Merge remote-tracking branch 'cd/master'

11 files changed, 412 insertions, 360 deletions

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index a1f335905..66a325ed9 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -12,14 +12,17 @@ let
     enable = mkEnableOption "krebs.backup" // { default = true; };
     plans = mkOption {
       default = {};
-      type = types.attrsOf (types.submodule ({
-        # TODO enable = mkEnableOption "TODO" // { default = true; };
+      type = types.attrsOf (types.submodule ({ config, ... }: {
         options = {
+          enable = mkEnableOption "krebs.backup.${config.name}" // {
+            default = true;
+          };
           method = mkOption {
             type = types.enum ["pull" "push"];
           };
           name = mkOption {
             type = types.str;
+            default = config._module.args.name;
           };
           src = mkOption {
             type = types.krebs.file-location;
@@ -29,7 +32,7 @@ let
           };
           startAt = mkOption {
             default = "hourly";
-            type = types.str; # TODO systemd.time(7)'s calendar event
+            type = with types; nullOr str; # TODO systemd.time(7)'s calendar event
           };
           snapshots = mkOption {
             default = {
@@ -57,239 +60,165 @@ let
   };
 
   imp = {
-    users.groups.backup.gid = genid "backup";
-    users.users = {}
-      // {
-        root.openssh.authorizedKeys.keys =
-          map (plan: plan.dst.host.ssh.pubkey)
-              (filter isPullSrc (attrValues cfg.plans))
-          ++
-          map (plan: plan.src.host.ssh.pubkey)
-              (filter isPushDst (attrValues cfg.plans))
-          ;
-      }
-      ;
     systemd.services =
-      flip mapAttrs' (filterAttrs (_:isPullDst) cfg.plans) (name: plan: {
-        name = "backup.${name}.pull";
-        value = makePullService plan;
-      })
-      //
-      flip mapAttrs' (filterAttrs (_:isPushSrc) cfg.plans) (name: plan: {
-        name = "backup.${name}.push";
-        value = makePushService plan;
-      })
-      ;
-  };
-
-  isPushSrc = plan:
-    plan.method == "push" &&
-    plan.src.host.name == config.krebs.build.host.name;
-
-  isPullSrc = plan:
-    plan.method == "pull" &&
-    plan.src.host.name == config.krebs.build.host.name;
-
-  isPushDst = plan:
-    plan.method == "push" &&
-    plan.dst.host.name == config.krebs.build.host.name;
-
-  isPullDst = plan:
-    plan.method == "pull" &&
-    plan.dst.host.name == config.krebs.build.host.name;
-
-  # TODO push destination needs this in the dst.user's PATH
-  service-path = [
-    pkgs.coreutils
-    pkgs.gnused
-    pkgs.openssh
-    pkgs.rsync
-    pkgs.utillinux
-  ];
-
-  # TODO if there is plan.user, then use its privkey
-  makePushService = plan: assert isPushSrc plan; {
-    path = service-path;
-    serviceConfig = {
-      ExecStart = push plan;
-      Type = "oneshot";
-    };
-    startAt = plan.startAt;
-  };
+      listToAttrs (map (plan: nameValuePair "backup.${plan.name}" {
+        # TODO if there is plan.user, then use its privkey
+        # TODO push destination users need a similar path
+        path = with pkgs; [
+          coreutils
+          gnused
+          openssh
+          rsync
+          utillinux
+        ];
+        serviceConfig = rec {
+          ExecStart = start plan;
+          SyslogIdentifier = ExecStart.name;
+          Type = "oneshot";
+        };
+        startAt = mkIf (plan.startAt != null) plan.startAt;
+      }) (filter (plan: build-host-is "pull" "dst" plan ||
+                        build-host-is "push" "src" plan)
+                 enabled-plans));
 
-  makePullService = plan: assert isPullDst plan; {
-    path = service-path;
-    serviceConfig = {
-      ExecStart = pull plan;
-      Type = "oneshot";
-    };
-    startAt = plan.startAt;
+    users.groups.backup.gid = genid "backup";
+    users.users.root.openssh.authorizedKeys.keys =
+      map (plan: getAttr plan.method {
+        push = plan.src.host.ssh.pubkey;
+        pull = plan.dst.host.ssh.pubkey;
+      }) (filter (plan: build-host-is "pull" "src" plan ||
+                        build-host-is "push" "dst" plan)
+                 enabled-plans);
   };
 
-  push = plan: let
-    # We use writeDashBin and return the absolute path so systemd will produce
-    # nice names in the log, i.e. without the Nix store hash.
-    out = "${main}/bin/${main.name}";
-
-    main = writeDashBin "backup.${plan.name}.push" ''
-      set -efu
-      dst=${shell.escape plan.dst.path}
-
-      mkdir -m 0700 -p "$dst"
-      exec flock -n "$dst" ${critical-section}
-    '';
-
-    critical-section = writeDash "backup.${plan.name}.push.critical-section" ''
-      # TODO check if there is a previous
-      set -efu
-      identity=${shell.escape plan.src.host.ssh.privkey.path}
-      src=${shell.escape plan.src.path}
-      dst_target=${shell.escape "root@${getFQDN plan.dst.host}"}
-      dst_path=${shell.escape plan.dst.path}
-      dst=$dst_target:$dst_path
-
-      # Export NOW so runtime of rsync doesn't influence snapshot naming.
-      export NOW
-      NOW=$(date +%s)
-
-      echo >&2 "update snapshot: current; $src -> $dst"
-      rsync >&2 \
-          -aAXF --delete \
-          -e "ssh -F /dev/null -i $identity" \
-          --rsync-path ${shell.escape
-            "mkdir -m 0700 -p ${shell.escape plan.dst.path} && rsync"} \
-          --link-dest="$dst_path/current" \
-          "$src/" \
-          "$dst/.partial"
+  enabled-plans = filter (getAttr "enable") (attrValues cfg.plans);
 
-      exec ssh -F /dev/null \
-          -i "$identity" \
-          "$dst_target" \
-          -T \
-          env NOW="$NOW" /bin/sh < ${remote-snapshot}
-      EOF
-    '';
+  build-host-is = method: side: plan:
+    plan.method == method &&
+    config.krebs.build.host.name == plan.${side}.host.name;
 
-    remote-snapshot = writeDash "backup.${plan.name}.push.remote-snapshot" ''
-      set -efu
-      dst=${shell.escape plan.dst.path}
-
-      if test -e "$dst/current"; then
-        mv "$dst/current" "$dst/.previous"
-      fi
-      mv "$dst/.partial" "$dst/current"
-      rm -fR "$dst/.previous"
-      echo >&2
-
-      (${(take-snapshots plan).text})
-    '';
-
-  in out;
-
-  # TODO admit plan.dst.user and its ssh identity
-  pull = plan: let
-    # We use writeDashBin and return the absolute path so systemd will produce
-    # nice names in the log, i.e. without the Nix store hash.
-    out = "${main}/bin/${main.name}";
-
-    main = writeDashBin "backup.${plan.name}.pull" ''
+  start = plan: pkgs.writeDash "backup.${plan.name}" ''
+    set -efu
+    ${getAttr plan.method {
+      push = ''
+        identity=${shell.escape plan.src.host.ssh.privkey.path}
+        src_path=${shell.escape plan.src.path}
+        src=$src_path
+        dst_user=root
+        dst_host=$(${fastest-address plan.dst.host})
+        dst_port=$(${network-ssh-port plan.dst.host "$dst_host"})
+        dst_path=${shell.escape plan.dst.path}
+        dst=$dst_user@$dst_host:$dst_path
+        echo "update snapshot: current; $src -> $dst" >&2
+        dst_shell() {
+          exec ssh -F /dev/null \
+              -i "$identity" \
+              ''${dst_port:+-p $dst_port} \
+              "$dst_user@$dst_host" \
+              -T "$with_dst_path_lock_script"
+        }
+      '';
+      pull = ''
+        identity=${shell.escape plan.dst.host.ssh.privkey.path}
+        src_user=root
+        src_host=$(${fastest-address plan.src.host})
+        src_port=$(${network-ssh-port plan.src.host "$src_host"})
+        src_path=${shell.escape plan.src.path}
+        src=$src_user@$src_host:$src_path
+        dst_path=${shell.escape plan.dst.path}
+        dst=$dst_path
+        echo "update snapshot: current; $dst <- $src" >&2
+        dst_shell() {
+          eval "$with_dst_path_lock_script"
+        }
+      '';
+    }}
+    # Note that this only works because we trust date +%s to produce output
+    # that doesn't need quoting when used to generate a command string.
+    # TODO relax this requirement by selectively allowing to inject variables
+    #   e.g.: ''${shell.quote "exec env NOW=''${shell.unquote "$NOW"} ..."}
+    with_dst_path_lock_script="exec env start_date=$(date +%s) "${shell.escape
+      "flock -n ${shell.escape plan.dst.path} /bin/sh"
+    }
+    rsync >&2 \
+        -aAXF --delete \
+        -e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \
+        --rsync-path ${shell.escape (concatStringsSep " && " [
+          "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current"
+          "exec flock -n ${shell.escape plan.dst.path} rsync"
+        ])} \
+        --link-dest="$dst_path/current" \
+        "$src/" \
+        "$dst/.partial"
+    dst_shell < ${toFile "backup.${plan.name}.take-snapshots" ''
       set -efu
-      dst=${shell.escape plan.dst.path}
-
-      mkdir -m 0700 -p "$dst"
-      exec flock -n "$dst" ${critical-section}
-    '';
+      : $start_date
 
-    critical-section = writeDash "backup.${plan.name}.pull.critical-section" ''
-      # TODO check if there is a previous
-      set -efu
-      identity=${shell.escape plan.dst.host.ssh.privkey.path}
-      src=${shell.escape "root@${getFQDN plan.src.host}:${plan.src.path}"}
       dst=${shell.escape plan.dst.path}
 
-      # Export NOW so runtime of rsync doesn't influence snapshot naming.
-      export NOW
-      NOW=$(date +%s)
-
-      echo >&2 "update snapshot: current; $dst <- $src"
-      mkdir -m 0700 -p ${shell.escape plan.dst.path}
-      rsync >&2 \
-          -aAXF --delete \
-          -e "ssh -F /dev/null -i $identity" \
-          --link-dest="$dst/current" \
-          "$src/" \
-          "$dst/.partial"
       mv "$dst/current" "$dst/.previous"
       mv "$dst/.partial" "$dst/current"
       rm -fR "$dst/.previous"
       echo >&2
 
-      exec ${take-snapshots plan}
-    '';
-  in out;
-
-  take-snapshots = plan: writeDash "backup.${plan.name}.take-snapshots" ''
-    set -efu
-    NOW=''${NOW-$(date +%s)}
-    dst=${shell.escape plan.dst.path}
-
-    snapshot() {(
-      : $ns $format $retain
-      name=$(date --date="@$NOW" +"$format")
-      if ! test -e "$dst/$ns/$name"; then
-        echo >&2 "create snapshot: $ns/$name"
-        mkdir -m 0700 -p "$dst/$ns"
-        rsync >&2 \
-            -aAXF --delete \
-            --link-dest="$dst/current" \
-            "$dst/current/" \
-            "$dst/$ns/.partial.$name"
-        mv "$dst/$ns/.partial.$name" "$dst/$ns/$name"
-        echo >&2
-      fi
-      case $retain in
-        ([0-9]*)
-          delete_from=$(($retain + 1))
-          ls -r "$dst/$ns" \
-            | sed -n "$delete_from,\$p" \
-            | while read old_name; do
-                echo >&2 "delete snapshot: $ns/$old_name"
-                rm -fR "$dst/$ns/$old_name"
-              done
-          ;;
-        (ALL)
-          :
-          ;;
-      esac
-    )}
-
-    ${concatStringsSep "\n" (mapAttrsToList (ns: { format, retain ? null, ... }:
-      toString (map shell.escape [
-        "ns=${ns}"
-        "format=${format}"
-        "retain=${if retain == null then "ALL" else toString retain}"
-        "snapshot"
-      ]))
-      plan.snapshots)}
+      snapshot() {(
+        : $ns $format $retain
+        name=$(date --date="@$start_date" +"$format")
+        if ! test -e "$dst/$ns/$name"; then
+          echo >&2 "create snapshot: $ns/$name"
+          mkdir -m 0700 -p "$dst/$ns"
+          rsync >&2 \
+              -aAXF --delete \
+              --link-dest="$dst/current" \
+              "$dst/current/" \
+              "$dst/$ns/.partial.$name"
+          mv "$dst/$ns/.partial.$name" "$dst/$ns/$name"
+          echo >&2
+        fi
+        case $retain in
+          ([0-9]*)
+            delete_from=$(($retain + 1))
+            ls -r "$dst/$ns" \
+              | sed -n "$delete_from,\$p" \
+              | while read old_name; do
+                  echo >&2 "delete snapshot: $ns/$old_name"
+                  rm -fR "$dst/$ns/$old_name"
+                done
+            ;;
+          (ALL)
+            :
+            ;;
+        esac
+      )}
+
+      ${concatStringsSep "\n" (mapAttrsToList (ns: { format, retain, ... }:
+        toString (map shell.escape [
+          "ns=${ns}"
+          "format=${format}"
+          "retain=${if retain == null then "ALL" else toString retain}"
+          "snapshot"
+        ]))
+        plan.snapshots)}
+    ''}
   '';
 
-  # TODO getFQDN: admit hosts in other domains
-  getFQDN = host: "${host.name}.${config.krebs.search-domain}";
-
-  writeDash = name: text: pkgs.writeScript name ''
-    #! ${pkgs.dash}/bin/dash
-    ${text}
+  # XXX Is one ping enough to determine fastest address?
+  fastest-address = host: ''
+    { ${pkgs.fping}/bin/fping </dev/null -a \
+        ${concatMapStringsSep " " shell.escape
+          (mapAttrsToList (_: net: head net.aliases) host.nets)} \
+      | ${pkgs.coreutils}/bin/head -1; }
   '';
 
-  writeDashBin = name: text: pkgs.writeTextFile {
-    executable = true;
-    destination = "/bin/${name}";
-    name = name;
-    text = ''
-      #! ${pkgs.dash}/bin/dash
-      ${text}
-    '';
-  };
+  # Note that we don't escape word on purpose, so we deref shell vars.
+  # TODO type word
+  network-ssh-port = host: word: ''
+    case ${word} in
+    ${concatStringsSep ";;\n" (mapAttrsToList
+      (_: net: "(${head net.aliases}) echo ${toString net.ssh.port}")
+      host.nets)};;
+    esac
+  '';
 
 in out
 # TODO ionice
diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 00142acdd..3530fd595 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -3,8 +3,6 @@
 with lib;
 
 let
-  target = config.krebs.build // { user.name = "root"; };
-
   out = {
     # TODO deprecate krebs.build.host
     options.krebs.build.host = mkOption {
@@ -17,12 +15,6 @@ let
       default = "/nix/var/nix/profiles/system";
     };
 
-    # TODO make krebs.build.target.host :: host
-    options.krebs.build.target = mkOption {
-      type = with types; nullOr str;
-      default = null;
-    };
-
     # TODO deprecate krebs.build.user
     options.krebs.build.user = mkOption {
       type = types.user;
@@ -74,7 +66,7 @@ let
 
           unset tmpdir
           trap '
-            rm "$tmpdir"/*
+            rm -f "$tmpdir"/*
             rmdir "$tmpdir"
             trap - EXIT INT QUIT
           '        EXIT INT QUIT
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index ba1f425d9..3d51076cf 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -21,6 +21,7 @@ let
       ./go.nix
       ./iptables.nix
       ./nginx.nix
+      ./nixpkgs.nix
       ./per-user.nix
       ./Reaktor.nix
       ./retiolum-bootstrap.nix
@@ -84,6 +85,7 @@ let
   imp = mkMerge [
     { krebs = import ./lass { inherit lib; }; }
     { krebs = import ./makefu { inherit lib; }; }
+    { krebs = import ./miefda { inherit lib; }; }
     { krebs = import ./mv { inherit lib; }; }
     { krebs = import ./shared { inherit lib; }; }
     { krebs = import ./tv { inherit lib; }; }
@@ -92,11 +94,12 @@ let
         de.krebsco = "zones";
         gg23 = "hosts";
         shack = "hosts";
+        i = "hosts";
         internet = "hosts";
+        r = "hosts";
         retiolum = "hosts";
       };
 
-      # XXX This overlaps with krebs.retiolum
       networking.extraHosts = concatStringsSep "\n" (flatten (
         mapAttrsToList (hostname: host:
           mapAttrsToList (netname: net:
@@ -104,10 +107,8 @@ let
               aliases = longs ++ shorts;
               providers = dns.split-by-provider net.aliases cfg.dns.providers;
               longs = providers.hosts;
-              shorts =
-                map (removeSuffix ".${cfg.search-domain}")
-                    (filter (hasSuffix ".${cfg.search-domain}")
-                            longs);
+              shorts = let s = ".${cfg.search-domain}"; in
+                map (removeSuffix s) (filter (hasSuffix s) longs);
             in
               map (addr: "${addr} ${toString aliases}") net.addrs
           ) (filterAttrs (name: host: host.aliases != []) host.nets)
@@ -156,7 +157,16 @@ let
         let inherit (config.krebs.build.host.ssh) privkey; in
         mkIf (privkey != null) (mkForce [privkey]);
 
+      # TODO use imports for merging
       services.openssh.knownHosts =
+        (let inherit (config.krebs.build.host.ssh) pubkey; in
+          optionalAttrs (pubkey != null) {
+            localhost = {
+              hostNames = ["localhost" "127.0.0.1" "::1"];
+              publicKey = pubkey;
+            };
+          })
+        //
         # GitHub's IPv4 address range is 192.30.252.0/22
         # Refs https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/
         # 192.30.252.0/22 = 192.30.252.0-192.30.255.255 (1024 addresses)
@@ -180,7 +190,6 @@ let
                 (mapAttrsToList
                   (net-name: net:
                     let
-                      aliases = shorts ++ longs;
                       longs = net.aliases;
                       shorts =
                         map (removeSuffix ".${cfg.search-domain}")
@@ -191,7 +200,7 @@ let
                           then "[${a}]:${toString net.ssh.port}"
                           else a;
                     in
-                    aliases ++ map add-port net.addrs)
+                    map add-port (shorts ++ longs ++ net.addrs))
                   host.nets);
 
             publicKey = host.ssh.pubkey;
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 26b0947bb..749d3ff49 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -3,10 +3,40 @@
 with lib;
 
 {
-  hosts = addNames {
+  hosts = {
+    dishfire = {
+      cores = 4;
+      nets = rec {
+        internet = {
+          addrs4 = ["144.76.172.188"];
+          aliases = [
+            "dishfire.internet"
+          ];
+        };
+        retiolum = {
+          via = internet;
+          addrs4 = ["10.243.133.99"];
+          addrs6 = ["42:0000:0000:0000:0000:0000:d15f:1233"];
+          aliases = [
+            "dishfire.retiolum"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEAwKi49fN+0s5Cze6JThM7f7lj4da27PSJ/3w3tDFPvtQco11ksNLs
+            Xd3qPaQIgmcNVCR06aexae3bBeTx9y3qHvKqZVE1nCtRlRyqy1LVKSj15J1D7yz7
+            uS6u/BSZiCzmdZwu3Fq5qqoK0nfzWe/NKEDWNa5l4Mz/BZQyI/hbOpn6UfFD0LpK
+            R4jzc9Dbk/IFNAvwb5yrgEYtwBzlXzeDvHW2JcPq3qQjK2byQYNiIyV3g0GHppEd
+            vDbIPDFhTn3Hv5zz/lX+/We8izzRge7MEd+Vn9Jwb5NAzwDsOHl6ExpqASv9H49U
+            HwgPw5pstabyrsDWXybSYUb+8LcZf+unGwIDAQAB
+            -----END RSA PUBLIC KEY-----
+          '';
+        };
+      };
+      ssh.privkey.path = <secrets/ssh.id_ed25519>;
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGv0JMp0y+E5433GRSFKVK3cQmP0AAlS9aH9fk49yFxy";
+    };
     echelon = {
       cores = 2;
-      dc = "lass"; #dc = "cac";
       nets = rec {
         internet = {
           addrs4 = ["162.252.241.33"];
@@ -40,7 +70,6 @@ with lib;
     };
     prism = {
       cores = 4;
-      dc = "lass"; #dc = "cac";
       nets = rec {
         internet = {
           addrs4 = ["213.239.205.240"];
@@ -72,7 +101,6 @@ with lib;
       ssh.pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChm4sqQ2bUZj+2YnTf6G5HHRTpSe1jTUhJRnwcYPYZKF+CBqBncipRpuGlGXEsptNa+7ZMcQC0ySsz5SUOMt3Ih+NehVe/qt3VtRz0l0MgOWmH2qBwKK9Y4IuxrJQzUmP4UGlOGlFj9DORssSMOyFIG4eZ9k2qMn3xal0NVRfGTShKlouWsiUILZ8I+sDNE00z8DAYesgc1yazvRnjzvLkRxdNdpYiAFBbmXMpPKK95McRJaWsuNSeal9kd5p5PagWcgN4DZ6+ebzz3NKnmzk4j+vuHX0U9lTXBqKMlzzmM2YNLRtDPfrtJNyHqLpZUpFhJKqZCD+4/0zdrzRfC7Th+5czzUCSvHiKPVsqw5eOdiQX6EyzNAF5zpkpRp//QdUNNXC5/Ku6GKCO491+TuA8VCha0fOwBONccTLUI/hGNmCh88mLbukVoeGJrbYNCOA/6kEz7ZLEveU4i+TT7okhDElMsNk+AWCZ8/NdJQNX3/K6+JJ9qAn+/yC8LdjgYYJ2oU/aw5/HyOgiQ0z4n9UfQ7j+nHysY9CQb1b3guX7yjJoc3KpNXCXEztuIRHjFD1EP8NRTSmGjsa/VjLmTLSsqjD+7IE5mT0tO5RJvmagDgdJSr/iR5D9zjW7hx7ttvektrlp9g0v3CiCFVaW4l95hGYT0HaNBLJ5R0YHm0lD+Q==";
     };
     fastpoke = {
-      dc = "lass";
       nets = rec {
         internet = {
           addrs4 = ["193.22.164.36"];
@@ -103,7 +131,6 @@ with lib;
     };
     cloudkrebs = {
       cores = 1;
-      dc = "lass"; #dc = "cac";
       nets = rec {
         internet = {
           addrs4 = ["104.167.113.104"];
@@ -136,7 +163,6 @@ with lib;
     };
     uriel = {
       cores = 1;
-      dc = "lass";
       nets = {
         gg23 = {
           addrs4 = ["10.23.1.12"];
@@ -167,7 +193,6 @@ with lib;
     };
     mors = {
       cores = 2;
-      dc = "lass";
       nets = {
         gg23 = {
           addrs4 = ["10.23.1.11"];
@@ -196,32 +221,46 @@ with lib;
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAMPlIG+6u75GJ3kvsPF6OoIZsU+u8ZQ+rdviv5fNMD";
     };
-    schnabel-ap = {
-      nets = {
-        gg23 = {
-          addrs4 = ["10.23.1.20"];
-          aliases = ["schnabel-ap.gg23"];
-        };
-      };
-    };
-    Reichsfunk-ap = {
+    helios = {
+      cores = 2;
       nets = {
-        gg23 = {
-          addrs4 = ["10.23.1.10"];
-          aliases = ["Reichsfunk-ap.gg23"];
+        retiolum = {
+          addrs4 = ["10.243.0.3"];
+          addrs6 = ["42:0:0:0:0:0:0:7105"];
+          aliases = [
+            "helios.retiolum"
+            "cgit.helios.retiolum"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEA9SItL2mhQpTl95gjSWRstrDajUnI5YbrVCuaDKfw9gRwMyPNiO/y
+            Xwv/w4Ri8NCJZLZGkj2vG3X0EfJFBEPTJPTCbF9fP7PqqVs38BD41txLp+NrFxEq
+            5fmFk65/eg8ujrNQoOSUGmky/BKqQhWjvxdAWuwjN933wJCcNCxyaUwljHLYEK/I
+            oIJX+spnFmPwmhW9hsOj8K06eHixT13+0W48GG/ZNcV3x5vWxcKUvZ4Qtzz2iMNB
+            hud5kae7xMUfFAzCeKF/zsjuyt2d/xQg1WgR8MXGNgYhNJFSXz94r/bivNO6H4vP
+            Pfjndnh8cD46ADo8woS1nQ19WId+sMbipwIDAQAB
+            -----END RSA PUBLIC KEY-----
+          '';
         };
       };
+      secure = true;
+      ssh.privkey.path = <secrets/ssh.id_ed25519>;
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDWlIxkX41V55Yker8n4gErx2xcKpXFNKthhbP3+bTJ7";
     };
 
   };
-  users = addNames {
+  users = {
     lass = {
-      pubkey = readFile ../../Zpubkeys/lass.ssh.pub;
+      pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAp83zynhIueJJsWlSEykVSBrrgBFKq38+vT8bRfa+csqyjZBl2SQFuCPo+Qbh49mwchpZRshBa9jQEIGqmXxv/PYdfBFQuOFgyUq9ZcTZUXqeynicg/SyOYFW86iiqYralIAkuGPfQ4howLPVyjTZtWeEeeEttom6p6LMY5Aumjz2em0FG0n9rRFY2fBzrdYAgk9C0N6ojCs/Gzknk9SGntA96MDqHJ1HXWFMfmwOLCnxtE5TY30MqSmkrJb7Fsejwjoqoe9Y/mCaR0LpG2cStC1+37GbHJNH0caCMaQCX8qdfgMVbWTVeFWtV6aWOaRgwLrPDYn4cHWQJqTfhtPrNQ== lass@mors";
       mail = "lass@mors.retiolum";
     };
-    uriel = {
-      pubkey = readFile ../../Zpubkeys/uriel.ssh.pub;
+    lass-uriel = {
+      pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDExWuRcltGM2FqXO695nm6/QY3wU3r1bDTyCpMrLfUSym7TxcXDSmZSWcueexPXV6GENuUfjJPZswOdWqIo5u2AXw9t0aGvwEDmI6uJ7K5nzQOsXIneGMdYuoOaAzWI8pxZ4N+lIP1HsOYttIPDp8RwU6kyG+Ud8mnVHWSTO13C7xC9vePnDP6b+44nHS691Zj3X/Cq35Ls0ISC3EM17jreucdP62L3TKk2R4NCm3Sjqj+OYEv0LAqIpgqSw5FypTYQgNByxRcIcNDlri63Q1yVftUP1338UiUfxtraUu6cqa2CdsHQmtX5mTNWEluVWO3uUKTz9zla3rShC+d3qvr lass@uriel";
       mail = "lass@uriel.retiolum";
     };
+    lass-helios = {
+      pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDBOnMtgy5GH6R6tHp2ugy5QTe3gAGxh2CKsstSNSNAJwvWGiaWJkbNmgM8KlCWeq1GJBGa95kU4I2BDO5fJd7J9vqyrTGF1+sx0Nwj/ELKSNVxDoKVYiU09pTqSB3pi46i+E8N49y4/8aRhu4/7O2dSTH7OS3YoZpt2Soas+cYJYhQdZtYQAgPX5LOkTfQvPhGR8AzrrTvOUrHyTWaSBEELVZ088LrFT6ibXHcPhwXX7A5+YMS8LLr3KRstySWzJEmfVOJxuMhQJSH1Xiq4bLilVn9V4AK5pCOnlALSYf48SexsCqzBUKgISuncurIBbXtW9EkNTMX3jSKlSQ7WniGRlmzrBAJCh4VXJUZgXDf8hAaPckIRbLosbTnEAauWcfnIXLfvI+bYkURhfYKsWelM+MS6ihk+P2yr8rNT9w5iUVJGVypOXUp45PrFuPn6ayCpNRJzqPwCCPE7fFagzLs7wibIXlrhCnRALT5HHyExFFcQoGvIq/8o+Oia8mrTimb55IDLwkiYrG6I5DPXFPKsTC0hium9T3I8dC+M7n9GbwnLTUK2kWnoklD3HTab21xJTtbF98nQ94df7doqPFxL/jongeZCGMB+PJ+BdQTtHr7tCY0kN2GXpoHxz/2w8YEWTKHhWIUsD+Utf8pDkKQfCqlm7iR7byxL51gHL9Z3Q== lass@helios";
+      mail = "lass@helios.retiolum";
+    };
   };
 }
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 38e773b53..2811c0c52 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -3,10 +3,9 @@
 with lib;
 
 {
-  hosts = addNames {
+  hosts = {
     pnp = {
       cores = 1;
-      dc = "makefu"; #vm on 'omo'
       nets = {
         retiolum = {
           addrs4 = ["10.243.0.210"];
@@ -30,7 +29,6 @@ with lib;
     };
     tsp = {
       cores = 1;
-      dc = "makefu"; #x200
       nets = {
         retiolum = {
           addrs4 = ["10.243.0.212"];
@@ -58,7 +56,6 @@ with lib;
     };
     pornocauster = {
       cores = 2;
-      dc = "makefu"; #x220
       nets = {
         retiolum = {
           addrs4 = ["10.243.0.91"];
@@ -90,7 +87,6 @@ with lib;
 
     vbob = {
       cores = 2;
-      dc = "makefu"; #vm local
       nets = {
         retiolum = {
           addrs4 = ["10.243.1.91"];
@@ -116,7 +112,6 @@ with lib;
     };
     flap = rec {
       cores = 1;
-      dc = "cac"; #vps
 
       extraZones = {
         "krebsco.de" = ''
@@ -152,7 +147,6 @@ with lib;
     };
     pigstarter = rec {
       cores = 1;
-      dc = "frontrange"; #vps
 
       extraZones = {
         "krebsco.de" = ''
@@ -191,7 +185,6 @@ with lib;
     };
     wry = rec {
       cores = 1;
-      dc = "makefu"; #dc = "cac";
       extraZones = {
         "krebsco.de" = ''
           euer           IN A  ${head nets.internet.addrs4}
@@ -248,7 +241,6 @@ with lib;
     };
     filepimp = rec {
       cores = 1;
-      dc = "makefu"; #nas
 
       nets = {
         retiolum = {
@@ -273,7 +265,6 @@ with lib;
 
     omo = rec {
       cores = 2;
-      dc = "makefu"; #AMD E350
 
       nets = {
         retiolum = {
@@ -299,7 +290,6 @@ with lib;
     };
     wbob = rec {
       cores = 1;
-      dc = "none";
       nets = {
         retiolm = {
           addrs4 = ["10.243.214.15/32"];
@@ -323,7 +313,6 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
 
     gum = rec {
       cores = 1;
-      dc = "online.net"; #root-server
 
       extraZones = {
         "krebsco.de" = ''
@@ -364,7 +353,7 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcxWFEPzke/Sdd9qNX6rSJgXal8NmINYajpFCxXfYdj root@gum";
     };
   };
-  users = addNames rec {
+  users = rec {
     makefu = {
       mail = "makefu@pornocauster.retiolum";
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl3RTOHd5DLiVeUbUr/GSiKoRWknXQnbkIf+uNiFO+XxiqZVojPlumQUVhasY8UzDzj9tSDruUKXpjut50FhIO5UFAgsBeMJyoZbgY/+R+QKU00Q19+IiUtxeFol/9dCO+F4o937MC0OpAC10LbOXN/9SYIXueYk3pJxIycXwUqhYmyEqtDdVh9Rx32LBVqlBoXRHpNGPLiswV2qNe0b5p919IGcslzf1XoUzfE3a3yjk/XbWh/59xnl4V7Oe7+iQheFxOT6rFA30WYwEygs5As//ZYtxvnn0gA02gOnXJsNjOW9irlxOUeP7IOU6Ye3WRKFRR0+7PS+w8IJLag2xb makefu@pornocauster";
diff --git a/krebs/3modules/miefda/default.nix b/krebs/3modules/miefda/default.nix
new file mode 100644
index 000000000..0cfa8bd27
--- /dev/null
+++ b/krebs/3modules/miefda/default.nix
@@ -0,0 +1,39 @@
+{ lib, ... }:
+
+with lib;
+
+{
+  hosts = {
+    bobby = {
+      cores = 4;
+      nets = {
+        retiolum = {
+          addrs4 = ["10.243.111.112"];
+          addrs6 = ["42:0:0:0:0:0:111:112"];
+          aliases = [
+            "bobby.retiolum"
+            "cgit.bobby.retiolum"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEA+AScnIqFdzGl+iRZTNZ7r91n/r1H4GzDsrAupUvJ4mi7nDN4eP8s
+            uLvKtJp22RxfuF3Kf4KhHb8LHQ8bLLN/KDaNDXrCNBc69d7vvLsjoY+wfGLJNu4Y
+            Ad/8J4r3rdb83mTA3IHb47T/70MERPBr2gF84YiG6ZoQrPQuTk4lHxaI83SOhjny
+            0F0ucS/rBV6Vv9y5/756TKi1cFPSpY4X+qeWc8xWrBGJcJiiqYb8ZX2o/lkAJ5c+
+            jI/VdybGFVGY9+bp4Jw5xBIo5KGuFnm8+blRmSDDl3joRneKQSx9FAu7RUwoajBu
+            cEbi1529NReQzIFT6Vt22ymbHftxOiuh4QIDAQAB
+            -----END RSA PUBLIC KEY-----
+          '';
+        };
+      };
+      #ssh.privkey.path = <secrets/ssh.ed25519>;
+      #ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro";
+    };
+  };
+  users = {
+    miefda = {
+      mail = "miefda@miefda.de";
+      pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCVdNCks6mrItKHYIwgW3s+NINFhHqZtLPj3l6TJUWd93ZSuuI6P+Z/0m0G9Z4tWWaXWsOCnzMA2WOKcitBbLcaQxVypJfvmfoA5CVlh4/nf8NfvbMFkVIYPehxR7YoejfKOxPOCNC3248RiD8kqa4/5IF8qdqE+mRQUIZJXvN0jZZ+rGnYo5Z544O9JqsV+VjjOgK0Fchpxf/lC8dnBucIce7gUwi5npwsGQZgSDmRobBRFVDZag1abLFNZN2faI8uqzSlU6KRRapYV266Of7j3kmDokMan4szjP1EexmTWm+arwRiz9p0M5oKs6zofez0mOyF5ux02NB3XIhbJc8CfMjeA7PmSg4ZhghjlSjIOR+1mMIDiDVi6PNLw5atzvpyfYtpf5sWpdIpXCS0lyzIgasqW4gbAiWoFPv5A0mw0QI6UqlxQ8Pdm6R7P6yQxyknrxnvFGMQPiqgl21ssSNA9A+YRd4j0nATntzOeD1bxTZkyU4FtW++0hg3Ph6HiHLfPd9w70wPr7b0RITVnBcN2ZqIO+5NIqQYU801FCNXsTuBh0ueTsVTGJYySUGkmkHyH5spLYdr1Z5w+4W+HgbxPk40pyZJ18S0umL49igxR9NsniucFy1/jqqi0TiDIsHx6vsawFT1F2rq9ZtGaRcJL6Yfz0p+uZC5rc/nI+mMlQ== miefda@nixos";
+    };
+  };
+}
diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix
index 6da2abc85..8803cb249 100644
--- a/krebs/3modules/mv/default.nix
+++ b/krebs/3modules/mv/default.nix
@@ -3,10 +3,9 @@
 with lib;
 
 {
-  hosts = addNames {
+  hosts = {
     stro = {
       cores = 4;
-      dc = "mv";
       nets = {
         retiolum = {
           addrs4 = ["10.243.111.111"];
@@ -31,8 +30,8 @@ with lib;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro";
     };
   };
-  users = addNames {
-    mv_stro = {
+  users = {
+    mv-stro = {
       mail = "mv@stro.retiolum";
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxM34g1GUm5EtU00DAOlGSx8MsCWunhGTrozurj460QT7EdUbZvj0AcrQC0lP9kaZyhX+KueTjmLC+ICsnlHYeg4zoSEnSAUkccuyZxfgynVc4wrpfNAc1nHjDhDb/ulnC+8wNxvxUpI0XlBgu/Y7AbbChZj3ofv6uGGHJKfG3uSyCkt9VTCi1KwydHpe9P252N8NbopnbnkT0EMkRHruh7ICEKr4/ivmUL/IUrbFicEeCy4SeRAl8+00x4WqqvbBPzgdXn0AIjKLvus3dBoQubJNpUoXnyXJbElnit5a7QcgZJNLMbV0kf9zzCGduxkADzHkAFB9D4PuSMYt62iy12QlGbm80A9ncuwaSyJf7hPTvNbU8VyCblyfRz/SCaudUrfk5Xbxxu26FHi4hZqr3IUQt4T8pD8JWYGl4n2ZKnD8hHz/jrmNBK8h9d+VFafU9t1hRxlFsW1AhMEM+kfWClyhfTcKBKbml2a657lgUEVmlZt+18kwwsivM1QhHNTgxn5urRXRkh1VQ40UQroVuV1OUmvAngyAthF441VPGc5z7kEI+D4qjmUjSy6k4dvEy/RGfsAgJCf63zilRuUbL68f2OpxE8aeZZUXPvgdLml284pry7+C5sjlnCDoJfCj/yhdVx6mU9pWUd/Q97CLQewbsYhMzsqlBlIkXuipkDQ== mv@stro";
     };
diff --git a/krebs/3modules/nixpkgs.nix b/krebs/3modules/nixpkgs.nix
new file mode 100644
index 000000000..4129f9483
--- /dev/null
+++ b/krebs/3modules/nixpkgs.nix
@@ -0,0 +1,43 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  cfg = config.krebs.nixpkgs;
+
+  out = {
+    options.krebs.nixpkgs = api;
+    config = mkIf cfg.enable imp;
+  };
+
+  api = {
+    enable = mkEnableOption "krebs.nixpkgs" // { default = true; };
+
+    allowUnfreePredicate = mkOption {
+      description = ''
+        This option is similar to `nixpkgs.config.allowUnfreePredicate'
+        but can be defined in several modules.  An unfree package will be
+        allowed if any of the defined predicates returns true.
+      '';
+      type = types.nullOr (mkOptionType {
+        name = "Predicate";
+        check = isFunction;
+        merge = _locs: defs: pkg: let
+          evalPredicateDef = def: let
+            allow = def.value pkg;
+          in if cfg.verbose && allow
+            then trace "unfree ‘${pkg.name}’ allowed in ${def.file}" allow
+            else allow;
+        in any evalPredicateDef defs;
+      });
+      default = null;
+    };
+
+    verbose = mkOption {
+      type = types.bool;
+      default = false;
+    };
+  };
+
+  imp = mkIf (cfg.allowUnfreePredicate != null) {
+    nixpkgs.config.allowUnfreePredicate = cfg.allowUnfreePredicate;
+  };
+in out
diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix
index e0e2692a8..2bf8aa5db 100644
--- a/