Merge remote-tracking branch 'lass/master'

26 files changed, 358 insertions, 193 deletions

diff --git a/jeschli/1systems/brauerei/config.nix b/jeschli/1systems/brauerei/config.nix
index e200cbcd4..4cd544a66 100644
--- a/jeschli/1systems/brauerei/config.nix
+++ b/jeschli/1systems/brauerei/config.nix
@@ -8,6 +8,7 @@
     <stockholm/jeschli/2configs/emacs.nix>
     <stockholm/jeschli/2configs/xdg.nix>
     <stockholm/jeschli/2configs/xserver>
+    <stockholm/jeschli/2configs/steam.nix>
     <stockholm/jeschli/2configs/virtualbox.nix>
   ];
 
diff --git a/jeschli/1systems/enklave/config.nix b/jeschli/1systems/enklave/config.nix
index 470566a8b..cadec3cab 100644
--- a/jeschli/1systems/enklave/config.nix
+++ b/jeschli/1systems/enklave/config.nix
@@ -5,6 +5,7 @@
     <stockholm/jeschli>
     <stockholm/jeschli/2configs/retiolum.nix>
     <stockholm/jeschli/2configs/IM.nix>
+    <stockholm/jeschli/2configs/git.nix>
     <stockholm/jeschli/2configs/os-templates/CentOS-7-64bit.nix>
     {
       networking.dhcpcd.allowInterfaces = [
diff --git a/jeschli/2configs/git.nix b/jeschli/2configs/git.nix
new file mode 100644
index 000000000..77602e0f1
--- /dev/null
+++ b/jeschli/2configs/git.nix
@@ -0,0 +1,73 @@
+{ config, lib, pkgs, ... }:
+
+with import <stockholm/lib>;
+
+let
+
+  out = {
+    services.nginx.enable = true;
+    krebs.git = {
+      enable = true;
+      cgit = {
+        settings = {
+          root-title = "public repositories at ${config.krebs.build.host.name}";
+          root-desc = "keep calm and engage";
+        };
+        enable = true;
+      };
+      repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) repos;
+      rules = rules;
+    };
+
+    krebs.iptables.tables.filter.INPUT.rules = [
+      { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; }
+    ];
+  };
+
+  repos = public-repos;
+
+  rules = concatMap make-rules (attrValues repos);
+
+  public-repos = mapAttrs make-public-repo {
+    stockholm = {
+      cgit.desc = "Bonbon aus Git - die ganze Nacht";
+    };
+    krebs-page = {
+      cgit.desc = "Die Krebs Page";
+    };
+  };
+
+  make-public-repo = name: { cgit ? {}, ... }: {
+    inherit cgit name;
+    public = true;
+    hooks = {
+      post-receive = pkgs.git-hooks.irc-announce {
+        nick = config.krebs.build.host.name;
+        channel = "#xxx";
+        server = "irc.r";
+        verbose = true; 
+        branches = [ "master" ];
+      };
+    };
+  };
+
+  make-rules =
+    with git // config.krebs.users;
+    repo:
+      singleton {
+        user = [ jeschli jeschli-brauerei];
+        repo = [ repo ];
+        perm = push "refs/*" [ non-fast-forward create delete merge ];
+      } ++
+      optional repo.public {
+        user = attrValues config.krebs.users;
+        repo = [ repo ];
+        perm = fetch;
+      } ++
+      optional (length (repo.collaborators or []) > 0) {
+        user = repo.collaborators;
+        repo = [ repo ];
+        perm = fetch;
+      };
+
+in out
diff --git a/jeschli/2configs/retiolum.nix b/jeschli/2configs/retiolum.nix
index b611cbe7d..f22609655 100644
--- a/jeschli/2configs/retiolum.nix
+++ b/jeschli/2configs/retiolum.nix
@@ -17,7 +17,7 @@
     tinc = pkgs.tinc_pre;
   };
 
-  networking.firewall.allowedTCPPorts = [ 655 ];
+  networking.firewall.allowedTCPPorts = [ 80 655 ];
   networking.firewall.allowedUDPPorts = [ 655 ];
 
   environment.systemPackages = [
diff --git a/jeschli/2configs/steam.nix b/jeschli/2configs/steam.nix
new file mode 100644
index 000000000..06a068a3f
--- /dev/null
+++ b/jeschli/2configs/steam.nix
@@ -0,0 +1,12 @@
+{ config, pkgs, ... }:
+
+{
+
+  nixpkgs.config.steam.java = true;
+  environment.systemPackages = with pkgs; [
+    steam
+  ];
+  hardware.opengl.driSupport32Bit = true;
+
+  #ports for inhome streaming
+}
diff --git a/jeschli/krops.nix b/jeschli/krops.nix
new file mode 100644
index 000000000..e55f207d3
--- /dev/null
+++ b/jeschli/krops.nix
@@ -0,0 +1,40 @@
+{ name }: let
+  inherit (import ../krebs/krops.nix { inherit name; })
+    krebs-source
+    lib
+    pkgs
+  ;
+
+  source = { test }: lib.evalSource [
+    krebs-source
+    {
+      nixos-config.symlink = "stockholm/jeschli/1systems/${name}/config.nix";
+      secrets = if test then {
+        file = toString ./2configs/tests/dummy-secrets;
+      } else {
+        pass = {
+          dir = "${lib.getEnv "HOME"}/.password-store";
+          name = "hosts/${name}";
+        };
+      };
+    }
+  ];
+
+in {
+  # usage: $(nix-build --no-out-link --argstr name HOSTNAME -A deploy)
+  deploy = pkgs.krops.writeDeploy "${name}-deploy" {
+    source = source { test = false; };
+    target = "root@${name}/var/src";
+  };
+
+  # usage: $(nix-build --no-out-link --argstr name HOSTNAME -A test)
+  test = pkgs.krops.writeTest "${name}-test" {
+    source = source { test = true; };
+    target = "${lib.getEnv "HOME"}/tmp/${name}-stockholm-test";
+  };
+
+  ci = pkgs.krops.writeTest "${name}-test" {
+    source = source { test = true; };
+    target = "${lib.getEnv "HOME"}/stockholm-build";
+  };
+}
diff --git a/krebs/0tests/data/secrets/konsens.id_ed25519 b/krebs/0tests/data/secrets/konsens.id_ed25519
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/krebs/0tests/data/secrets/konsens.id_ed25519
diff --git a/krebs/2configs/buildbot-stockholm.nix b/krebs/2configs/buildbot-stockholm.nix
index 62a5f9ab5..13d4c6729 100644
--- a/krebs/2configs/buildbot-stockholm.nix
+++ b/krebs/2configs/buildbot-stockholm.nix
@@ -4,6 +4,14 @@ let
 
   hostname = config.networking.hostName;
 
+  build = pkgs.writeDash "build" ''
+    set -eu
+    export USER="$1"
+    export SYSTEM="$2"
+    $(nix-build $USER/krops.nix --no-out-link --argstr name "$SYSTEM" --argstr target "$HOME/stockholm-build" -A ci)
+  '';
+
+
 in
 {
   networking.firewall.allowedTCPPorts = [ 80 ];
@@ -24,7 +32,7 @@ in
       testslave = "lasspass";
     };
     change_source.stockholm = ''
-      stockholm_repo = 'http://cgit.prism.r/stockholm'
+      stockholm_repo = 'http://cgit.hotdog.r/stockholm'
       cs.append(
           changes.GitPoller(
               stockholm_repo,
@@ -95,15 +103,9 @@ in
                         env={
                           "NIX_PATH": "secrets=/var/src/stockholm/null:stockholm=./:/var/src",
                           "NIX_REMOTE": "daemon",
-                          "dummy_secrets": "true",
                         },
                         command=[
-                          "nix-shell", "-I", "stockholm=.", "--run", " ".join(["test",
-                            "--user={}".format(user),
-                            "--system={}".format(host),
-                            "--force-populate",
-                            "--target=$LOGNAME@${config.krebs.build.host.name}$HOME/{}".format(user),
-                          ])
+                          "${build}", user, host
                         ],
                         timeout=90001,
                         workdir='build', # TODO figure out why we need this?
diff --git a/krebs/2configs/repo-sync.nix b/krebs/2configs/repo-sync.nix
index 7c3b2c90e..813dc154b 100644
--- a/krebs/2configs/repo-sync.nix
+++ b/krebs/2configs/repo-sync.nix
@@ -3,6 +3,10 @@
 with import <stockholm/lib>;
 
 let
+  konsens-user = {
+    name = "konsens";
+    pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKKozGNGBAzHnyj6xUlsjGxxknyChXvuyrddkWVVnz7";
+  };
   mirror = "git@${config.networking.hostName}:";
 
   defineRepo = {
@@ -20,7 +24,7 @@ let
           verbose = false;
           channel = "#xxx";
           server = "irc.r";
-          branches = [ "newest" ];
+          branches = [ "master" "newest" ];
         };
       };
     };
@@ -38,6 +42,13 @@ let
         perm = push ''refs/*'' [ non-fast-forward create delete merge ];
       }
       {
+        user = [
+          konsens-user
+        ];
+        repo = [ repo ];
+        perm = push ''refs/heads/master'' [ create merge ];
+      }
+      {
         user = attrValues config.krebs.users;
         repo = [ repo ];
         perm = fetch;
@@ -108,6 +119,19 @@ in {
   krebs.repo-sync = {
     enable = true;
   };
+  krebs.konsens = {
+    enable = true;
+    repos = {
+      krops = { branchesToCheck = [ "lassulus" "tv" ]; };
+      stockholm = {};
+    };
+  };
+  krebs.secret.files.konsens = {
+    path = "/var/lib/konsens/.ssh/id_ed25519";
+    owner = konsens-user;
+    source-path = "${<secrets/konsens.id_ed25519>}";
+  };
+
   imports = [
     (sync-retiolum { name = "the_playlist"; desc = "Good Music collection + tools"; section = "art"; })
 
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index afc96e9ee..833349769 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -26,6 +26,7 @@ let
       ./iana-etc.nix
       ./iptables.nix
       ./kapacitor.nix
+      ./konsens.nix
       ./monit.nix
       ./newsbot-js.nix
       ./nixpkgs.nix
diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix
index 5ae24b40b..8a923efd2 100644
--- a/krebs/3modules/git.nix
+++ b/krebs/3modules/git.nix
@@ -348,6 +348,10 @@ let
     users.users.${cfg.user.name} = {
       inherit (cfg.user) home name uid;
       description = "Git repository hosting user";
+      extraGroups = [
+        # To allow running cgit-clear-cache via hooks.
+        cfg.cgit.fcgiwrap.group.name
+      ];
       shell = "/bin/sh";
       openssh.authorizedKeys.keys =
         unique
@@ -403,13 +407,12 @@ let
         ));
 
     environment.systemPackages = [
-      (pkgs.writeDashBin "cgit-clear-cache" ''
-        ${pkgs.coreutils}/bin/rm -f ${cfg.cgit.settings.cache-root}/*
-      '')
+      (pkgs.cgit-clear-cache.override { inherit (cfg.cgit.settings) cache-root; })
     ];
 
     system.activationScripts.cgit = ''
-      mkdir -m 0700 -p ${cfg.cgit.settings.cache-root}
+      mkdir -m 0770 -p ${cfg.cgit.settings.cache-root}
+      chmod 0770 ${cfg.cgit.settings.cache-root}
       chown ${toString cfg.cgit.fcgiwrap.user.uid}:${toString cfg.cgit.fcgiwrap.group.gid} ${cfg.cgit.settings.cache-root}
     '';
 
diff --git a/krebs/3modules/jeschli/default.nix b/krebs/3modules/jeschli/default.nix
index ed9bfad29..ab8fe097d 100644
--- a/krebs/3modules/jeschli/default.nix
+++ b/krebs/3modules/jeschli/default.nix
@@ -132,6 +132,7 @@ with import <stockholm/lib>;
           ip6.addr = "42::30";
           aliases = [
             "enklave.r"
+            "cgit.enklave.r"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----
diff --git a/krebs/3modules/konsens.nix b/krebs/3modules/konsens.nix
new file mode 100644
index 000000000..47316d5d6
--- /dev/null
+++ b/krebs/3modules/konsens.nix
@@ -0,0 +1,80 @@
+{ config, lib, pkgs, ... }:
+
+with import <stockholm/lib>;
+
+let
+  cfg = config.krebs.konsens;
+
+  out = {
+    options.krebs.konsens = api;
+    config = lib.mkIf cfg.enable imp;
+  };
+
+  api = {
+    enable = mkEnableOption "git konsens finder";
+    repos = mkOption {
+      type = types.attrsOf (types.submodule ({ config, ...}: {
+        options = {
+          url = mkOption {
+            type = types.str;
+            default = "git@localhost:${config._module.args.name}";
+          };
+          branchesToCheck = mkOption {
+            type = types.listOf types.str;
+            default = [ "lassulus" "makefu" "tv" ];
+          };
+          target = mkOption {
+            type = types.str;
+            default = "master";
+          };
+          timerConfig = mkOption {
+            type = types.attrsOf types.str;
+            default = {
+              OnCalendar = "*:00,15,30,45";
+            };
+          };
+        };
+      }));
+    };
+  };
+
+  imp = {
+    users.users.konsens = rec {
+      name = "konsens";
+      uid = genid name;
+      home = "/var/lib/konsens";
+      createHome = true;
+    };
+
+    systemd.timers = mapAttrs' (name: repo:
+      nameValuePair "konsens-${name}" {
+        description = "konsens timer";
+        wantedBy = [ "timers.target" ];
+        timerConfig = repo.timerConfig;
+      }
+    ) cfg.repos;
+
+    systemd.services = mapAttrs' (name: repo:
+      nameValuePair "konsens-${name}" {
+        after = [ "network.target" "secret.service" ];
+        path = [ pkgs.git ];
+        restartIfChanged = false;
+        serviceConfig = {
+          Type = "simple";
+          PermissionsStartOnly = true;
+          ExecStart = pkgs.writeDash "konsens-${name}" ''
+            if ! test -e ${name}; then
+              git clone ${repo.url} ${name}
+            fi
+            cd ${name}
+            git fetch origin
+            git push origin $(git merge-base ${concatMapStringsSep " " (branch: "origin/${branch}") repo.branchesToCheck}):refs/heads/master
+          '';
+          WorkingDirectory = /var/lib/konsens;
+          User = "konsens";
+        };
+      }
+    ) cfg.repos;
+  };
+
+in out
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index c4a5bbb0d..7d9ef5075 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -11,39 +11,6 @@ with import <stockholm/lib>;
     ci = true;
     monitoring = true;
   }) {
-    dishfire = {
-      cores = 4;
-      nets = rec {
-        internet = {
-          ip4.addr = "144.76.172.188";
-          aliases = [
-            "dishfire.i"
-          ];
-          ssh.port = 45621;
-        };
-        retiolum = {
-          via = internet;
-          ip4.addr = "10.243.133.99";
-          ip6.addr = "42:0000:0000:0000:0000:0000:d15f:1233";
-          aliases = [
-            "dishfire.r"
-          ];
-          tinc.pubkey = ''
-            -----BEGIN RSA PUBLIC KEY-----
-            MIIBCgKCAQEAwKi49fN+0s5Cze6JThM7f7lj4da27PSJ/3w3tDFPvtQco11ksNLs
-            Xd3qPaQIgmcNVCR06aexae3bBeTx9y3qHvKqZVE1nCtRlRyqy1LVKSj15J1D7yz7
-            uS6u/BSZiCzmdZwu3Fq5qqoK0nfzWe/NKEDWNa5l4Mz/BZQyI/hbOpn6UfFD0LpK
-            R4jzc9Dbk/IFNAvwb5yrgEYtwBzlXzeDvHW2JcPq3qQjK2byQYNiIyV3g0GHppEd
-            vDbIPDFhTn3Hv5zz/lX+/We8izzRge7MEd+Vn9Jwb5NAzwDsOHl6ExpqASv9H49U
-            HwgPw5pstabyrsDWXybSYUb+8LcZf+unGwIDAQAB
-            -----END RSA PUBLIC KEY-----
-          '';
-          tinc.port = 993;
-        };
-      };
-      ssh.privkey.path = <secrets/ssh.id_ed25519>;
-      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGv0JMp0y+E5433GRSFKVK3cQmP0AAlS9aH9fk49yFxy";
-    };
     prism = rec {
       cores = 4;
       extraZones = {
@@ -441,7 +408,7 @@ with import <stockholm/lib>;
         };
       };
     };
-    borg = {
+    rock = {
       monitoring = false;
       ci = false;
       external = true;
@@ -449,22 +416,21 @@ with import <stockholm/lib>;
         retiolum = {
           ip4.addr = "10.243.29.171";
           ip6.addr = "42:4992:6a6d:700::2";
-          aliases = [ "borg.r" ];
+          aliases = [ "rock.r" ];
           tinc.pubkey = ''
-            -----BEGIN PUBLIC KEY-----
-            MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0bHZApTM7Hl4qqNakSwq
-            bt7zJoTVK9ePoC3Mue1VmJ1mCKMaxKdzlO31kPeHtkilAzgyIJdgikyKFlApGsQL
-            aIuU9h55X7TbikoDD6ghbSrAe3Pgc+sJ3OZ7wO7Qb8CKgJvEbkk/u68YiJgyTjYD
-            HNjIQzlsGdpoSke9vwC8qWanfgN7c2MMGtakqfXDjYjCgp7O43i+SMupkMSXIXMA
-            5XUFh/vVp6xgPxBofcw0uQIyZ5v4PPFjnGPm4rnMbFzbhubntHjDadwGd5Niyw4O
-            zNNKNchTLfNiuNGqTZeYd0kJ5fNMKykhpSs+ou34MvexvpuyPlFuotnPXN/nOMml
-            3nwiqzthzPuBZRLswxT0WvlA8wlbeTOKJ0wTIR4dDuAF+euDtoNocVEN5PJNc7yN
-            fmwAV6geESoJbZQMSCtAp1NioaBlRPp1pFfoM/GotHywuFrTIxyoIBiYhkpWyQvq
-            WYw5j13IKqkL7jDchhoBmcardmh+AP5bL3uQ84BgaYNwFzHp04qIRrrdpF0eMaHB
-            /8zaqsNLn4/zQJB5ffkelwoIqfvLPQeCMLzHGHgP5xUnWgmZZGiiDLvhuaMeNq4U
-            EpCKoTL178sPOgNfHfd8mEqx0qKYuPrNQEdlpa5xOZqwx56pfYpGWY+KtF2FHLhS
-            iO64GCJqCi1MKBYx/NhaxKMCAwEAAQ==
-            -----END PUBLIC KEY-----
+            -----BEGIN RSA PUBLIC KEY-----
+            MIICCgKCAgEAsMJbXDhkaLZcEzCIe8G+rHyLulWIqrUAmDT4Vbtv4r0QhPBsqwjM
+            DuvRtX5SNHdjfZWnUZoOlmXrmIo07exPFQvyrnppm6DNx+IZ5mNMNVIFUoojRhF7
+            HS2jubcjTEib56XEYWKly0olrVMbsJk5THJqRQyOQuTPCFToxXVRcT5t/UK6Dzgh
+            mp+suJ7IcmmO80IwfZrQrQslkQ6TdOy1Vs908GacSQJyRxdRxLraU/98iMhFbAQf
+            Ap+qVSUU88iCi+tcoSYzKhqU2N0AhRGcsE073B3Px8CAgPK/juwTrFElKEc17X9M
+            Rh41DvUjrtG4ERPmbwKPtsLagmnZUlU8A5YC8wtV08RI5QBsbbOsKInareV1aLeD
+            91ZVCBPFTz8IM6Mc6H435eMCMC2ynFCDyRGdcue3tBQoaTGe1dbduIZkPGn+7cg4
+            fef1db6SQD4HCwDLv8CTFLACR/jmAapwZEgvJ3u3bpgMGzt+QNvL1cxUr3TBUWRv
+            3f0R+Dj8DCUWTJUE7K5LO7bL4p9Ht0yIsVH+/DucyoMQqRwCwWSr7+H2MAsWviav
+            ZRRfH0RqZPEzCxyLDBtkVrx+GRAUZxy1xlqmN16O/sRHiqq3bv8Jk3dwuRZlFu6q
+            cOFu4g9XsamHkmCuVkvTGjnC2h21MjUUr3PGHzOMtiM/18LcfX730f8CAwEAAQ==
+            -----END RSA PUBLIC KEY-----
           '';
         };
       };
diff --git a/krebs/5pkgs/simple/cgit-clear-cache.nix b/krebs/5pkgs/simple/cgit-clear-cache.nix
new file mode 100644
index 000000000..28402c39c
--- /dev/null
+++ b/krebs/5pkgs/simple/cgit-clear-cache.nix
@@ -0,0 +1,8 @@
+with import <stockholm/lib>;
+
+{ cache-root ? "/tmp/cgit", findutils, writeDashBin }:
+
+writeDashBin "cgit-clear-cache" ''
+  set -efu
+  ${findutils}/bin/find ${shell.escape cache-root} -type f -delete
+''
diff --git a/krebs/5pkgs/simple/krops.nix b/krebs/5pkgs/simple/krops.nix
index e4e9928d4..23cc224b8 100644
--- a/krebs/5pkgs/simple/krops.nix
+++ b/krebs/5pkgs/simple/krops.nix
@@ -2,6 +2,6 @@
 
 fetchgit {
   url = https://cgit.krebsco.de/krops;
-  rev = "refs/tags/v1.1.0";
-  sha256 = "19z5385rdci2bj0l7ksjbgyj84vsb29kz87j9x6vj5vv16y7y4ll";
+  rev = "refs/tags/v1.3.1";
+  sha256 = "0bv984bjc6r1ys1q0wnszv1v1g1wdvjb6i0ibj7namwz0mhg67a7";
 }
diff --git a/krebs/krops.nix b/krebs/krops.nix
index c334bc07d..c71e60571 100644
--- a/krebs/krops.nix
+++ b/krebs/krops.nix
@@ -60,4 +60,9 @@
     source = source { test = true; };
     target = "${lib.getEnv "HOME"}/tmp/${name}-krops-test-src";
   };
+
+  ci = pkgs.krops.writeTest "${name}-test" {
+    source = source { test = true; };
+    target = "${lib.getEnv "HOME"}/stockholm-build";
+  };
 }
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index 13bed8bfe..a9a0f6634 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
 {
   "url": "https://github.com/NixOS/nixpkgs-channels",
-  "rev": "4df3426f5a5e78cef4835897a43abd9e2a092b74",
-  "date": "2018-08-19T09:20:40+02:00",
-  "sha256": "05k5mssiqxffxi45mss9wjns6k76i248rpasa48akdcriry1mp63",
+  "rev": "a37638d46706610d12c9747614fd1b8f8d35ad48",
+  "date": "2018-08-30T21:03:26+02:00",
+  "sha256": "0rsdkk4z7pkqr2mw0pq7i6fkqs7gbi5kral3c8smm9bw104sn8v7",
   "fetchSubmodules": true
 }
diff --git a/lass/1systems/dishfire/config.nix b/lass/1systems/dishfire/config.nix
deleted file mode 100644
index 3d5f32180..000000000
--- a/lass/1systems/dishfire/config.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  imports = [
-    <stockholm/lass>
-    <stockholm/lass/2configs/retiolum.nix>
-    <stockholm/lass/2configs/git.nix>
-    {
-      networking.dhcpcd.allowInterfaces = [
-        "enp*"
-        "eth*"
-        "ens*"
-      ];
-    }
-    {
-      sound.enable = false;
-    }
-    {
-      environment.systemPackages = with pkgs; [
-        mk_sql_pair
-      ];
-    }
-    {
-      imports = [
-        <stockholm/lass/2configs/websites/fritz.nix>
-      ];
-      krebs.iptables.tables.filter.INPUT.rules = [
-         { predicate = "-p tcp --dport http"; target = "ACCEPT"; }
-         { predicate = "-p tcp --dport https"; target = "ACCEPT"; }
-      ];
-    }
-    {
-      #TODO: abstract & move to own file
-      krebs.exim-smarthost = {
-        enable = true;
-        relay_from_hosts = map (host: host.nets.retiolum.ip4.addr) [
-          config.krebs.hosts.mors
-          config.krebs.hosts.uriel
-        ];
-        system-aliases = [
-          { from = "mailer-daemon"; to = "postmaster"; }
-          { from = "postmaster"; to = "root"; }
-          { from = "nobody"; to = "root"; }
-          { from = "hostmaster"; to = "root"; }
-          { from = "usenet"; to = "root"; }
-          { from = "news"; to = "root"; }
-          { from = "webmaster"; to = "root"; }
-          { from = "www"; to = "root"; }
-          { from = "ftp"; to = "root"; }
-          { from = "abuse"; to = "root"; }
-          { from = "noc"; to = "root"; }
-          { from = "security"; to = "root"; }
-          { from = "root"; to = "lass"; }
-        ];
-      };
-      krebs.iptables.tables.filter.INPUT.rules = [
-        { predicate = "-p tcp --dport smtp"; target = "ACCEPT"; }
-      ];
-    }
-  ];
-
-  krebs.build.host = config.krebs.hosts.dishfire;
-}
diff --git a/lass/1systems/dishfire/physical.nix b/lass/1systems/dishfire/physical.nix
deleted file mode 100644
index 64e3904e0..000000000
--- a/lass/1systems/dishfire/physical.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  imports = [
-    ./config.nix
-    <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
-  ];
-
-  boot.loader.grub = {
-    device = "/dev/vda";
-    splashImage = null;
-  };
-
-  boot.initrd.availableKernelModules = [
-    "ata_piix"
-    "ehci_pci"
-    "uhci_hcd"
-    "virtio_pci"
-    "virtio_blk"
-  ];
-
-  fileSystems."/" = {
-    device = "/dev/mapper/pool-nix";
-    fsType = "ext4";
-  };
-
-  fileSystems."/srv/http" = {
-    device = "/dev/pool/srv_http";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/vda1";
-    fsType = "ext4";
-  };
-  fileSystems."/bku" = {
-    device = "/dev/pool/bku";
-    fsType = "ext4";
-  };
-}
diff --git a/lass/1systems/dishfire/source.nix b/lass/1systems/dishfire/source.nix
deleted file mode 100644
index 2445af130..000000000
--- a/lass/1systems/dishfire/source.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-import <stockholm/lass/source.nix> {
-  name = "dishfire";
-}
diff --git a/lass/krops.nix b/lass/krops.nix
index 776a3a55d..c5a932206 100644
--- a/lass/krops.nix
+++ b/lass/krops.nix
@@ -1,4 +1,4 @@
-{ config ? config, name }: let
+{ name }: let
   inherit (import ../krebs/krops.nix { inherit name; })
     krebs-source
     lib
@@ -10,7 +10,7 @@
     {
       nixos-config.symlink = "stockholm/lass/1systems/${name}/physical.nix";
       secrets = if test then {
-        file = "/home/lass/stockholm/lass/2configs/tests/dummy-secrets";
+        file = toString ./2configs/tests/dummy-secrets;
       } else {
         pass = {
           dir = "${lib.getEnv "HOME"}/.password-store";
@@ -30,13 +30,11 @@ in {
   # usage: $(nix-build --no-out-link --argstr name HOSTNAME -A test)
   test = pkgs.krops.writeTest "${name}-test" {
     source = source { test = true; };
-    target = "${lib.getEnv "HOME"}/tmp/${name}-krops-test-src";
+    target = "${lib.getEnv "HOME"}/tmp/${name}-stockholm-test";
   };
 
-  ci = map (host:
-    pkgs.krops.writeTest "${host.name}-test" {
-      source = source { test = true; };
-      target = "${lib.getEnv "TMPDIR"}/lass/${host.name}";
-    }
-  ) (lib.filter (host: lib.getAttr "ci" host && host.owner == "lass") (lib.attrValues config.krebs.hosts));
+  ci = pkgs.krops.writeTest "${name}-test" {
+    source = source { test = true; };
+    target = "${lib.getEnv "HOME"}/stockholm-build";
+  };
 }
diff --git a/makefu/krops.nix b/makefu/krops.nix
index 3b5f3df9c..9a701dcac 100644
--- a/makefu/krops.nix
+++ b/makefu/krops.nix
@@ -81,10 +81,8 @@ in {
     target = "${lib.getEnv "HOME"}/tmp/${name}-krops-test-src";
   };
 
-  ci = map (host:
-    pkgs.krops.writeTest "${host.name}-test" {
-      source = source { test = true; };
-      target = "${lib.getEnv "TMPDIR"}/makefu/${host.name}";
-    }
-  ) (lib.filter (host: lib.getAttr "ci" host && host.owner == "makefu") (lib.attrValues config.krebs.hosts));
+  ci = pkgs.krops.writeTest "${name}-test" {
+    source = source { test = true; };
+    target = "${lib.getEnv "HOME"}/stockholm-build";
+  };
 }
diff --git a/nin/krops.nix b/nin/krops.nix
new file mode 100644
index 000000000..2ba896419
--- /dev/null
+++ b/nin/krops.nix
@@ -0,0 +1,40 @@
+{ name }: let
+  inherit (import ../krebs/krops.nix { inherit name; })
+    krebs-source
+    lib
+    pkgs
+  ;
+
+  source = { test }: lib.evalSource [
+    krebs-source
+    {
+      nixos-config.symlink = "stockholm/nin/1systems/${name}/config.nix";
+      secrets = if test then {
+        file = toString ./0tests/dummysecrets;
+      } else {
+        pass = {
+          dir = "${lib.getEnv "HOME"}/.password-store";
+          name = "hosts/${name}";
+        };
+      };
+    }
+  ];
+
+in {
+  # usage: $(nix-build --no-out-link --argstr name HOSTNAME -A deploy)
+  deploy = pkgs.krops.writeDeploy "${name}-deploy" {
+    source = source { test = false; };
+    target = "root@${name}/var/src";
+  };
+
+  # usage: $(nix-build --no-out-link --argstr name HOSTNAME -A test)
+  test = pkgs.krops.writeTest "${name}-test" {
+    source = source { test = true; };
+    target = "${lib.getEnv "HOME"}/tmp/${name}-stockholm-test";
+  };
+
+  ci = pkgs.krops.writeTest "${name}-test" {
+    source = source { test = true; };
+    target = "${lib.getEnv "HOME"}/stockholm-build";
+  };
+}
diff --git a/submodules/nix-writers b/submodules/nix-writers
-Subproject 4d0829328e885a6d7163b513998a975e60dd0a7
+Subproject 5d79992262e8f16a3efa985375be74abea3bb39
diff --git a/tv/2configs/gitrepos.nix b/tv/2configs/gitrepos.nix
index 06875038d..74fb5215a 100644
--- a/tv/2configs/gitrepos.nix
+++ b/tv/2configs/gitrepos.nix
@@ -18,6 +18,10 @@ let {
     };
   };
 
+  cgit-clear-cache = pkgs.cgit-clear-cache.override {
+    inherit (config.krebs.git.cgit.settings) cache-root;
+  };
+
   repos =
     public-repos //
     optionalAttrs config.krebs.build.host.secure restricted-repos;
@@ -97,8 +101,11 @@ let {
     {