Merge branch 'master' of prism.r:stockholm

2 files changed, 109 insertions, 81 deletions

diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index bf7de6fc5..0ca39447d 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -57,13 +57,6 @@ with import <stockholm/lib>;
           config.krebs.users.makefu.pubkey
         ];
       };
-      users.users.nin = {
-        uid = genid "nin";
-        isNormalUser = true;
-        openssh.authorizedKeys.keys = [
-          config.krebs.users.nin.pubkey
-        ];
-      };
       users.extraUsers.dritter = {
         uid = genid "dritter";
         isNormalUser = true;
@@ -119,7 +112,6 @@ with import <stockholm/lib>;
           services.openssh.enable = true;
           users.users.root.openssh.authorizedKeys.keys = [
             config.krebs.users.lass.pubkey
-            config.krebs.users.nin.pubkey
           ];
         };
         autoStart = true;
@@ -215,7 +207,6 @@ with import <stockholm/lib>;
         RandomizedDelaySec = "2min";
       };
     }
-    <stockholm/lass/2configs/downloading.nix>
     <stockholm/lass/2configs/minecraft.nix>
     {
       services.taskserver = {
@@ -346,11 +337,64 @@ with import <stockholm/lib>;
       ];
 
     }
+    {
+      systemd.services."container@yellow".reloadIfChanged = mkForce false;
+      containers.yellow = {
+        config = { ... }: {
+          environment.systemPackages = [ pkgs.git ];
+          services.openssh.enable = true;
+          users.users.root.openssh.authorizedKeys.keys = [
+            config.krebs.users.lass.pubkey
+          ];
+        };
+        autoStart = false;
+        enableTun = true;
+        privateNetwork = true;
+        hostAddress = "10.233.2.13";
+        localAddress = "10.233.2.14";
+      };
+
+      services.nginx.virtualHosts."lassul.us".locations."^~ /transmission".extraConfig = ''
+        if ($scheme != "https") {
+          rewrite ^ https://$host$uri permanent;
+        }
+        auth_basic "Restricted Content";
+        auth_basic_user_file ${pkgs.writeText "transmission-user-pass" ''
+          krebs:$apr1$1Fwt/4T0$YwcUn3OBmtmsGiEPlYWyq0
+        ''};
+        proxy_pass http://10.233.2.14:9091;
+      '';
+
+      users.groups.download = {};
+      users.users = {
+        download = {
+          createHome = true;
+          group = "download";
+          name = "download";
+          home = "/var/download";
+          useDefaultShell = true;
+          openssh.authorizedKeys.keys = with config.krebs.users; [
+            lass.pubkey
+            lass-shodan.pubkey
+            lass-icarus.pubkey
+            lass-daedalus.pubkey
+            lass-helios.pubkey
+            makefu.pubkey
+            wine-mors.pubkey
+          ];
+        };
+      };
+
+      system.activationScripts.downloadFolder = ''
+        mkdir -p /var/download
+        chmod 775 /var/download
+        ln -fnsT /var/lib/containers/yellow/var/download/finished /var/download/finished || :
+        chown download: /var/download/finished
+      '';
+    }
   ];
 
   krebs.build.host = config.krebs.hosts.prism;
-  # workaround because grub store paths are broken
-  boot.copyKernels = true;
   services.earlyoom = {
     enable = true;
     freeMemThreshold = 5;
diff --git a/lass/1systems/prism/physical.nix b/lass/1systems/prism/physical.nix
index 56348d0ab..116bdb92f 100644
--- a/lass/1systems/prism/physical.nix
+++ b/lass/1systems/prism/physical.nix
@@ -1,77 +1,61 @@
 { config, lib, pkgs, ... }:
+
 {
+
   imports = [
     ./config.nix
-    {
-      boot.kernelParams = [ "net.ifnames=0" ];
-      networking = {
-        defaultGateway = "46.4.114.225";
-        # Use google's public DNS server
-        nameservers = [ "8.8.8.8" ];
-        interfaces.eth0 = {
-          ipAddress = "46.4.114.247";
-          prefixLength = 27;
-        };
-      };
-      # TODO use this network config
-      #networking.interfaces.et0.ipv4.addresses = [
-      #  {
-      #    address = config.krebs.build.host.nets.internet.ip4.addr;
-      #    prefixLength = 27;
-      #  }
-      #  {
-      #    address = "46.4.114.243";
-      #    prefixLength = 27;
-      #  }
-      #];
-      #networking.defaultGateway = "46.4.114.225";
-      #networking.nameservers = [
-      #  "8.8.8.8"
-      #];
-      #services.udev.extraRules = ''
-      #  SUBSYSTEM=="net", ATTR{address}=="08:60:6e:e7:87:04", NAME="et0"
-      #'';
-    }
-    {
-      imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
-
-      networking.hostId = "fb4173ea";
-      boot.loader.grub = {
-        devices = [
-          "/dev/sda"
-          "/dev/sdb"
-        ];
-        splashImage = null;
-      };
-
-      boot.initrd.availableKernelModules = [
-        "ata_piix"
-        "vmw_pvscsi"
-        "ahci" "sd_mod"
-      ];
-
-      boot.kernelModules = [ "kvm-intel" ];
-
-      sound.enable = false;
-      nixpkgs.config.allowUnfree = true;
-      time.timeZone = "Europe/Berlin";
-
-      fileSystems."/" = {
-        device = "rpool/root/nixos";
-        fsType = "zfs";
-      };
-
-      fileSystems."/home" = {
-        device = "rpool/home";
-        fsType = "zfs";
-      };
-
-      fileSystems."/boot" = {
-        device = "/dev/disk/by-uuid/b67c3370-1597-4ce8-8a46-e257ca32150d";
-        fsType = "ext4";
-      };
-
-    }
+    <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
   ];
 
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "sd_mod" ];
+  boot.kernelModules = [ "kvm-intel" ];
+
+  fileSystems."/" = {
+    device = "rpool/root/nixos";
+    fsType = "zfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/d155d6ff-8e89-4876-a9e7-d1b7ba6a4804";
+    fsType = "ext4";
+  };
+
+  fileSystems."/srv/http" = {
+    device = "tank/srv-http";
+    fsType = "zfs";
+  };
+
+  fileSystems."/var/download" = {
+    device = "tank/download";
+    fsType = "zfs";
+  };
+
+  fileSystems."/var/lib/containers" = {
+    device = "tank/containers";
+    fsType = "zfs";
+  };
+
+  fileSystems."/home" = {
+    device = "tank/home";
+    fsType = "zfs";
+  };
+
+  nix.maxJobs = lib.mkDefault 8;
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.devices = [ "/dev/sda" "/dev/sdb" ];
+
+  boot.kernelParams = [ "net.ifnames=0" ];
+  networking = {
+    hostId = "2283aaae";
+    defaultGateway = "95.216.1.129";
+    # Use google's public DNS server
+    nameservers = [ "8.8.8.8" ];
+    interfaces.eth0 = {
+      ipAddress = "95.216.1.150";
+      prefixLength = 26;
+    };
+  };
 }