Merge 'cd/master' - update krebs.build.source

21 files changed, 491 insertions, 281 deletions

diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index 01bb16a2b..a1f335905 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -28,9 +28,17 @@ let
             type = types.krebs.file-location;
           };
           startAt = mkOption {
-            type = types.str;
+            default = "hourly";
+            type = types.str; # TODO systemd.time(7)'s calendar event
           };
           snapshots = mkOption {
+            default = {
+              hourly   = { format = "%Y-%m-%dT%H"; retain =  4; };
+              daily    = { format = "%Y-%m-%d";    retain =  7; };
+              weekly   = { format = "%YW%W";       retain =  4; };
+              monthly  = { format = "%Y-%m";       retain = 12; };
+              yearly   = { format = "%Y";                       };
+            };
             type = types.attrsOf (types.submodule {
               options = {
                 format = mkOption {
@@ -284,3 +292,15 @@ let
   };
 
 in out
+# TODO ionice
+# TODO mail on failed push, pull
+# TODO mail on missing push
+# TODO don't cancel plans on activation
+#   also, don't hang while deploying at:
+#   starting the following units: backup.wu-home-xu.push.service, backup.wu-home-xu.push.timer
+# TODO make sure /bku is properly mounted
+# TODO make sure that secure hosts cannot backup to insecure ones
+# TODO optionally only backup when src and dst are near enough :)
+# TODO try using btrfs for snapshots (configurable)
+# TODO warn if partial snapshots are found
+# TODO warn if unknown stuff is found in dst path
diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 7f004cd81..00142acdd 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -28,48 +28,159 @@ let
       type = types.user;
     };
 
-    options.krebs.build.source.dir = mkOption {
-      type = let
-        default-host = config.krebs.current.host;
-      in types.attrsOf (types.submodule ({ config, ... }: {
+    options.krebs.build.source = let
+      raw = types.either types.str types.path;
+      url = types.submodule {
         options = {
-          host = mkOption {
-            type = types.host;
-            default = default-host;
-          };
-          path = mkOption {
-            type = types.str;
-          };
-          target-path = mkOption {
-            type = types.str;
-            default = "/root/${config._module.args.name}";
-          };
           url = mkOption {
             type = types.str;
-            default = "file://${config.host.name}${config.path}";
-          };
-        };
-      }));
-      default = {};
-    };
-
-    options.krebs.build.source.git = mkOption {
-      type = with types; attrsOf (submodule ({ config, ... }: {
-        options = {
-          url = mkOption {
-            type = types.str; # TODO must be shell safe
           };
           rev = mkOption {
             type = types.str;
           };
-          target-path = mkOption {
+          dev = mkOption {
             type = types.str;
-            default = "/root/${config._module.args.name}";
           };
         };
-      }));
+      };
+    in mkOption {
+      type = types.attrsOf (types.either types.str url);
+      apply = let f = mapAttrs (_: value: {
+        string = value;
+        path = toString value;
+        set = f value;
+      }.${typeOf value}); in f;
       default = {};
     };
+
+    options.krebs.build.populate = mkOption {
+      type = types.str;
+      default = let
+        source = config.krebs.build.source;
+        target-user = maybeEnv "target_user" "root";
+        target-host = maybeEnv "target_host" config.krebs.build.host.name;
+        target-path = maybeEnv "target_path" "/var/src";
+        out = ''
+          #! /bin/sh
+          set -eu
+
+          verbose() {
+            printf '+%s\n' "$(printf ' %q' "$@")" >&2
+            "$@"
+          }
+
+          echo ${shell.escape git-script} \
+            | ssh ${shell.escape "${target-user}@${target-host}"} -T
+
+          unset tmpdir
+          trap '
+            rm "$tmpdir"/*
+            rmdir "$tmpdir"
+            trap - EXIT INT QUIT
+          '        EXIT INT QUIT
+          tmpdir=$(mktemp -dt stockholm.XXXXXXXX)
+          chmod 0755 "$tmpdir"
+
+          ${concatStringsSep "\n"
+            (mapAttrsToList
+              (name: spec: let dst = removePrefix "symlink:" (get-url spec); in
+                "verbose ln -s ${shell.escape dst} $tmpdir/${shell.escape name}")
+              symlink-specs)}
+
+          verbose proot \
+              -b $tmpdir:${shell.escape target-path} \
+              ${concatStringsSep " \\\n    "
+                (mapAttrsToList
+                  (name: spec:
+                    "-b ${shell.escape "${get-url spec}:${target-path}/${name}"}")
+                  file-specs)} \
+              rsync \
+                  -f ${shell.escape "P /*"} \
+                  ${concatMapStringsSep " \\\n        "
+                    (name: "-f ${shell.escape "R /${name}"}")
+                    (attrNames file-specs)} \
+                  --delete \
+                  -vFrlptD \
+                  ${shell.escape target-path}/ \
+                  ${shell.escape "${target-user}@${target-host}:${target-path}"}
+        '';
+
+        get-schema = uri:
+          if substring 0 1 uri == "/"
+            then "file"
+            else head (splitString ":" uri);
+
+        has-schema = schema: uri: get-schema uri == schema;
+
+        get-url = spec: {
+          string = spec;
+          path = toString spec;
+          set = get-url spec.url;
+        }.${typeOf spec};
+
+        git-specs =
+          filterAttrs (_: spec: has-schema "https" (get-url spec)) source //
+          filterAttrs (_: spec: has-schema "http" (get-url spec)) source //
+          filterAttrs (_: spec: has-schema "git" (get-url spec)) source;
+
+        file-specs =
+          filterAttrs (_: spec: has-schema "file" (get-url spec)) source;
+
+        symlink-specs =
+          filterAttrs (_: spec: has-schema "symlink" (get-url spec)) source;
+
+        git-script = ''
+          #! /bin/sh
+          set -efu
+
+          verbose() {
+            printf '+%s\n' "$(printf ' %q' "$@")" >&2
+            "$@"
+          }
+
+          fetch_git() {(
+            dst_dir=$1
+            src_url=$2
+            src_ref=$3
+
+            if ! test -e "$dst_dir"; then
+              git clone "$src_url" "$dst_dir"
+            fi
+
+            cd "$dst_dir"
+
+            if ! url=$(git config remote.origin.url); then
+              git remote add origin "$src_url"
+            elif test "$url" != "$src_url"; then
+              git remote set-url origin "$src_url"
+            fi
+
+            # TODO resolve src_ref to commit hash
+            hash=$src_ref
+
+            if ! test "$(git log --format=%H -1)" = "$hash"; then
+              git fetch origin
+              git checkout "$hash" -- "$dst_dir"
+              git checkout "$hash"
+            fi
+
+            git clean -dxf
+          )}
+
+          ${concatStringsSep "\n"
+            (mapAttrsToList
+              (name: spec: toString (map shell.escape [
+                "verbose"
+                "fetch_git"
+                "${target-path}/${name}"
+                spec.url
+                spec.rev
+              ]))
+              git-specs)}
+        '';
+      in out;
+    };
+
   };
 
 in out
diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix
index e6267d7e6..7b28ffca8 100644
--- a/krebs/3modules/git.nix
+++ b/krebs/3modules/git.nix
@@ -27,7 +27,7 @@ let
       description = ''
           Enable cgit.
           Cgit is an attempt to create a fast web interface for the git version
-          control system, using a built in cache to decrease pressure on the 
+          control system, using a built in cache to decrease pressure on the
           git server.
           cgit in this module is being served via fastcgi nginx.This module
           deploys a http://cgit.<hostname> nginx configuration and enables nginx
@@ -44,48 +44,8 @@ let
       default = "/etc/git";
     };
     repos = mkOption {
-      type = types.attrsOf (types.submodule ({
-        options = {
-          desc = mkOption {
-            type = types.nullOr types.str;
-            default = null;
-            description = ''
-              Repository description.
-            '';
-          };
-          section = mkOption {
-            type = types.nullOr types.str;
-            default = null;
-            description = ''
-              Repository section.
-            '';
-          };
-          name = mkOption {
-            type = types.str;
-            description = ''
-              Repository name.
-            '';
-          };
-          hooks = mkOption {
-            type = types.attrsOf types.str;
-            default = {};
-            description = ''
-              Repository-specific hooks.
-            '';
-          };
-          public = mkOption {
-            type = types.bool;
-            default = false;
-            description = ''
-              Allow everybody to read the repository via HTTP if cgit enabled.
-            '';
-            # TODO allow every configured user to fetch the repository via SSH.
-          };
-        };
-      }));
-
+      type = types.attrsOf subtypes.repo;
       default = {};
-
       example = literalExample ''
         {
           testing = {
@@ -99,7 +59,6 @@ let
           testing2 = { name = "testing2"; };
         }
       '';
-
       description = ''
         Repositories.
       '';
@@ -121,30 +80,158 @@ let
       '';
     };
     rules = mkOption {
-      type = types.unspecified;
+      type = types.listOf subtypes.rule;
+      default = [];
+      example = literalExample ''
+        singleton {
+          user = [ config.krebs.users.tv ];
+          repo = [ testing ]; # see literal example of repos
+          perm = push "refs/*" (with lib.git; [
+            non-fast-forward create delete merge
+          ]);
+        }
+      '';
+      description = ''
+        Rules.
+      '';
     };
   };
 
+  # TODO put into krebs/4lib/types.nix?
+  subtypes = {
+    repo = types.submodule ({
+      options = {
+        collaborators = mkOption {
+          type = types.listOf types.user;
+          default = [];
+          description = ''
+            List of users that should be able to fetch from this repo.
+
+            This option is currently not used by krebs.git but instead can be
+            used to create rules.  See e.g. <stockholm/tv/2configs/git.nix> for
+            an example.
+          '';
+        };
+        desc = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            Repository description.
+          '';
+        };
+        section = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            Repository section.
+          '';
+        };
+        name = mkOption {
+          type = types.str;
+          description = ''
+            Repository name.
+          '';
+        };
+        hooks = mkOption {
+          type = types.attrsOf types.str;
+          default = {};
+          description = ''
+            Repository-specific hooks.
+          '';
+        };
+        public = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Allow everybody to read the repository via HTTP if cgit enabled.
+          '';
+          # TODO allow every configured user to fetch the repository via SSH.
+        };
+      };
+    });
+    rule = types.submodule ({ config, ... }: {
+      options = {
+        user = mkOption {
+          type = types.listOf types.user;
+          description = ''
+            List of users this rule should apply to.
+            Checked by authorize-command.
+          '';
+        };
+        repo = mkOption {
+          type = types.listOf subtypes.repo;
+          description = ''
+            List of repos this rule should apply to.
+            Checked by authorize-command.
+          '';
+        };
+        perm = mkOption {
+          type = types.submodule {
+            # TODO generate enum argument from krebs/4lib/git.nix
+            options = {
+              allow-commands = mkOption {
+                type = types.listOf (types.enum (with git; [
+                  git-receive-pack
+                  git-upload-pack
+                ]));
+                default = [];
+                description = ''
+                  List of commands the rule's users are allowed to execute.
+                  Checked by authorize-command.
+                '';
+              };
+              allow-receive-ref = mkOption {
+                type = types.nullOr types.str;
+                default = null;
+                description = ''
+                  Ref that can receive objects.
+                  Checked by authorize-push.
+                '';
+              };
+              allow-receive-modes = mkOption {
+                type = types.listOf (types.enum (with git; [
+                  fast-forward
+                  non-fast-forward
+                  create
+                  delete
+                  merge
+                ]));
+                default = [];
+                description = ''
+                  List of allowed receive modes.
+                  Checked by pre-receive hook.
+                '';
+              };
+            };
+          };
+          description = ''
+            Permissions granted.
+          '';
+        };
+      };
+    });
+  };
+
   git-imp = {
     system.activationScripts.git-init = "${init-script}";
-    
+
     # TODO maybe put all scripts here and then use PATH?
     environment.etc."${etc-base}".source =
       scriptFarm "git-ssh-authorizers" {
-        authorize-command = makeAuthorizeScript (map ({ repo, user, perm }: [
-          (map getName (ensureList user))
-          (map getName (ensureList repo))
-          (map getName perm.allow-commands)
+        authorize-command = makeAuthorizeScript (map (rule: [
+          (map getName (ensureList rule.user))
+          (map getName (ensureList rule.repo))
+          (map getName rule.perm.allow-commands)
         ]) cfg.rules);
-    
-        authorize-push = makeAuthorizeScript (map ({ repo, user, perm }: [
-          (map getName (ensureList user))
-          (map getName (ensureList repo))
-          (ensureList perm.allow-receive-ref)
-          (map getName perm.allow-receive-modes)
-        ]) (filter (x: hasAttr "allow-receive-ref" x.perm) cfg.rules));
+
+        authorize-push = makeAuthorizeScript (map (rule: [
+          (map getName (ensureList rule.user))
+          (map getName (ensureList rule.repo))
+          (ensureList rule.perm.allow-receive-ref)
+          (map getName rule.perm.allow-receive-modes)
+        ]) (filter (rule: rule.perm.allow-receive-ref != null) cfg.rules));
       };
-    
+
     users.extraUsers = singleton rec {
       description = "Git repository hosting user";
       name = "git";
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index 6fd1c4224..31c1a375a 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -247,6 +247,7 @@ with lib;
         };
       };
       secure = true;
+      ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcJvu8JDVzObLUtlAQg9qVugthKSfitwCljuJ5liyHa";
     };
     xu = {
diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix
index 31cbfcf6e..7a9fb55fd 100644
--- a/krebs/3modules/urlwatch.nix
+++ b/krebs/3modules/urlwatch.nix
@@ -54,6 +54,10 @@ let
       example = [
         https://nixos.org/channels/nixos-unstable/git-revision
       ];
+      apply = map (x: getAttr (typeOf x) {
+        set = x;
+        string.url = x;
+      });
     };
     verbose = mkOption {
       type = types.bool;
@@ -64,7 +68,40 @@ let
     };
   };
 
-  urlsFile = toFile "urls" (concatStringsSep "\n" cfg.urls);
+  urlsFile = toFile "urls" (concatMapStringsSep "\n---\n" toJSON cfg.urls);
+
+  configFile = toFile "urlwatch.yaml" (toJSON {
+    display = {
+      error = true;
+      new = true;
+      unchanged = false;
+    };
+    report = {
+      email = {
+        enabled = false;
+        from = "";
+        html = false;
+        smtp = {
+          host = "localhost";
+          keyring = true;
+          port = 25;
+          starttls = true;
+        };
+        subject = "{count} changes: {jobs}";
+        to = "";
+      };
+      html.diff = "unified";
+      stdout = {
+        color = true;
+        enabled = true;
+      };
+      text = {
+        details = true;
+        footer = true;
+        line_length = 75;
+      };
+    };
+  });
 
   imp = {
     systemd.timers.urlwatch = {
@@ -109,10 +146,15 @@ let
           from=${escapeShellArg cfg.from}
           mailto=${escapeShellArg cfg.mailto}
           urlsFile=${escapeShellArg urlsFile}
+          configFile=${escapeShellArg configFile}
 
           cd /tmp
 
-          urlwatch -e ${optionalString cfg.verbose "-v"} --urls="$urlsFile" > changes || :
+          urlwatch \
+              ${optionalString cfg.verbose "-v"} \
+              --urls="$urlsFile" \
+              --config="$configFile" \
+            > changes || :
 
           if test -s changes; then
             date=$(date -R)
diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix
index dfc51bbe4..4d7e0b549 100644
--- a/krebs/4lib/default.nix
+++ b/krebs/4lib/default.nix
@@ -6,6 +6,7 @@ with lib;
 let out = rec {
 
   eq = x: y: x == y;
+  ne = x: y: x != y;
 
   mod = x: y: x - y * (x / y);
 
diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 81ce659bd..c596d0f9d 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -164,10 +164,6 @@ types // rec {
       pubkey = mkOption {
         type = str;
       };
-      pubkeys = mkOption {
-        type = attrsOf str;
-        default = {};
-      };
     };
   };
 
diff --git a/krebs/5pkgs/Reaktor/plugins.nix b/krebs/5pkgs/Reaktor/plugins.nix
index 7490be4ca..0f61688e3 100644
--- a/krebs/5pkgs/Reaktor/plugins.nix
+++ b/krebs/5pkgs/Reaktor/plugins.nix
@@ -82,7 +82,7 @@ rec {
   };
   stockholm-issue = buildSimpleReaktorPlugin "stockholm-issue" {
     script = ./scripts/random-issue.sh;
-    path = with pkgs; [ git gnused lentil ];
+    path = with pkgs; [ git gnused haskellPackages.lentil ];
     env = { "origin" = "http://cgit.gum/stockholm"; };
   };
 
diff --git a/krebs/5pkgs/cac-api/default.nix b/krebs/5pkgs/cac-api/default.nix
new file mode 100644
index 000000000..9ab6ac8b2
--- /dev/null
+++ b/krebs/5pkgs/cac-api/default.nix
@@ -0,0 +1,42 @@
+{ stdenv, fetchgit, bc, cac-cert, coreutils, curl, dash, gnused, inotifyTools, jq, ncurses, openssh, sshpass, ... }:
+
+stdenv.mkDerivation {
+  name = "cac-api-1.1.0";
+
+  src = fetchgit {
+    url = http://cgit.cd.krebsco.de/cac-api;
+    rev = "0809fae379239687ed1170e04311dc2880ef0aba";
+    sha256 = "357ced27c9ed88028967c934178a1d230bf38617a7494cd4632fabdd2a04fcdd";
+  };
+
+  phases = [
+    "unpackPhase"
+    "installPhase"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    { cat <<\EOF
+    #! ${dash}/bin/dash
+    export PATH=${stdenv.lib.makeSearchPath "bin" [
+      bc
+      coreutils
+      curl
+      gnused
+      inotifyTools
+      jq
+      ncurses
+      openssh
+      sshpass
+    ]}
+    EOF
+      # [1]: Disable fetching tasks; listtasks is currently broken:
+      # Unknown column 'iod.apitask.cid' in 'field list'
+      sed '
+        /^\s*tasks \\$/d; # [1]
+        s|\<_cac_exec curl|<${cac-cert} & --cacert /dev/stdin|
+      ' cac-api
+    } > $out/bin/cac-api
+    chmod +x $out/bin/cac-api
+  '';
+}
diff --git a/krebs/5pkgs/test/infest-cac-centos7/panel.cloudatcost.com.crt b/krebs/5pkgs/cac-cert/cac.pem
index 9d02b6bcf..9d02b6bcf 100644
--- a/krebs/5pkgs/test/infest-cac-centos7/panel.cloudatcost.com.crt
+++ b/krebs/5pkgs/cac-cert/cac.pem
diff --git a/krebs/5pkgs/cac-cert/default.nix b/krebs/5pkgs/cac-cert/default.nix
new file mode 100644
index 000000000..d99019dca
--- /dev/null
+++ b/krebs/5pkgs/cac-cert/default.nix
@@ -0,0 +1,2 @@
+{ writeText, ... }:
+writeText "cac.pem" (builtins.readFile ./cac.pem)
diff --git a/krebs/5pkgs/cac/default.nix b/krebs/5pkgs/cac/default.nix
deleted file mode 100644
index 4d39ce2fb..000000000
--- a/krebs/5pkgs/cac/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ stdenv, fetchgit, bc, coreutils, curl, gnused, inotifyTools, jq, ncurses, sshpass, ... }:
-
-stdenv.mkDerivation {
-  name = "cac-1.0.3";
-
-  src = fetchgit {
-    url = http://cgit.cd.retiolum/cac;
-    rev = "22acc1b990ac7d97c16344fbcbc2621e24cdf915";
-    sha256 = "135b740617c983b3f46a1983d4744be17340d5146a0a0de0dff4bb7a53688f2f";
-  };
-
-  phases = [
-    "unpackPhase"
-    "installPhase"
-  ];
-
-  installPhase =
-    let
-      path = stdenv.lib.makeSearchPath "bin" [
-        bc
-        coreutils
-        curl
-        gnused
-        inotifyTools
-        jq
-        ncurses
-        sshpass
-      ];
-    in
-    ''
-      mkdir -p $out/bin
-
-      sed < ./cac > $out/bin/cac '
-        s;^_cac_main .*;PATH=${path}''${PATH+:$PATH} &;
-      '
-
-      chmod +x $out/bin/cac
-    '';
-}
diff --git a/krebs/5pkgs/get/default.nix b/krebs/5pkgs/get/default.nix
index 9a0192aab..13cdeca96 100644
--- a/krebs/5pkgs/get/default.nix
+++ b/krebs/5pkgs/get/default.nix
@@ -1,12 +1,12 @@
 { coreutils, gnugrep, gnused, fetchgit, jq, nix, stdenv, ... }:
 
 stdenv.mkDerivation {
-  name = "get-1.3.1";
+  name = "get-1.4.0";
 
   src = fetchgit {
     url = http://cgit.cd.krebsco.de/get;
-    rev = "64c97edd3f9952cd5e703208c46748a035a515bf";
-    sha256 = "32ca83f4fd86fd3285bef9dcfd0917308086d239189858daceca175de49ff97c";
+    rev = "08757d47c480c130d69270855c6c0371f6b7d385";
+    sha256 = "7c609e2cde7a071bbf62241a7bea60313fdbf076b9f7b3d97226417e13e5ba9d";
   };
 
   phases = [
diff --git a/krebs/5pkgs/lentil/default.nix b/krebs/5pkgs/lentil/default.nix
deleted file mode 100644
index 8a57a77fe..000000000
--- a/krebs/5pkgs/lentil/default.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ pkgs, ... }:
-
-(pkgs.haskellPackages.override {
-  overrides = self: super: {
-    lentil = super.lentil.override {
-      mkDerivation = (attrs: self.mkDerivation (attrs // {
-        version = "0.1.3.0";
-        sha256 = "0xa59avh0bvfg69xh9p5b8dppfhx29mvfq8v41sk9j7qbcnzjivg";
-        patches = [
-          ./syntaxes.patch
-        ];
-      }));
-    };
-  };
-}).lentil
diff --git a/krebs/5pkgs/lentil/syntaxes.patch b/krebs/5pkgs/lentil/syntaxes.patch
deleted file mode 100644
index a9390ae51..000000000
--- a/krebs/5pkgs/lentil/syntaxes.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff -rN -u old-lentil/src/Lentil/Parse/Syntaxes.hs new-lentil/src/Lentil/Parse/Syntaxes.hs
---- old-lentil/src/Lentil/Parse/Syntaxes.hs	2015-07-20 23:15:38.600539779 +0200
-+++ new-lentil/src/Lentil/Parse/Syntaxes.hs	2015-07-20 23:15:38.600539779 +0200
-@@ -30,6 +30,7 @@
-               | ext `elem` [".pas", ".pp", ".inc"] = Just pascal
-               | ext `elem` [".py"]                 = Just python
-               | ext `elem` [".rb"]                 = Just ruby
-+              | ext `elem` [".nix"]                = Just perl -- Nix
-               | ext `elem` [".pl", ".pm", ".t"]    = Just perl
-               | ext `elem` [".sh"]                 = Just perl -- shell
-               | ext `elem` [".txt"]                = Just text
diff --git a/krebs/5pkgs/much/default.nix b/krebs/5pkgs/much/default.nix
index 2a9376139..efe84fbf0 100644
--- a/krebs/5pkgs/much/default.nix
+++ b/krebs/5pkgs/much/default.nix
@@ -1,6 +1,6 @@
 { pkgs, ... }:
 
-pkgs.haskellngPackages.callPackage (
+pkgs.haskellPackages.callPackage (
 { mkDerivation, aeson, attoparsec, base, base64-bytestring
 , blaze-builder, blessings, bytestring, case-insensitive, containers, deepseq
 , directory, docopt, email-header, fetchgit, filepath
diff --git a/krebs/5pkgs/test/infest-cac-centos7/default.nix b/krebs/5pkgs/test/infest-cac-centos7/default.nix
index 7adb09ca9..3be4b1c41 100644
--- a/krebs/5pkgs/test/infest-cac-centos7/default.nix
+++ b/krebs/5pkgs/test/infest-cac-centos7/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, coreutils,makeWrapper, cac-api, cac-panel, gnumake, gnused, jq, openssh, ... }:
+{ stdenv, coreutils,makeWrapper, cac-api, cac-cert, cac-panel, gnumake, gnused, jq, openssh, ... }:
 
 stdenv.mkDerivation rec {
   name = "${shortname}-${version}";
@@ -10,6 +10,7 @@ stdenv.mkDerivation rec {
   phases = [
     "installPhase"
   ];
+
   buildInputs = [ makeWrapper ];
 
   path = stdenv.lib.makeSearchPath "bin" [
@@ -22,16 +23,15 @@ stdenv.mkDerivation rec {
     openssh
   ];
 
-  installPhase =
-    ''
-      mkdir -p $out/bin
-      cp ${src} $out/bin/${shortname}
-      chmod +x $out/bin/${shortname}
-      wrapProgram $out/bin/${shortname} \
-              --prefix PATH : ${path} \
-              --set SSL_CERT_FILE ${./panel.cloudatcost.com.crt} \
-              --set REQUESTS_CA_BUNDLE ${./panel.cloudatcost.com.crt}
-    '';
+  installPhase = ''
+    mkdir -p $out/bin
+    cp ${src} $out/bin/${shortname}
+    chmod +x $out/bin/${shortname}
+    wrapProgram $out/bin/${shortname} \
+        --prefix PATH : ${path} \
+        --set REQUESTS_CA_BUNDLE ${cac-cert} \
+        --set SSL_CERT_FILE ${cac-cert}
+  '';
   meta = with stdenv.lib; {
     homepage = http://krebsco.de;
     description = "Krebs CI Scripts";
diff --git a/krebs/5pkgs/test/infest-cac-centos7/notes b/krebs/5pkgs/test/infest-cac-centos7/notes
index 793ef3560..b3beb392f 100755
--- a/krebs/5pkgs/test/infest-cac-centos7/notes
+++ b/krebs/5pkgs/test/infest-cac-centos7/notes
@@ -1,5 +1,3 @@
-#! /bin/sh
-
 # nix-shell -p gnumake jq openssh cac-api cac-panel
 set -eufx
 
@@ -54,7 +52,7 @@ cac-api servers
 old_trapstr=$(clear_defer)
 while true;do
   # Template 26: CentOS7
-  # TODO: use cac templates to determine the real Centos7 template in case it changes
+  # TODO: use cac-api templates to determine the real Centos7 template in case it changes
   out=$(cac-api build cpu=1 ram=512 storage=10 os=26 2>&1)
   if name=$(echo "$out" | jq -r .servername);then
     id=servername:$name
@@ -67,15 +65,15 @@ while true;do
   fi
 
   clear_defer >/dev/null
-  defer "cac delete $id"
+  defer "cac-api delete $id"
 
   # TODO: timeout?
 
   wait_login_cac(){
     # we wait for 30 minutes
     for t in `seq 180`;do
-      # now we have a working cac server
-      if cac ssh $1 -o ConnectTimeout=10 \
+      # now we have a working cac-api server
+      if cac-api ssh $1 -o ConnectTimeout=10 \
                     cat /etc/redhat-release | \
                       grep CentOS ;then
         return 0
@@ -134,7 +132,7 @@ cac-api powerop $id reset
 wait_login(){
   # timeout
   for t in `seq 90`;do
-    # now we have a working cac server
+    # now we have a working cac-api server
     if ssh -o StrictHostKeyChecking=no \
            -o UserKnownHostsFile=/dev/null \
            -i $krebs_ssh \
diff --git a/krebs/5pkgs/urlwatch/default.nix b/krebs/5pkgs/urlwatch/default.nix
new file mode 100644
index 000000000..d9b595314
--- /dev/null
+++ b/