-  # Enable the KDE Desktop Environment.
-#  services.xserver.displayManager.lightdm.enable = true;
+  services.xserver.videoDrivers = [ "nvidia" ];
+
   services.xserver.windowManager.xmonad.enable = true;
   services.xserver.windowManager.xmonad.enableContribAndExtras = true;
-#   services.xserver.desktopManager.gnome3.enable = true;
-  # services.xserver.displayManager.gdm.enable = true;
   services.xserver.displayManager.sddm.enable = true;
-  #services.xserver.desktopManager.plasma5.enable = true;
-#  services.xserver.displayManager.sessionCommands = ''
-#    (sleep 1 && ${pkgs.xorg.xrandr}/bin/xrandr --output VIRTUAL1 --off --output eDP1 --mode 1920x1080 --pos 5120x688 --rotate normal --output DP1 --off --output DP2-1 --mode 2560x1440 --pos 2560x328 --rotate normal --output DP2-2 --primary --mode 2560x1440 --pos 0x328 --rotate normal --output DP2-3 --off --output HDMI2 --off --output HDMI1 --off --output DP2 --off
-#'';
+  services.xserver.dpi = 100;
+  fonts.fontconfig.dpi = 100;
 
-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.extraUsers.markus = {
+  users.extraUsers.jeschli = {
     isNormalUser = true;
-    extraGroups = ["docker"];
+    extraGroups = ["docker" "vboxusers"];
     uid = 1000;
   };
 
-  # This value determines the NixOS release with which your system is to be
-  # compatible, in order to avoid breaking some software such as database
-  # servers. You should change this only after NixOS release notes say you
-  # should.
-  system.stateVersion = "17.09"; # Did you read the comment?
-
+  system.stateVersion = "17.09";
   # Gogland Debugger workaround
-#  nixpkgs.config.packageOverrides = super: {
-#    idea.gogland = lib.overrideDerivation super.idea.gogland (attrs: {
-#      postFixup = ''
-#	interp="$(cat $NIX_CC/nix-support/dynamic-linker)"
-#	patchelf --set-interpreter $interp $out/gogland*/plugins/intellij-go-plugin/lib/dlv/linux/dlv
-#        chmod +x $out/gogland*/plugins/intellij-go-plugin/lib/dlv/linux/dlv
-#     '';
-#    });
-#  };
-
-#  virtualisation.docker.enable = true;
-  
+  #  nixpkgs.config.packageOverrides = super: {
+  #    idea.gogland = lib.overrideDerivation super.idea.gogland (attrs: {
+  #      postFixup = ''
+  #	interp="$(cat $NIX_CC/nix-support/dynamic-linker)"
+  #	patchelf --set-interpreter $interp $out/gogland*/plugins/intellij-go-plugin/lib/dlv/linux/dlv
+  #        chmod +x $out/gogland*/plugins/intellij-go-plugin/lib/dlv/linux/dlv
+  #     '';
+  #    });
+  #  };
+
+  virtualisation.docker.enable = true;
 
   # DCSO Certificates
   security.pki.certificateFiles = [
@@ -197,7 +129,7 @@
    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCACOMPC3G1.pem"; sha256 = "0w88qaqhwxzvdkx40kzj2gka1yi85ipppjdkxah4mscwfhlryrnk"; })
    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC2G1.pem"; sha256 = "1z2qkyhgjvri13bvi06ynkb7mjmpcznmc9yw8chx1lnwc3cxa7kf"; })
    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC3G1.pem"; sha256 = "0smdjjvz95n652cb45yhzdb2lr83zg52najgbzf6lm3w71f8mv7f"; })
-  ]; 
+  ];
 
   hardware.bluetooth.enable = true;
   krebs.build.host = config.krebs.hosts.bln;
diff --git a/jeschli/1systems/bln/hardware-configuration.nix b/jeschli/1systems/bln/hardware-configuration.nix
index 714162271..b774bfc19 100644
--- a/jeschli/1systems/bln/hardware-configuration.nix
+++ b/jeschli/1systems/bln/hardware-configuration.nix
@@ -1,6 +1,3 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, ... }:
 
 {
@@ -8,27 +5,29 @@
     [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
     ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sr_mod" "rtsx_pci_sdmmc" ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
+  boot.initrd.luks.devices.crypted.device = "/dev/disk/by-uuid/25534522-5748-4dcc-a5ca-80a3ac70f59d";
+
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/02144ea4-947d-440e-bbf9-99cab0dccf05";
+    { device = "/dev/disk/by-uuid/496c8889-96db-446d-9bac-60d4347faeac";
       fsType = "ext4";
     };
 
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/f169fd32-bf96-4da0-bc34-294249ffa606";
-      fsType = "ext2";
-    };
-
   fileSystems."/home" =
-    { device = "/dev/disk/by-uuid/68ef2163-7b3d-4dbb-add9-d3543ad7c738";
+    { device = "/dev/disk/by-uuid/2785adf5-a99e-49d7-86d6-99f393f457ea";
       fsType = "ext4";
     };
 
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/927E-01A0";
+      fsType = "vfat";
+    };
+
   swapDevices = [ ];
 
-  nix.maxJobs = lib.mkDefault 4;
+  nix.maxJobs = lib.mkDefault 8;
   powerManagement.cpuFreqGovernor = "powersave";
 }
diff --git a/jeschli/1systems/bolide/config.nix b/jeschli/1systems/bolide/config.nix
index 83640801f..699a85b58 100644
--- a/jeschli/1systems/bolide/config.nix
+++ b/jeschli/1systems/bolide/config.nix
@@ -10,6 +10,7 @@
       ./hardware-configuration.nix
       <stockholm/jeschli>
       <stockholm/jeschli/2configs/urxvt.nix>
+      <stockholm/jeschli/2configs/emacs.nix>
     ];
 
   krebs.build.host = config.krebs.hosts.bolide;
diff --git a/jeschli/1systems/brauerei/config.nix b/jeschli/1systems/brauerei/config.nix
index eb2bb11d2..1203720a5 100644
--- a/jeschli/1systems/brauerei/config.nix
+++ b/jeschli/1systems/brauerei/config.nix
@@ -5,6 +5,7 @@
     <stockholm/jeschli>
     ./hardware-configuration.nix
     <stockholm/jeschli/2configs/urxvt.nix>
+    <stockholm/jeschli/2configs/emacs.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.brauerei;
diff --git a/jeschli/2configs/emacs.nix b/jeschli/2configs/emacs.nix
new file mode 100644
index 000000000..d9e6c854a
--- /dev/null
+++ b/jeschli/2configs/emacs.nix
@@ -0,0 +1,77 @@
+{ config, pkgs, ... }:
+
+let
+  packageRepos = ''
+    (require 'package) ;; You might already have this line
+    (let* ((no-ssl (and (memq system-type '(windows-nt ms-dos))
+                        (not (gnutls-available-p))))
+           (url (concat (if no-ssl "http" "https") "://melpa.org/packages/")))
+      (add-to-list 'package-archives (cons "melpa" url) t)
+      (add-to-list 'package-archives
+                 '("org" . "http://orgmode.org/elpa/") t)
+    )
+    (when (< emacs-major-version 24)
+      ;; For important compatibility libraries like cl-lib
+      (add-to-list 'package-archives '("gnu" . "http://elpa.gnu.org/packages/")))
+    (package-initialize)
+  '';
+  evilMode = ''
+    ;; Evil Mode
+    (add-to-list 'load-path "~/.emacs.d/evil")
+    (require 'evil)
+    (evil-mode 1)
+    (require 'evil-org)
+    (add-hook 'org-mode-hook 'evil-org-mode)
+    (evil-org-set-key-theme '(navigation insert textobjects additional calendar))
+    (require 'evil-org-agenda)
+    (evil-org-agenda-set-keys)
+  '';
+  windowCosmetics = ''
+    (tool-bar-mode -1)                  ; Disable the button bar atop screen
+    (scroll-bar-mode -1)                ; Disable scroll bar
+    (setq inhibit-startup-screen t)     ; Disable startup screen with graphics
+    (setq-default indent-tabs-mode nil) ; Use spaces instead of tabs
+    (setq tab-width 2)                  ; Four spaces is a tab
+    (setq visible-bell nil)             ; Disable annoying visual bell graphic
+    (setq ring-bell-function 'ignore)   ; Disable super annoying audio bell
+  '';
+  orgMode = ''
+    (add-to-list 'auto-mode-alist '("\\.\\(org\\|org_archive\\|txt\\)$" . org-mode))
+    (global-set-key "\C-cl" 'org-store-link)
+    (global-set-key "\C-ca" 'org-agenda)
+    (global-set-key "\C-cb" 'org-iswitchb)
+    (if (boundp 'org-user-agenda-files)
+      (setq org-agenda-files org-user-agenda-files)
+      (setq org-agenda-files (quote ("~/projects/notes")))
+    )
+  '';
+  emacsFile = ''
+    ${packageRepos}
+    ${windowCosmetics}
+    (custom-set-variables
+     ;; custom-set-variables was added by Custom.
+     ;; If you edit it by hand, you could mess it up, so be careful.
+     ;; Your init file should contain only one such instance.
+     ;; If there is more than one, they won't work right.
+     '(inhibit-startup-screen t)
+     '(org-agenda-files nil)
+     '(package-selected-packages
+       (quote
+        (smex ox-jira org-plus-contrib org-mime org-jira neotree molokai-theme let-alist helm-fuzzy-find go-guru go-autocomplete flymake-go exec-path-from-shell evil-org cl-lib-highlight bbdb atom-one-dark-theme))))
+     ${orgMode}
+  '';
+  dotEmacs = pkgs.writeText "dot-emacs" emacsFile;
+  emacs = (pkgs.emacsPackagesNgGen pkgs.emacs).emacsWithPackages (epkgs: [
+    epkgs.melpaStablePackages.magit
+    epkgs.melpaPackages.mmm-mode
+    epkgs.melpaPackages.nix-mode
+    epkgs.melpaPackages.go-mode
+  ]);
+  myEmacs = pkgs.writeDashBin "my-emacs" ''
+    exec ${emacs}/bin/emacs -q -l ${dotEmacs} "$@"
+  '';
+in {
+  environment.systemPackages = [
+    myEmacs
+  ];
+}
diff --git a/jeschli/2configs/virtualbox.nix b/jeschli/2configs/virtualbox.nix
index b2cb851a1..c9bb8c41f 100644
--- a/jeschli/2configs/virtualbox.nix
+++ b/jeschli/2configs/virtualbox.nix
@@ -1,7 +1,7 @@
 { config, pkgs, ... }:
 
 let
-  mainUser = config.users.extraUsers.markus;
+  mainUser = config.users.extraUsers.jeschli;
 
 in {
   #services.virtualboxHost.enable = true;
diff --git a/jeschli/source.nix b/jeschli/source.nix
index fe1de8fd1..29cf9d818 100644
--- a/jeschli/source.nix
+++ b/jeschli/source.nix
@@ -13,10 +13,7 @@ in
   evalSource (toString _file) [
     {
       nixos-config.symlink = "stockholm/jeschli/1systems/${name}/config.nix";
-      nixpkgs.git = {
-        url = https://github.com/nixos/nixpkgs;
-        ref = "0653b73";
-      };
+      nixpkgs = (import <stockholm/krebs/source.nix> host).nixpkgs;
       secrets.file = getAttr builder {
         buildbot = toString <stockholm/jeschli/2configs/tests/dummy-secrets>;
         jeschli = "${getEnv "HOME"}/secrets/${name}";
diff --git a/krebs/2configs/buildbot-all.nix b/krebs/2configs/buildbot-all.nix
index 5ea78f227..d85cde175 100644
--- a/krebs/2configs/buildbot-all.nix
+++ b/krebs/2configs/buildbot-all.nix
@@ -5,6 +5,5 @@ with import <stockholm/lib>;
   krebs.ci.enable = true;
   krebs.ci.treeStableTimer = 1;
   krebs.ci.hosts = filter (getAttr "ci") (attrValues config.krebs.hosts);
-  krebs.ci.tests = [ "deploy" ];
 }
 
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index e269d1fa1..0c3e68c39 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -89,7 +89,7 @@ with import <stockholm/lib>;
                           60 IN NS     ns16.ovh.net.
                           60 IN NS     dns16.ovh.net.
                           60 IN A      ${config.krebs.hosts.prism.nets.internet.ip4.addr}
-                          60 IN TXT    v=spf1 mx -all
+                          60 IN TXT    v=spf1 mx a:lassul.us -all
           cgit            60 IN A      ${config.krebs.hosts.prism.nets.internet.ip4.addr}
           io              60 IN NS     ions.lassul.us.
           ions            60 IN A      ${config.krebs.hosts.prism.nets.internet.ip4.addr}
@@ -618,6 +618,47 @@ with import <stockholm/lib>;
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5HyLyaIvVH0qHIQ4ciKhDiElhSqsK+uXcA6lTvL+5n";
     };
+    cabal = {
+      cores = 2;
+      nets = rec {
+        retiolum = {
+          ip4.addr = "10.243.1.4";
+          ip6.addr = "42::1:4";
+          aliases = [
+            "cabal.r"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIECgKCBAEAukXm8xPpC6/F+wssYqQbqt1QDwsPrF3TJ9ToLFcN1WgDlhDhjM3A
+            SuRDMNjRT1fvVTuXyplH5g16eokW/yLOpNnznMS3/VR372pLPEOqfuRf7wAy18jj
+            rZkW3EO7nyZ8KMb+SXA8Q0KIpHY50Ezh+tqGoTZDICwoK6N5dKLgAZShS55JXwwK
+            qRG3vyzV3mDjgVyT0FNfyL1/BN1qvJ+tQQ40lEbkcQauMunMzNbH058kAd6H2/0e
+            LK4JkxI9XpZHE6Pf1epXyClHW7vT7APFRp9gL9tZS/XMC18+aEMFfQrNW9jb3FIq
+            rU5MfJ7aubboe7dT6CRaRSWpduiKLVzY/JCoGvUziyvmR7qHsQWTEjtNuQX9joc3
+            6iq1o+gmLV0G8Xwq8cEcg5USlLxNsGBQPwYnTG6iTPPHqOv7BKucekE/opnVZseE
+            fSNCGl1+tGwa3soSMI97LkpQTZxdeqf+jWZve0RbSa2Ihyod91ldFCqi1+PZx68v
+            yBI0PJamlt+dBx6WQKbPngWYeD8hXo7tg0XVRVa3ZQyX+Mq6uCCb2GM8ewMUPl+A
+            kcY1osFt6+sdkFGdiv3FMyijAiZumPoPprXC/4SGIsMnkoI4JfSAbTpHi2QuesqR
+            KMeairdB7XGUYlMvWpDLKN2dbMdRc+l3kDUKT7hALjKeyWS/27WYeK/STxvZXEXi
+            TZGHopvOFv6wcrb6nI49vIJo5mDLFamAPN3ZjeR20wP95UP7cUUSaTYX49M4lX6U
+            oL5BaFrcLn2PTvS84pUxcXKAp70FgTpvGJbaWwETgDjW+H+qlGmI/BTejpL7flVs
+            TOtaP/uCMxhVZSFv9bzo0ih10o+4gtU8lqxfJsVxlf2K7LVZ++LQba/u+XxRY+xw
+            3IFBfg34tnO6zYlV8XgAiJ6IUOHUZANsuBD4iMoFSVOig6t5eIOkgXR6GEkP8FBD
+            rkroRMmxcu4lTCOzWIuAVOxCd4XXguoGQ4HAzpGd5ccdcb8Ev4RYEvNJY7B5tIQZ
+            4J0F9ECzJuSu1HvWTL+T6a36d2MDTkXU2IJ2tSHciXqiP+QMMF7p9Ux0tiAq4mtf
+            luA94uKWg3cSyTyEM/jF66CgO6Ts3AivNE0MRNupV6AbUdr+TjzotGn9rxi168py
+            w/49OVbpR9EIGC2wxx7qcSEk5chFOcgvNQMRqgIx51bbOL7JYb0f4XuA38GUqLkG
+            09PXmPeyqGzR9HsV2XZDprZdD3Dy4ojdexw0+YILg9bHaAxLHYs6WFZvzfaLLsf1
+            K2I39vvrEEOy8tHi4jvMk7oVX6RWG+DOZMeXTvyUCaBHyYkA0eDlC6NeKOHxnW/g
+            ZtN1W93UdklEqc5okM0/ZIke1HDRt3ZLdQIDAQAB
+            -----END RSA PUBLIC KEY-----
+          '';
+        };
+      };
+      secure = true;
+      ssh.privkey.path =