Merge branch 'master' of prism:stockholm

6 files changed, 42 insertions, 25 deletions

diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix
index d32262810..9582413ed 100644
--- a/lass/2configs/downloading.nix
+++ b/lass/2configs/downloading.nix
@@ -17,6 +17,7 @@ with import <stockholm/lib>;
         lass-shodan.pubkey
         lass-icarus.pubkey
         makefu.pubkey
+        wine-mors.pubkey
       ];
     };
 
diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index 4137c482e..a66d08927 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -49,6 +49,7 @@ let
     {
       brain = {
         collaborators = with config.krebs.users; [ tv makefu ];
+        announce = true;
       };
     } //
     import <secrets/repos.nix> { inherit config lib pkgs; }
@@ -75,9 +76,20 @@ let
     public = true;
   };
 
-  make-restricted-repo = name: { collaborators ? [], ... }: {
+  make-restricted-repo = name: { collaborators ? [], announce ? false, ... }: {
     inherit collaborators name;
     public = false;
+    hooks = optionalAttrs announce {
+      post-receive = pkgs.git-hooks.irc-announce {
+        # TODO make nick = config.krebs.build.host.name the default
+        nick = config.krebs.build.host.name;
+        channel = "#retiolum";
+        server = "ni.r";
+        verbose = true;
+        # TODO define branches in some kind of option per repo
+        branches = [ "master" "staging*" ];
+      };
+    };
   };
 
   make-rules =
diff --git a/lass/2configs/makefu-sip.nix b/lass/2configs/makefu-sip.nix
deleted file mode 100644
index 9d2e9b696..000000000
--- a/lass/2configs/makefu-sip.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-{
-  users.users.makefu = {
-    uid = genid "makefu";
-    isNormalUser = true;
-    extraGroups = [ "libvirtd" ];
-    openssh.authorizedKeys.keys = [
-      config.krebs.users.makefu.pubkey
-    ];
-  };
-
-  krebs.iptables.tables.nat.PREROUTING.rules = [
-    { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 10022"; target = "DNAT --to-destination 192.168.122.136:22"; }
-  ];
-
-  krebs.iptables.tables.filter.FORWARD.rules = [
-    { v6 = false; precedence = 1000; predicate = "-d 192.168.122.136 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
-  ];
-}
diff --git a/lass/2configs/otp-ssh.nix b/lass/2configs/otp-ssh.nix
new file mode 100644
index 000000000..f9984e245
--- /dev/null
+++ b/lass/2configs/otp-ssh.nix
@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+# Enables second factor for ssh password login
+
+## Usage:
+#  gen-oath-safe <username> totp
+## scan the qrcode with google authenticator (or FreeOTP)
+## copy last line into secrets/<host>/users.oath (chmod 700)
+{
+  security.pam.oath = {
+    # enabling it will make it a requisite of `all` services
+    # enable = true;
+    digits = 6;
+    # TODO assert existing
+    usersFile = (toString <secrets>) + "/users.oath";
+  };
+  # I want TFA only active for sshd with password-auth
+  security.pam.services.sshd.oathAuth = true;
+}
diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix
index 3bc5570c4..3e1ad6638 100644
--- a/lass/2configs/websites/domsen.nix
+++ b/lass/2configs/websites/domsen.nix
@@ -25,9 +25,15 @@ in {
   imports = [
     ./sqlBackup.nix
     (servePage [ "reich-gebaeudereinigung.de" "www.reich-gebaeudereinigung.de" ])
-    (servePage [ "karlaskop.de" ])
+    (servePage [
+      "karlaskop.de"
+      "www.karlaskop.de"
+    ])
     (servePage [ "makeup.apanowicz.de" ])
-    (servePage [ "pixelpocket.de" ])
+    (servePage [
+      "pixelpocket.de"
+      "www.pixelpocket.de"
+    ])
     (servePage [
       "habsys.de"
       "habsys.eu"
diff --git a/lass/2configs/wine.nix b/lass/2configs/wine.nix
index d4a91e645..2444d32d3 100644
--- a/lass/2configs/wine.nix
+++ b/lass/2configs/wine.nix
@@ -5,7 +5,8 @@ let
 
 in {
   krebs.per-user.wine.packages = with pkgs; [
-    wineUnstable
+    wineFull
+    #(wineFull.override { wineBuild = "wine64"; })
   ];
   users.users= {
     wine = {