Merge remote-tracking branch 'lass/master'

4 files changed, 225 insertions, 2 deletions

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 9c2f53cbe..567c077eb 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -48,6 +48,7 @@ let
       ./rtorrent.nix
       ./secret.nix
       ./setuid.nix
+      ./syncthing.nix
       ./tinc.nix
       ./tinc_graphs.nix
       ./urlwatch.nix
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 630c14f18..a3b8cab39 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -106,6 +106,7 @@ in {
       };
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAsANFdMi825qWQXQbWLYuNZ6/fARt3lnh1KStQHQQMD";
+      syncthing.id = "QITFKYQ-VEPIPL2-AZIXHMD-BBT62ML-YHSB35A-BSUIBXS-QYMPFHW-M7XN2QU";
     };
     archprism = {
       cores = 1;
@@ -204,6 +205,7 @@ in {
       secure = true;
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAMPlIG+6u75GJ3kvsPF6OoIZsU+u8ZQ+rdviv5fNMD";
+      syncthing.id = "ZPRS57K-YK32ROQ-7A6MRAV-VOYXQ3I-CQCXISZ-C5PCV2A-GSFLG3I-K7UGGAH";
     };
     shodan = {
       cores = 2;
@@ -270,6 +272,7 @@ in {
       secure = true;
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOPgQIMYiyD4/Co+nlOQWEzCKssemOEXAY/lbIZZaMhj";
+      syncthing.id = "7V75LMM-MIFCAIZ-TAWR3AI-OXONVZR-TEW4GBK-URKPPN4-PQFG653-LGHPDQ4";
     };
     daedalus = {
       cores = 2;
@@ -324,10 +327,18 @@ in {
             -----END RSA PUBLIC KEY-----
           '';
         };
+        wiregrill = {
+          ip6.addr = w6 "5ce7";
+          aliases = [
+            "skynet.w"
+          ];
+          wireguard.pubkey = "pt9a6nP+YPqxnSskcM9NqRmAmFzbO5bE7wzViFFonnU=";
+        };
       };
       secure = true;
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEB/MmASvx3i09DY1xFVM5jOhZRZA8rMRqtf8bCIkC+t";
+      syncthing.id = "KWGPAHH-H53Y2WL-SDAUVQE-7PMYRVP-6Q2INYB-FL535EO-HIE7425-ZCNP7A3";
     };
     littleT = {
       cores = 2;
@@ -365,10 +376,18 @@ in {
             -----END RSA PUBLIC KEY-----
           '';
         };
+        wiregrill = {
+          ip6.addr = w6 "771e";
+          aliases = [
+            "littleT.w"
+          ];
+          wireguard.pubkey = "VfSTPO1XGqLqujAGCov1yA0WxyRXJndZCW5XYkScNXg=";
+        };
       };
       secure = true;
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJzb9BPFClubs6wSOi/ivqPFVPlowXwAxBS0jHaB29hX";
+      syncthing.id = "PCDXICO-GMGWKSB-V6CYF3I-LQMZSGV-B7YBJXA-DVO7KXN-TFCSQXW-XY6WNQD";
     };
     red = {
       monitoring = false;
@@ -474,7 +493,48 @@ in {
       };
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSBxtPf8yJfzzI7/iYpoRSc/TT+zYmE/HM9XWS3MZlv";
+      syncthing.id = "J2LMIPD-PBEPVKL-A3MN6NQ-KL6DZ4N-K4GGWZB-E2EPLFN-PDLVAOC-DCSZHAD";
     };
+
+    green = {
+      cores = 1;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.0.66";
+          ip6.addr = r6 "12ee";
+          aliases = [
+            "green.r"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN PUBLIC KEY-----
+            MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwpgFxMxWQ0Cp3I82bLWk
+            uoDBjWqhM9Pgq6PJSpJjyNAgMkKJcQnWi0WpELaHISAVqjdPGUQSLiar++JN3YBx
+            ZQGFiucG0ijVJKAUbQQDYbc+RGK8MGO2v3Bv/6E56UKjxtT1zjjvkyXpSC7FN477
+            n9IfsvIzH/RLcAP5VnHBYqZ467UR4rqi7T7yWjrEgr+VirY9Opp9LM9YozlbRrlI
+            hYshk5RET/EvOSwYlw/KJEMMmYHro74neZKIVKoXD3CSE66rncNmdFwD3ZXVxYn6
+            m3Eob8ojWPW+CpAL2AurUyq4Igem9JVigZiyKGgaYsdkOWgkYLW2M0DXX+vCRcM6
+            BvJgJn7s0PHkLvybEVveTolRWO+I/IG1LN8m0SvrVPXf5JYHB32nKYwVMLwi+BQ1
+            pwo0USGByVRv2lWZfy3doKxow0ppilq4DwoT+iqVO4sK5YhPipBHSmCcaxlquHjy
+            2k1eb0gYisp0LBjHlhTErXtt4RlrUqs/84RfgtIZYUowJfXbtEbyDmLIlESbY7qk
+            UlXIMXtY0sWpDivWwpdMj9kJdKlS09QTMeLYz4fFGXMksFmLijx8RKDOYfNWL7oA
+            udmEOHPzYzu/Ex8RfKJjD4GhWLDvDTcyXDG9vmuDNZGcPHANeg23sGhr5Hz37FRT
+            3MVh92sFyMVYkJcL7SISk80CAwEAAQ==
+            -----END PUBLIC KEY-----
+          '';
+        };
+        wiregrill = {
+          ip6.addr = w6 "12ee";
+          aliases = [
+            "green.w"
+          ];
+          wireguard.pubkey = "lOORkStNJ6iP5ffqjHa/kWOxilJIMW4E6BEtNvNhLGk=";
+        };
+      };
+      ssh.privkey.path = <secrets/ssh.id_ed25519>;
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0wqzo7rMkyw6gqTGuUp8aUA0vtwj0HuuaTIkkOnA30 ";
+      syncthing.id = "CADHN7J-CWRCWTZ-3GZRLII-JBVZN4N-RGHDGDL-UTAJNYI-RZPHK55-7EYAWQM";
+    };
+
     phone = {
       nets = {
         wiregrill = {
@@ -482,11 +542,12 @@ in {
           aliases = [
             "phone.w"
           ];
-          wireguard.pubkey = "zVunBVOxsMETlnHkgjfH71HaZjjNUOeYNveAVv5z3jw=";
+          wireguard.pubkey = "MRicxap2VxPnzmXoOqqjQNGWJ54cQC8Tfy28+IXXsxM=";
         };
       };
       external = true;
       ci = false;
+      syncthing.id = "DUFMX7V-HNR6WXM-LZB5LJE-TM6QIOH-MTGHEUJ-QSD3XIY-YRFJLOR-G6Y3XQB";
     };
     morpheus = {
       cores = 1;
diff --git a/krebs/3modules/lass/ssh/android.rsa b/krebs/3modules/lass/ssh/android.rsa
index 3d35b76e4..675ba8df2 100644
--- a/krebs/3modules/lass/ssh/android.rsa
+++ b/krebs/3modules/lass/ssh/android.rsa
@@ -1 +1 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOPH4c2zQCaCmus4T9GvaY1lrgVR9CKV3Fx1vRn1K1XB u0_a194@android
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPF7RHU4q6w1f3xWcfeAD6u23jDs2fd/H3IuxdT5G1ZL
diff --git a/krebs/3modules/syncthing.nix b/krebs/3modules/syncthing.nix
new file mode 100644
index 000000000..bfbac1db9
--- /dev/null
+++ b/krebs/3modules/syncthing.nix
@@ -0,0 +1,161 @@
+{ config, pkgs, ... }: with import <stockholm/lib>;
+
+let
+
+  cfg = config.krebs.syncthing;
+
+  devices = mapAttrsToList (name: peer: {
+    name = name;
+    deviceID = peer.id;
+    addresses = peer.addresses;
+  }) cfg.peers;
+
+  folders = map (folder: {
+    inherit (folder) path id type;
+    devices = map (peer: { deviceId = cfg.peers.${peer}.id; }) folder.peers;
+    rescanIntervalS = folder.rescanInterval;
+    fsWatcherEnabled = folder.watch;
+    fsWatcherDelayS = folder.watchDelay;
+    ignorePerms = folder.ignorePerms;
+  }) cfg.folders;
+
+  getApiKey = pkgs.writeDash "getAPIKey" ''
+    ${pkgs.libxml2}/bin/xmllint \
+      --xpath 'string(configuration/gui/apikey)'\
+      ${config.services.syncthing.dataDir}/config.xml
+  '';
+
+  updateConfig = pkgs.writeDash "merge-syncthing-config" ''
+    set -efu
+    # wait for service to restart
+    ${pkgs.untilport}/bin/untilport localhost 8384
+    API_KEY=$(${getApiKey})
+    CFG=$(${pkgs.curl}/bin/curl -Ss -H "X-API-Key: $API_KEY" localhost:8384/rest/system/config)
+    echo "$CFG" | ${pkgs.jq}/bin/jq -s '.[] * {
+      "devices": ${builtins.toJSON devices},
+      "folders": ${builtins.toJSON folders}
+    }' | ${pkgs.curl}/bin/curl -Ss -H "X-API-Key: $API_KEY" localhost:8384/rest/system/config -d @-
+    ${pkgs.curl}/bin/curl -Ss -H "X-API-Key: $API_KEY" localhost:8384/rest/system/restart -X POST
+  '';
+
+in
+
+{
+  options.krebs.syncthing = {
+
+    enable = mkEnableOption "syncthing-init";
+
+    id = mkOption {
+      type = types.str;
+      default = config.krebs.build.host.name;
+    };
+
+    cert = mkOption {
+      type = types.nullOr types.absolute-pathname;
+      default = null;
+    };
+
+    key = mkOption {
+      type = types.nullOr types.absolute-pathname;
+      default = null;
+    };
+
+    peers = mkOption {
+      default = {};
+      type = types.attrsOf (types.submodule ({
+        options = {
+
+          # TODO make into addr + port submodule
+          addresses = mkOption {
+            type = types.listOf types.str;
+            default = [];
+          };
+
+          #TODO check
+          id = mkOption {
+            type = types.str;
+          };
+
+        };
+      }));
+    };
+
+    folders = mkOption {
+      default = [];
+      type = types.listOf (types.submodule ({ config, ... }: {
+        options = {
+
+          path = mkOption {
+            type = types.absolute-pathname;
+          };
+
+          id = mkOption {
+            type = types.str;
+            default = config.path;
+          };
+
+          peers = mkOption {
+            type = types.listOf types.str;
+            default = [];
+          };
+
+          rescanInterval = mkOption {
+            type = types.int;
+            default = 3600;
+          };
+
+          type = mkOption {
+            type = types.enum [ "sendreceive" "sendonly" "receiveonly" ];
+            default = "sendreceive";
+          };
+
+          watch = mkOption {
+            type = types.bool;
+            default = true;
+          };
+
+          watchDelay = mkOption {
+            type = types.int;
+            default = 10;
+          };
+
+          ignorePerms = mkOption {
+            type = types.bool;
+            default = true;
+          };
+
+        };
+      }));
+    };
+  };
+
+  config = (mkIf cfg.enable) {
+
+    systemd.services.syncthing = mkIf (cfg.cert != null || cfg.key != null) {
+      preStart = ''
+        ${optionalString (cfg.cert != null) ''
+          cp ${toString cfg.cert} ${config.services.syncthing.dataDir}/cert.pem
+          chown ${config.services.syncthing.user}:${config.services.syncthing.group} ${config.services.syncthing.dataDir}/cert.pem
+          chmod 400 ${config.services.syncthing.dataDir}/cert.pem
+        ''}
+        ${optionalString (cfg.key != null) ''
+          cp ${toString cfg.key} ${config.services.syncthing.dataDir}/key.pem
+          chown ${config.services.syncthing.user}:${config.services.syncthing.group} ${config.services.syncthing.dataDir}/key.pem
+          chmod 400 ${config.services.syncthing.dataDir}/key.pem
+        ''}
+      '';
+    };
+
+    systemd.services.syncthing-init = {
+      after = [ "syncthing.service" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        User = config.services.syncthing.user;
+        RemainAfterExit = true;
+        Type = "oneshot";
+        ExecStart = updateConfig;
+      };
+    };
+  };
+}