Merge remote-tracking branch 'lass/master'

13 files changed, 150 insertions, 43 deletions

diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix
index 60ec625f2..bb84b1873 100644
--- a/krebs/1systems/hotdog/config.nix
+++ b/krebs/1systems/hotdog/config.nix
@@ -14,6 +14,7 @@
     <stockholm/krebs/2configs/ircd.nix>
     <stockholm/krebs/2configs/nscd-fix.nix>
     <stockholm/krebs/2configs/reaktor2.nix>
+    <stockholm/krebs/2configs/wiki.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.hotdog;
diff --git a/krebs/2configs/buildbot-stockholm.nix b/krebs/2configs/buildbot-stockholm.nix
index 43dd96919..43a38a9f8 100644
--- a/krebs/2configs/buildbot-stockholm.nix
+++ b/krebs/2configs/buildbot-stockholm.nix
@@ -5,7 +5,7 @@
   services.nginx = {
     enable = true;
     virtualHosts.build = {
-      serverAliases = [ "build.${config.networking.hostName}.r" ];
+      serverAliases = [ "build.r" "build.${config.networking.hostName}.r" ];
       locations."/".extraConfig = ''
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
diff --git a/krebs/2configs/reaktor2.nix b/krebs/2configs/reaktor2.nix
index f4fa2ca7c..72eff176b 100644
--- a/krebs/2configs/reaktor2.nix
+++ b/krebs/2configs/reaktor2.nix
@@ -14,7 +14,7 @@ let
       confirmation=no
     '';
   in {
-    pattern = "^${name}-([a-z]+)(?::\\s*(.*))?";
+    pattern = "^${name}-([a-z]+)(?::?\\s*(.*))?";
     activate = "match";
     command = 1;
     arguments = [2];
@@ -76,7 +76,7 @@ let
           };
         }
         {
-          pattern = ''^(\S+)\s+([+-][1-9][0-9]*)\s+(\S+)$'';
+          pattern = ''^([\w-]*):?\s+([+-][1-9][0-9]*)\s+(\S+)$'';
           activate = "match";
           arguments = [1 2 3];
           command = {
diff --git a/krebs/2configs/wiki.nix b/krebs/2configs/wiki.nix
new file mode 100644
index 000000000..2350e711e
--- /dev/null
+++ b/krebs/2configs/wiki.nix
@@ -0,0 +1,19 @@
+{ config, ... }:
+
+{
+  services.gollum = {
+    enable = true;
+  };
+  networking.firewall.allowedTCPPorts = [ 80 ];
+  services.nginx = {
+    enable = true;
+    virtualHosts.wiki = {
+      serverAliases = [ "wiki.r" "wiki.${config.networking.hostName}.r" ];
+      locations."/".extraConfig = ''
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_pass http://127.0.0.1:${toString config.services.gollum.port};
+      '';
+    };
+  };
+}
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index e988fb563..c5969caac 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -26,6 +26,7 @@ let
           private_key = mkOption {
             type = types.secret-file;
             default = {
+              name = "exim.dkim_private_key/${config.domain}";
               path = "/run/krebs.secret/${config.domain}.dkim_private_key";
               owner.name = "exim";
               source-path = toString <secrets> + "/${config.domain}.dkim.priv";
@@ -115,8 +116,12 @@ let
     }));
     systemd.services = mkIf (cfg.dkim != []) {
       exim = {
-        after = [ "secret.service" ];
-        requires = [ "secret.service" ];
+        after = flip map cfg.dkim (dkim:
+          config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
+        );
+        partOf = flip map cfg.dkim (dkim:
+          config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
+        );
       };
     };
     krebs.exim = {
diff --git a/krebs/3modules/external/mic92.nix b/krebs/3modules/external/mic92.nix
index 23ab4f684..b8aaf9900 100644
--- a/krebs/3modules/external/mic92.nix
+++ b/krebs/3modules/external/mic92.nix
@@ -13,6 +13,11 @@ in {
     amy = {
       owner = config.krebs.users.Mic92;
       nets = rec {
+        internet = {
+          ip4.addr = "129.215.165.57";
+          ip6.addr = "2001:630:3c1:164:b62e:99ff:fe3e:d369";
+          aliases = [ "amy.i" ];
+        };
         retiolum = {
           addrs = [
             config.krebs.hosts.amy.nets.retiolum.ip4.addr
@@ -41,6 +46,11 @@ in {
     clara = {
       owner = config.krebs.users.Mic92;
       nets = rec {
+        internet = {
+          ip4.addr = "129.215.165.58";
+          ip6.addr = "2001:630:3c1:164:b62e:99ff:fe3d:70f2";
+          aliases = [ "clara.i" ];
+        };
         retiolum = {
           addrs = [
             config.krebs.hosts.clara.nets.retiolum.ip4.addr
@@ -92,6 +102,7 @@ in {
       nets = rec {
         internet = {
           ip4.addr = "129.215.165.54";
+          ip6.addr = "2001:630:3c1:164:30a2:6e7b:c58b:cafd";
           aliases = [ "donna.i" ];
         };
         retiolum = {
@@ -272,6 +283,7 @@ in {
       nets = rec {
         internet = {
           ip4.addr = "129.215.165.53";
+          ip6.addr = "2001:630:3c1:164:6d4:c4ff:fe04:4aba";
           aliases = [ "martha.i" ];
         };
         retiolum = {
@@ -355,6 +367,7 @@ in {
       nets = rec {
         internet = {
           ip4.addr = "129.215.165.52";
+          ip6.addr = "2001:630:3c1:164:6d4:c4ff:fe04:4e4b";
           aliases = [ "rose.i" ];
         };
         retiolum = {
@@ -411,5 +424,47 @@ in {
         };
       };
     };
+    harsha = {
+      owner = config.krebs.users.Mic92;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.29.184";
+          aliases = [
+            "harsha.r"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEAqIc+ozq3hKHMe/X3v4j+6or8LMjEV7MtQ8/+n00xpG4NkI4G38Bv
+            3nmAcV7OhN6of0fr0psbBmym+2VxCZbpl8E3g1GWSKpAvlmP/9v4wDVdrADaTvXC
+            pzCxejtCwEhKLisnMwCMJCuUPbIsSBU+IQDPKP7NP0yY5VapgW3Xl3qXpnehCW1r
+            NBZjZASnhSXcJRLJayEDN6uBviYrnnfbrHOx4fPcjQPTHX5RYr3EbgGZQO9xki44
+            9dKT4EA95lupTqC3wzuQbaNpvIuVzmggiDY/NsBIVh0/2XjGnO54wtCEPudaLnWd
+            WNtc1wfVFB6gzgG1N7msOuFUReOIfyF/ywIDAQAB
+            -----END RSA PUBLIC KEY-----
+          '';
+        };
+      };
+    };
+    eva = {
+      owner = config.krebs.users.Mic92;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.29.185";
+          aliases = [
+            "eva.r"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEAqIc+ozq3hKHMe/X3v4j+6or8LMjEV7MtQ8/+n00xpG4NkI4G38Bv
+            3nmAcV7OhN6of0fr0psbBmym+2VxCZbpl8E3g1GWSKpAvlmP/9v4wDVdrADaTvXC
+            pzCxejtCwEhKLisnMwCMJCuUPbIsSBU+IQDPKP7NP0yY5VapgW3Xl3qXpnehCW1r
+            NBZjZASnhSXcJRLJayEDN6uBviYrnnfbrHOx4fPcjQPTHX5RYr3EbgGZQO9xki44
+            9dKT4EA95lupTqC3wzuQbaNpvIuVzmggiDY/NsBIVh0/2XjGnO54wtCEPudaLnWd
+            WNtc1wfVFB6gzgG1N7msOuFUReOIfyF/ywIDAQAB
+            -----END RSA PUBLIC KEY-----
+          '';
+        };
+      };
+    };
   };
 }
diff --git a/krebs/3modules/konsens.nix b/krebs/3modules/konsens.nix
index 74895a971..81486810b 100644
--- a/krebs/3modules/konsens.nix
+++ b/krebs/3modules/konsens.nix
@@ -56,7 +56,7 @@ let
 
     systemd.services = mapAttrs' (name: repo:
       nameValuePair "konsens-${name}" {
-        after = [ "network.target" "secret.service" ];
+        after = [ "network.target" ];
         path = [ pkgs.git ];
         restartIfChanged = false;
         serviceConfig = {
diff --git a/krebs/3modules/krebs/default.nix b/krebs/3modules/krebs/default.nix
index de09b4251..5e3ddcb2d 100644
--- a/krebs/3modules/krebs/default.nix
+++ b/krebs/3modules/krebs/default.nix
@@ -74,6 +74,8 @@ in {
             "build.hotdog.r"
             "cgit.hotdog.r"
             "irc.r"
+            "wiki.r"
+            "wiki.hotdog.r"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----
diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix
index 45d9d81c3..91111f3eb 100644
--- a/krebs/3modules/repo-sync.nix
+++ b/krebs/3modules/repo-sync.nix
@@ -124,6 +124,7 @@ let
     privateKeyFile = mkOption {
       type = types.secret-file;
       default = {
+        name = "repo-sync-key";
         path = "${cfg.stateDir}/ssh.priv";
         owner = cfg.user;
         source-path = toString <secrets> + "/repo-sync.ssh.key";
@@ -166,7 +167,13 @@ let
           });
       in nameValuePair "repo-sync-${name}" {
         description = "repo-sync";
-        after = [ "network.target" "secret.service" ];
+        after = [
+          config.krebs.secret.files.repo-sync-key.service
+          "network.target"
+        ];
+        partOf = [
+          config.krebs.secret.files.repo-sync-key.service
+        ];
 
         environment = {
           GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i ${cfg.stateDir}/ssh.priv";
diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix
index 672c503b0..bf2c62cc9 100644
--- a/krebs/3modules/secret.nix
+++ b/krebs/3modules/secret.nix
@@ -1,4 +1,5 @@
-{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }: let
   cfg = config.krebs.secret;
 in {
   options.krebs.secret = {
@@ -8,32 +9,43 @@ in {
     };
   };
   config = lib.mkIf (cfg.files != {}) {
-    systemd.services.secret = let
-      # TODO fail if two files have the same path but differ otherwise
-      files = unique (map (flip removeAttrs ["_module"])
-                          (attrValues cfg.files));
-    in {
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = "yes";
-        SyslogIdentifier = "secret";
-        ExecStart = pkgs.writeDash "install-secret-files" ''
-          exit_code=0
-          ${concatMapStringsSep "\n" (file: ''
-            ${pkgs.coreutils}/bin/install \
-                  -D \
-                  --compare \
-                  --verbose \
-                  --mode=${shell.escape file.mode} \
-                  --owner=${shell.escape file.owner.name} \
-                  --group=${shell.escape file.group-name} \
-                  ${shell.escape file.source-path} \
-                  ${shell.escape file.path} \
-                || exit_code=1
-          '') files}
-          exit $exit_code
-        '';
-      };
-    };
+    systemd.paths =
+      mapAttrs'
+        (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+          wantedBy = ["multi-user.target"];
+          pathConfig.PathChanged = file.source-path;
+        })
+        cfg.files;
+    systemd.services =
+      mapAttrs'
+        (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+          wantedBy = ["multi-user.target"];
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}";
+          };
+        })
+        cfg.files
+      //
+      mapAttrs'
+        (name: file: nameValuePair "secret-${systemd.encodeName name}" {
+          wantedBy = ["multi-user.target"];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = "yes";
+            ExecStart = toString [
+              "${pkgs.coreutils}/bin/install"
+              "-D"
+              "--compare"
+              "--verbose"
+              "--mode=${file.mode}"
+              "--owner=${file.owner.name}"
+              "--group=${file.group-name}"
+              file.source-path
+              file.path
+            ];
+          };
+        })
+        cfg.files;
   };
 }
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 8b6e959d4..1fca7de5c 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -158,6 +158,7 @@ let
         privkey = mkOption {
           type = types.secret-file;
           default = {
+            name = "${tinc.config.netname}.rsa_key.priv";
             path = "${tinc.config.user.home}/tinc.rsa_key.priv";
             owner = tinc.config.user;
             source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
@@ -219,9 +220,14 @@ let
         iproute = cfg.iproutePackage;
       in {
         description = "Tinc daemon for ${netname}";
-        after = [ "network.target" ];
+        after = [
+          config.krebs.secret.files."${netname}.rsa_key.priv".service
+          "network.target"
+        ];
+        partOf = [
+          config.krebs.secret.files."${netname}.rsa_key.priv".service
+        ];
         wantedBy = [ "multi-user.target" ];
-        requires = [ "secret.service" ];
         path = [ tinc iproute ];
         serviceConfig = rec {
           Restart = "always";
diff --git a/krebs/nixpkgs-unstable.json b/krebs/nixpkgs-unstable.json
index c64d43862..1973a012a 100644
--- a/krebs/nixpkgs-unstable.json
+++ b/krebs/nixpkgs-unstable.json
@@ -1,7 +1,7 @@
 {
   "url": "https://github.com/NixOS/nixpkgs-channels",
-  "rev": "0f5ce2fac0c726036ca69a5524c59a49e2973dd4",
-  "date": "2020-05-19T01:31:20+02:00",
-  "sha256": "0nkk492aa7pr0d30vv1aw192wc16wpa1j02925pldc09s9m9i0r3",
+  "rev": "8e2b14aceb1d40c7e8b84c03a7c78955359872bb",
+  "date": "2020-08-05T09:17:35+01:00",
+  "sha256": "0zzjpd9smr7rxzrdf6raw9kbj42fbvafxb5bz36lcxgv290pgsm8",
   "fetchSubmodules": false
 }
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index cee3c5ec8..04684a220 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
 {
   "url": "https://github.com/NixOS/nixpkgs-channels",
-  "rev": "e2bb73ce5f786b83e984b80199112f86b8a6cc9d",
-  "date": "2020-06-07T23:11:12+02:00",
-  "sha256": "0mpcdwhippvgsj3kj8vw35dgz94dnzgxgsfqqzcfpmvnzjc23vk7",
+  "rev": "e23e05452c67ce406debffa831290fb3abaabf0e",
+  "date": "2020-08-06T15:33:30+02:00",
+  "sha256": "10wlcm20bvak8cxjhfvmn0vm4n9da3zl19026h66zc1wfmcqgrkp",
   "fetchSubmodules": false
 }