Merge remote-tracking branch 'cd/master'

23 files changed, 437 insertions, 244 deletions

diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix
index 26ad316ce..8ce1d5748 100644
--- a/lass/1systems/helios.nix
+++ b/lass/1systems/helios.nix
@@ -102,6 +102,11 @@ with config.krebs.lib;
       device = "/dev/pool/bku";
       fsType = "ext4";
     };
+    "/tmp" = {
+      device = "tmpfs";
+      fsType = "tmpfs";
+      options = ["nosuid" "nodev" "noatime"];
+    };
   };
 
   #services.udev.extraRules = ''
diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index 1aa4d9b23..1028ca652 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -23,7 +23,7 @@ with config.krebs.lib;
     ../2configs/teamviewer.nix
     ../2configs/libvirt.nix
     ../2configs/fetchWallpaper.nix
-    ../2configs/c-base.nix
+    #../2configs/c-base.nix
     ../2configs/mail.nix
     ../2configs/krebs-pass.nix
     ../2configs/repo-sync.nix
@@ -54,8 +54,8 @@ with config.krebs.lib;
         enable = true;
         package = pkgs.postgresql;
       };
-      virtualisation.docker.enable = true;
-      users.users.mainUser.extraGroups = [ "docker" ];
+      #virtualisation.docker.enable = true;
+      #users.users.mainUser.extraGroups = [ "docker" ];
     }
     {
       lass.umts = {
@@ -140,6 +140,11 @@ with config.krebs.lib;
       device = "/dev/big/conf";
       fsType = "ext4";
     };
+    "/tmp" = {
+      device = "tmpfs";
+      fsType = "tmpfs";
+      options = ["nosuid" "nodev" "noatime"];
+    };
   };
 
   services.udev.extraRules = ''
@@ -192,8 +197,12 @@ with config.krebs.lib;
     urban
     mk_sql_pair
     remmina
+    thunderbird
 
     logf
+    iodine
+
+    macchanger
   ];
 
   #TODO: fix this shit
diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix
index c7c765302..51d106b5e 100644
--- a/lass/1systems/prism.nix
+++ b/lass/1systems/prism.nix
@@ -23,6 +23,7 @@ in {
     ../2configs/buildbot-standalone.nix
     ../2configs/repo-sync.nix
     ../2configs/binary-cache/server.nix
+    ../2configs/iodined.nix
     {
       imports = [
         ../2configs/git.nix
@@ -119,6 +120,12 @@ in {
         device = "/dev/pool/bku";
       };
 
+      fileSystems."/tmp" = {
+        device = "tmpfs";
+        fsType = "tmpfs";
+        options = ["nosuid" "nodev" "noatime"];
+      };
+
     }
     {
       sound.enable = false;
@@ -260,6 +267,11 @@ in {
        { predicate = "-p tcp --dport 8088"; target = "ACCEPT"; }
       ];
     }
+    {
+      krebs.repo-sync.timerConfig = {
+        OnCalendar = "*:0/5";
+      };
+    }
   ];
 
   krebs.build.host = config.krebs.hosts.prism;
diff --git a/lass/1systems/shodan.nix b/lass/1systems/shodan.nix
index af98c6968..5140591af 100644
--- a/lass/1systems/shodan.nix
+++ b/lass/1systems/shodan.nix
@@ -50,6 +50,11 @@ with builtins;
       device = "/dev/pool/home-lass";
       fsType = "ext4";
     };
+    "/tmp" = {
+      device = "tmpfs";
+      fsType = "tmpfs";
+      options = ["nosuid" "nodev" "noatime"];
+    };
   };
 
   services.udev.extraRules = ''
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index 16c39280d..aa5286ae0 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -1,33 +1,45 @@
 { config, pkgs, ... }:
 
 with builtins;
+with config.krebs.lib;
 {
   imports = [
     ../.
     ../2configs/retiolum.nix
-    ../2configs/baseX.nix
     ../2configs/exim-retiolum.nix
-    ../2configs/browsers.nix
-    ../2configs/games.nix
-    ../2configs/pass.nix
-    ../2configs/bird.nix
-    ../2configs/git.nix
-    ../2configs/chromium-patched.nix
-    ../2configs/bitlbee.nix
-    ../2configs/weechat.nix
-    ../2configs/skype.nix
     {
-      lass.umts = {
+      # locke config
+      time.timeZone = "Europe/Berlin";
+      services.xserver.enable = true;
+      users.users.locke = {
+        uid = genid "locke";
+        home = "/home/locke";
+        group = "users";
+        createHome = true;
+        extraGroups = [
+          "audio"
+          "networkmanager"
+        ];
+        useDefaultShell = true;
+      };
+      networking.networkmanager.enable = true;
+      hardware.pulseaudio = {
+        enable = true;
+        systemWide = true;
+      };
+      environment.systemPackages = with pkgs; [
+        firefox
+        hexchat
+        networkmanagerapplet
+      ];
+      services.xserver.desktopManager.xfce = {
         enable = true;
-        modem = "/dev/serial/by-id/usb-HUAWEI_Technologies_HUAWEI_Mobile-if00-port0";
       };
     }
   ];
 
   krebs.build.host = config.krebs.hosts.uriel;
 
-  networking.wireless.enable = true;
-
   hardware.enableAllFirmware = true;
   nixpkgs.config.allowUnfree = true;
 
@@ -62,6 +74,11 @@ with builtins;
     "/boot" = {
       device = "/dev/sda1";
     };
+    "/tmp" = {
+      device = "tmpfs";
+      fsType = "tmpfs";
+      options = ["nosuid" "nodev" "noatime"];
+    };
   };
 
   services.udev.extraRules = ''
diff --git a/lass/2configs/backups.nix b/lass/2configs/backups.nix
index 7d3046d43..916e08219 100644
--- a/lass/2configs/backups.nix
+++ b/lass/2configs/backups.nix
@@ -23,10 +23,10 @@ with config.krebs.lib;
       dst = { host = config.krebs.hosts.mors;     path = "/bku/dishfire-http"; };
       startAt = "03:05";
     };
-    dishfire-http-uriel = {
+    dishfire-http-shodan = {
       method = "pull";
       src = { host = config.krebs.hosts.dishfire; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.uriel;    path = "/bku/dishfire-http"; };
+      dst = { host = config.krebs.hosts.shodan;    path = "/bku/dishfire-http"; };
       startAt = "03:10";
     };
     dishfire-sql-prism = {
@@ -41,10 +41,10 @@ with config.krebs.lib;
       dst = { host = config.krebs.hosts.mors;     path = "/bku/dishfire-sql"; };
       startAt = "03:20";
     };
-    dishfire-sql-uriel = {
+    dishfire-sql-shodan = {
       method = "pull";
       src = { host = config.krebs.hosts.dishfire; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.uriel;    path = "/bku/dishfire-sql"; };
+      dst = { host = config.krebs.hosts.shodan;    path = "/bku/dishfire-sql"; };
       startAt = "03:25";
     };
     prism-bitlbee-mors = {
@@ -53,10 +53,10 @@ with config.krebs.lib;
       dst = { host = config.krebs.hosts.mors; path = "/bku/prism-bitlbee"; };
       startAt = "03:25";
     };
-    prism-bitlbee-uriel = {
+    prism-bitlbee-shodan = {
       method = "pull";
       src = { host = config.krebs.hosts.prism; path = "/var/lib/bitlbee"; };
-      dst = { host = config.krebs.hosts.uriel; path = "/bku/prism-bitlbee"; };
+      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-bitlbee"; };
       startAt = "03:25";
     };
     prism-chat-mors = {
@@ -65,10 +65,10 @@ with config.krebs.lib;
       dst = { host = config.krebs.hosts.mors;  path = "/bku/prism-chat"; };
       startAt = "03:30";
     };
-    prism-chat-uriel = {
+    prism-chat-shodan = {
       method = "pull";
       src = { host = config.krebs.hosts.prism; path = "/home/chat"; };
-      dst = { host = config.krebs.hosts.uriel; path = "/bku/prism-chat"; };
+      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-chat"; };
       startAt = "03:35";
     };
     prism-sql-mors = {
@@ -77,10 +77,10 @@ with config.krebs.lib;
       dst = { host = config.krebs.hosts.mors;  path = "/bku/prism-sql_dumps"; };
       startAt = "03:40";
     };
-    prism-sql-uriel = {
+    prism-sql-shodan = {
       method = "pull";
       src = { host = config.krebs.hosts.prism; path = "/bku/sql_dumps"; };
-      dst = { host = config.krebs.hosts.uriel; path = "/bku/prism-sql_dumps"; };
+      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-sql_dumps"; };
       startAt = "03:45";
     };
     prism-http-mors = {
@@ -89,22 +89,22 @@ with config.krebs.lib;
       dst = { host = config.krebs.hosts.mors;  path = "/bku/prism-http"; };
       startAt = "03:50";
     };
-    prism-http-uriel = {
+    prism-http-shodan = {
       method = "pull";
       src = { host = config.krebs.hosts.prism; path = "/srv/http"; };
-      dst = { host = config.krebs.hosts.uriel; path = "/bku/prism-http"; };
+      dst = { host = config.krebs.hosts.shodan; path = "/bku/prism-http"; };
       startAt = "03:55";
     };
-    uriel-home-mors = {
+    shodan-home-mors = {
       method = "pull";
-      src = { host = config.krebs.hosts.uriel; path = "/home"; };
-      dst = { host = config.krebs.hosts.mors;  path = "/bku/uriel-home"; };
+      src = { host = config.krebs.hosts.shodan; path = "/home"; };
+      dst = { host = config.krebs.hosts.mors;  path = "/bku/shodan-home"; };
       startAt = "04:00";
     };
-    mors-home-uriel = {
+    mors-home-shodan = {
       method = "push";
       src = { host = config.krebs.hosts.mors;  path = "/home"; };
-      dst = { host = config.krebs.hosts.uriel; path = "/bku/mors-home"; };
+      dst = { host = config.krebs.hosts.shodan; path = "/bku/mors-home"; };
       startAt = "05:00";
     };
     dishfire-http-helios = {
diff --git a/lass/2configs/browsers.nix b/lass/2configs/browsers.nix
index ea79053ce..90f420674 100644
--- a/lass/2configs/browsers.nix
+++ b/lass/2configs/browsers.nix
@@ -1,11 +1,28 @@
 { config, lib, pkgs, ... }:
 
+with config.krebs.lib;
 let
-  inherit (config.krebs.lib) genid;
 
   mainUser = config.users.extraUsers.mainUser;
-  createChromiumUser = name: extraGroups: packages:
-    {
+
+  browser-select = pkgs.writeScriptBin "browser-select" ''
+    BROWSER=$(echo -e "${concatStringsSep "\\n" (attrNames config.lass.browser.paths)}" | ${pkgs.dmenu}/bin/dmenu)
+    case $BROWSER in
+    ${concatMapStringsSep "\n" (n: ''
+      ${n})
+        export BIN=${config.lass.browser.paths.${n}}/bin/${n}
+        ;;
+    '') (attrNames config.lass.browser.paths)}
+    esac
+    $BIN "$@"
+  '';
+
+  createChromiumUser = name: extraGroups:
+    let
+      bin = pkgs.writeScriptBin name ''
+        /var/setuid-wrappers/sudo -u ${name} -i ${pkgs.chromium}/bin/chromium $@
+      '';
+    in {
       users.extraUsers.${name} = {
         inherit name;
         inherit extraGroups;
@@ -14,19 +31,21 @@ let
         useDefaultShell = true;
         createHome = true;
       };
-      krebs.per-user.${name}.packages = packages;
+      lass.browser.paths.${name} = bin;
       security.sudo.extraConfig = ''
         ${mainUser.name} ALL=(${name}) NOPASSWD: ALL
       '';
       environment.systemPackages = [
-        (pkgs.writeScriptBin name ''
-          /var/setuid-wrappers/sudo -u ${name} -i chromium $@
-        '')
+        bin
       ];
     };
 
-  createFirefoxUser = name: extraGroups: packages:
-    {
+  createFirefoxUser = name: extraGroups:
+    let
+      bin = pkgs.writeScriptBin name ''
+        /var/setuid-wrappers/sudo -u ${name} -i ${pkgs.firefox}/bin/firefox $@
+      '';
+    in {
       users.extraUsers.${name} = {
         inherit name;
         inherit extraGroups;
@@ -35,14 +54,12 @@ let
         useDefaultShell = true;
         createHome = true;
       };
-      krebs.per-user.${name}.packages = packages;
+      lass.browser.paths.${name} = bin;
       security.sudo.extraConfig = ''
         ${mainUser.name} ALL=(${name}) NOPASSWD: ALL
       '';
       environment.systemPackages = [
-        (pkgs.writeScriptBin name ''
-          /var/setuid-wrappers/sudo -u ${name} -i firefox $@
-        '')
+        bin
       ];
     };
 
@@ -50,19 +67,26 @@ let
 
 in {
 
+  lass.browser.select = browser-select;
+
   environment.systemPackages = [
-    (pkgs.writeScriptBin "browser-select" ''
-      BROWSER=$(echo -e "ff\ncr\nwk\nfb\ngm\nflash" | dmenu)
-      $BROWSER $@
-    '')
+    browser-select
   ];
 
   imports = [
-    ( createFirefoxUser "ff" [ "audio" ] [ pkgs.firefox ] )
-    ( createChromiumUser "cr" [ "video" "audio" ] [ pkgs.chromium ] )
-    ( createChromiumUser "wk" [ "video" "audio" ] [ pkgs.chromium ] )
-    ( createChromiumUser "fb" [ "video" "audio" ] [ pkgs.chromium ] )
-    ( createChromiumUser "gm" [ "video" "audio" ] [ pkgs.chromium ] )
-    ( createChromiumUser "com" [ "video" "audio" ] [ pkgs.chromium ] )
+    {
+      options.lass.browser.select = mkOption {
+        type = types.path;
+      };
+      options.lass.browser.paths = mkOption {
+        type = with types; attrsOf path;
+      };
+    }
+    ( createFirefoxUser "ff" [ "audio" ] )
+    ( createChromiumUser "cr" [ "video" "audio" ] )
+    ( createChromiumUser "wk" [ "video" "audio" ] )
+    ( createChromiumUser "fb" [ "video" "audio" ] )
+    ( createChromiumUser "gm" [ "video" "audio" ] )
+    ( createChromiumUser "com" [ "video" "audio" ] )
   ];
 }
diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix
index 5575b7e7b..0b7ca8eaa 100644
--- a/lass/2configs/default.nix
+++ b/lass/2configs/default.nix
@@ -21,7 +21,6 @@ with config.krebs.lib;
         root = {
           openssh.authorizedKeys.keys = [
             config.krebs.users.lass.pubkey
-            config.krebs.users.lass-uriel.pubkey
             config.krebs.users.lass-shodan.pubkey
           ];
         };
@@ -37,7 +36,6 @@ with config.krebs.lib;
           ];
           openssh.authorizedKeys.keys = [
             config.krebs.users.lass.pubkey
-            config.krebs.users.lass-uriel.pubkey
             config.krebs.users.lass-shodan.pubkey
           ];
         };
@@ -69,7 +67,7 @@ with config.krebs.lib;
     };
   };
 
-  nix.useChroot = true;
+  nix.useSandbox = true;
 
   users.mutableUsers = false;
 
@@ -99,6 +97,7 @@ with config.krebs.lib;
     jq
     parallel
     proot
+    populate
 
   #style
     most
@@ -143,15 +142,6 @@ with config.krebs.lib;
       shopt -s histappend histreedit histverify
       shopt -s no_empty_cmd_completion
       complete -d cd
-
-      #fancy colors
-      if [ -e ~/LS_COLORS ]; then
-        eval $(dircolors ~/LS_COLORS)
-      fi
-
-      if [ -e /etc/nixos/dotfiles/link ]; then
-        /etc/nixos/dotfiles/link
-      fi
     '';
     promptInit = ''
       if test $UID = 0; then
diff --git a/lass/2configs/iodined.nix b/lass/2configs/iodined.nix
new file mode 100644
index 000000000..f67e2ae86
--- /dev/null
+++ b/lass/2configs/iodined.nix
@@ -0,0 +1,20 @@
+{ pkgs, config, ... }:
+
+let
+  # TODO: make this a parameter
+  domain = "io.lassul.us";
+  pw = import <secrets/iodinepw.nix>;
+in {
+
+  services.iodine.server = {
+    enable = true;
+    domain = domain;
+    ip = "172.16.10.1/24";
+    extraConfig = "-c -P ${pw} -l ${config.krebs.build.host.nets.internet.ip4.addr}";
+  };
+
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-p udp --dport 53"; target = "ACCEPT";}
+  ];
+
+}
diff --git a/lass/2configs/nixpkgs.nix b/lass/2configs/nixpkgs.nix
index 9e3fe888c..6e9138b61 100644
--- a/lass/2configs/nixpkgs.nix
+++ b/lass/2configs/nixpkgs.nix
@@ -2,7 +2,7 @@
 
 {
   krebs.build.source.nixpkgs.git = {
-    url = https://github.com/lassulus/nixpkgs;
-    ref = "3fb009d94e70f5d1151f4ec239a90d2de1979a74";
+    url = https://github.com/nixos/nixpkgs;
+    ref = "354fd3728952c229fee4f2924737c601d7ab4725";
   };
 }
diff --git a/lass/2configs/tests/dummy-secrets/iodinepw.nix b/lass/2configs/tests/dummy-secrets/iodinepw.nix
new file mode 100644
index 000000000..f5e704702
--- /dev/null
+++ b/lass/2configs/tests/dummy-secrets/iodinepw.nix
@@ -0,0 +1 @@
+"derp"
diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix
index d5ad38c07..e05f40d97 100644
--- a/lass/2configs/websites/domsen.nix
+++ b/lass/2configs/websites/domsen.nix
@@ -1,9 +1,11 @@
 { config, pkgs, lib, ... }:
 
 let
+
   inherit (import <stockholm/krebs/4lib> { config = {}; inherit lib; })
     genid
-    ;
+    genid_signed
+  ;
   inherit (import <stockholm/lass/2configs/websites/util.nix> {inherit lib pkgs;})
     ssl
     servePage
@@ -20,6 +22,25 @@ let
     exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
   '';
 
+  check-password = pkgs.writeDash "check-password" ''
+    read pw
+
+    file="/home/$PAM_USER/.shadow"
+
+    #check if shadow file exists
+    test -e "$file" || exit 123
+
+    hash="$(${pkgs.coreutils}/bin/head -1 $file)"
+    salt="$(echo $hash | ${pkgs.gnused}/bin/sed 's/.*\$\(.*\)\$.*/\1/')"
+
+    calc_hash="$(echo "$pw" | ${pkgs.mkpasswd}/bin/mkpasswd -m sha-512 -S $salt)"
+    if [ "$calc_hash" == $hash ]; then
+      exit 0
+    else
+      exit 1
+    fi
+  '';
+
 in {
   imports = [
     ./sqlBackup.nix
@@ -122,39 +143,62 @@ in {
     };
   };
 
-
-  #services.phpfpm.phpOptions = ''
-  #  extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
-  #  sendmail_path = ${sendmail} -t
-  #'';
-  services.phpfpm.phpIni = pkgs.runCommand "php.ini" {
-     options = ''
-      extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
-      sendmail_path = "${sendmail} -t -i"
-      always_populate_raw_post_data = -1
-    '';
-  } ''
-    cat ${pkgs.php}/etc/php-recommended.ini > $out
-    echo "$options" >> $out
+  services.phpfpm.phpOptions = ''
+    sendmail_path = ${sendmail} -t
+    upload_max_filesize = 100M
+    post_max_size = 100M
+    file_uploads = on
   '';
 
   # MAIL STUFF
   # TODO: make into its own module
-    services.dovecot2 = {
-      enable = true;
-      mailLocation = "maildir:~/Mail";
-    };
-    krebs.iptables.tables.filter.INPUT.rules = [
-      { predicate = "-p tcp --dport pop3"; target = "ACCEPT"; }
-      { predicate = "-p tcp --dport imap"; target = "ACCEPT"; }
-    ];
+  services.dovecot2 = {
+    enable = true;
+    mailLocation = "maildir:~/Mail";
+    sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem";
+    sslServerKey = "/var/lib/acme/lassul.us/key.pem";
+  };
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-p tcp --dport pop3s"; target = "ACCEPT"; }
+    { predicate = "-p tcp --dport imaps"; target = "ACCEPT"; }
+    { predicate = "-p tcp --dport 465"; target = "ACCEPT"; }
+  ];
+
+  security.pam.services.exim.text = ''
+    auth        required      pam_env.so
+    auth        sufficient    pam_exec.so debug expose_authtok ${check-password}
+    auth        sufficient    pam_unix.so likeauth nullok
+    auth        required      pam_deny.so
+    account     required      pam_unix.so
+    password    required      pam_cracklib.so retry=3 type=
+    password    sufficient    pam_unix.so nullok use_authtok md5shadow
+    password    required      pam_deny.so
+    session     required      pam_limits.so
+    session     required      pam_unix.so
+  '';
+
   krebs.exim-smarthost = {
+    authenticators.PLAIN = ''
+      driver = plaintext
+      server_prompts = :
+      server_condition = "''${if pam{$auth2:$auth3}{yes}{no}}"
+      server_set_id = $auth2
+    '';
+    authenticators.LOGIN = ''
+      driver = plaintext
+      server_prompts = "Username:: : Password::"
+      server_condition = "''${if pam{$auth1:$auth2}{yes}{no}}"
+      server_set_id = $auth1
+    '';
     internet-aliases = [
       { from = "dominik@apanowicz.de"; to = "dma@ubikmedia.eu"; }
       { from = "mail@jla-trading.com"; to = "jla-trading"; }
+      { from = "testuser@lassul.us"; to = "testuser"; }
     ];
     system-aliases = [
     ];
+    ssl_cert = "/var/lib/acme/lassul.us/fullchain.pem";
+    ssl_key = "/var/lib/acme/lassul.us/key.pem";
   };
 
   users.users.domsen = {
diff --git a/lass/2configs/websites/util.nix b/lass/2configs/websites/util.nix
index 330d8ba86..23f417195 100644
--- a/lass/2configs/websites/util.nix
+++ b/lass/2configs/websites/util.nix
@@ -167,7 +167,6 @@ rec {
         pm.max_spare_servers = 3
         listen.owner = nginx
         listen.group = nginx
-        # errors to journal
         php_admin_value[error_log] = 'stderr'
         php_admin_flag[log_errors] = on
         catch_workers_output = yes
@@ -188,6 +187,7 @@ rec {
           error_log /tmp/nginx_err.log;
           error_page 404 /404.html;
           error_page 500 502 503 504 /50x.html;
+          client_max_body_size 100m;
         '';
         locations = [
           (nameValuePair "/" ''
@@ -219,7 +219,6 @@ rec {
         pm.max_spare_servers = 3
         listen.owner = nginx
         listen.group = nginx
-        # errors to journal
         php_admin_value[error_log] = 'stderr'
         php_admin_flag[log_errors] = on
         catch_workers_output = yes
diff --git a/lass/2configs/xserver/Xresources.nix b/lass/2configs/xserver/Xresources.nix
index 5d3661706..0f04540c3 100644
--- a/lass/2configs/xserver/Xresources.nix
+++ b/lass/2configs/xserver/Xresources.nix
@@ -11,7 +11,7 @@ pkgs.writeText "Xresources" ''
   ! ref https://github.com/muennich/urxvt-perls
   URxvt.perl-lib: ${pkgs.urxvt_perls}/lib/urxvt/perl
   URxvt.perl-ext-common:      default,clipboard,url-select,keyboard-select
-  URxvt.url-select.launcher:  browser-select
+  URxvt.url-select.launcher:  ${config.lass.browser.select}/bin/browser-select
   URxvt.url-select.underline: true
   URxvt.keysym.M-u:           perl:url-select:select_next
   URxvt.keysym.M-Escape:      perl:keyboard-select:activate
diff --git a/lass/2configs/xserver/default.nix b/lass/2configs/xserver/default.nix
index 73b148bf7..0f9b1f84a 100644
--- a/lass/2configs/xserver/default.nix
+++ b/lass/2configs/xserver/default.nix
@@ -1,143 +1,112 @@
-{ config, lib, pkgs, ... }@args:
-
+{ config, pkgs, ... }@args:
 with config.krebs.lib;
-
 let
-  # TODO krebs.build.user
-  user = config.users.users.mainUser;
-
-  out = {
-    services.xserver = {
-      display = 11;
-      tty = 11;
-
-      synaptics = {
-        enable = true;
-        twoFingerScroll = true;
-        accelFactor = "0.035";
-      };
-
-      #keyboard stuff
-      layout = "us";
-      xkbVariant = "altgr-intl";
-      xkbOptions = "caps:backspace";
+  user = config.krebs.build.user;
+in {
+
+  environment.systemPackages = [
+    pkgs.gitAndTools.qgit
+    pkgs.mpv
+    pkgs.sxiv
+    pkgs.xsel
+    pkgs.zathura
+  ];
+
+  fonts.fonts = [
+    pkgs.xlibs.fontschumachermisc
+  ];
+
+  services.xserver = {
+    enable = true;
+    display = 11;
+    tty = 11;
+
+    synaptics = {
+      enable = true;
+      twoFingerScroll = true;
+      accelFactor = "0.035";
     };
 
-    fonts.fonts = [
-      pkgs.xlibs.fontschumachermisc
-    ];
+    layout = "us";
+    xkbVariant = "altgr-intl";
+    xkbOptions = "caps:backspace";
+  };
 
-    systemd.services.urxvtd = {
-      wantedBy = [ "multi-user.target" ];
-      reloadIfChanged = true;
-      serviceConfig = {
-        ExecReload = need-reload "urxvtd.service";
-        ExecStart = "${pkgs.rxvt_unicode}/bin/urxvtd";
-        Restart = "always";
-        RestartSec = "2s";
-        StartLimitBurst = 0;
-        User = user.name;
-      };
-    };
+  systemd.services.display-manager.enable = false;
 
-    krebs.per-user.lass.packages = [
-      pkgs.rxvt_unicode_with-plugins
-    ];
+  systemd.services.xmonad = {
+    wantedBy = [ "multi-user.target" ];
+    requires = [ "xserver.service" ];
+    environment = {
+      DISPLAY = ":${toString config.services.xserver.display}";
 
-    systemd.services.display-manager.enable = false;
+      XMONAD_STARTUP_HOOK = pkgs.writeDash "xmonad-startup-hook" ''
+        ${pkgs.xorg.xhost}/bin/xhost +LOCAL: &
+        ${pkgs.xorg.xrdb}/bin/xrdb -merge ${import ./Xresources.nix args} &
+        ${pkgs.xorg.xsetroot}/bin/xsetroot -solid '#1c1c1c' &
+        wait
+      '';
 
-    services.xserver.enable = true;
+      XMONAD_STATE = "/tmp/xmonad.state";
 
-    systemd.services.xmonad = {
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "xserver.service" ];
-      environment = xmonad-environment;
-      restartIfChanged = true;
-      serviceConfig = {
-        ExecStart = "${xmonad-start}/bin/xmonad";
-        ExecStop = "${xmonad-stop}/bin/xmonad-stop";
-        User = user.name;
-        WorkingDirectory = user.home;
-      };
+      # XXX JSON is close enough :)
+      XMONAD_WORKSPACES0_FILE = pkgs.writeText "xmonad.workspaces0" (toJSON [
+        "dashboard" # we start here
+      ]);
     };
-
-    systemd.services.xserver = {
-      after = [
-        "systemd-udev-settle.service"
-        "local-fs.target"
-        "acpid.service"
-      ];
-      reloadIfChanged = true;
-      environment = xserver-environment;
-      serviceConfig = {
-        ExecReload = need-reload "xserver.service";
-        ExecStart = "${xserver}/bin/xserver";
-      };
+    serviceConfig = {
+      SyslogIdentifier = "xmonad";
+      ExecStart = "${pkgs.xmonad-lass}/bin/xmonad";
+      ExecStop = pkgs.writeScript "xmonad-stop" ''
+        #! /bin/sh
+        ${pkgs.xmonad-lass}/bin/xmonad --shutdown
+        ${pkgs.coreutils}/bin/sleep 2s
+      '';
+      User = user.name;
+      WorkingDirectory = user.home;
     };
   };
 
-  xmonad-environment = {
-    DISPLAY = ":${toString config.services.xserver.display}";
-    XMONAD_STATE = "/tmp/xmonad.state";
-
-    # XXX JSON is close enough :)
-    XMONAD_WORKSPACES0_FILE = pkgs.writeText "xmonad.workspaces0" (toJSON [
-      "dashboard"
-    ]);
+  systemd.services.xserver = {
+    after = [
+      "systemd-udev-settle.service"
+      "local-fs.target"
+      "acpid.service"
+    ];
+    reloadIfChanged = true;
+    environment = {
+      XKB_BINDIR = "${pkgs.xorg.xkbcomp}/bin"; # Needed for the Xkb extension.
+      XORG_DRI_DRIVER_PATH = "/run/opengl-driver/lib/dri"; # !!! Depends on the driver selected at runtime.
+      LD_LIBRARY_PATH = concatStringsSep ":" (
+        [ "${pkgs.xorg.libX11}/lib" "${pkgs.xorg.libXext}/lib" ]
+        ++ concatLists (catAttrs "libPath" config.services.xserver.drivers));
+    };
+    serviceConfig = {
+      SyslogIdentifier = "xserver";
+      ExecReload = "${pkgs.coreutils}/bin/echo NOP";
+      ExecStart = toString [
+        "${pkgs.xorg.xorgserver}/bin/X"
+        ":${toString config.services.xserver.display}"
+        "vt${toString config.services.xserver.tty}"
+        "-config ${import ./xserver.conf.nix args}"
+        "-logfile /dev/null -logverbose 0 -verbose 3"
+        "-nolisten tcp"
+        "-xkbdir ${pkgs.xkeyboard_config}/etc/X11/xkb"
+      ];
+    };
   };
 
-  xmonad-start = pkgs.writeScriptBin "xmonad" ''
-    #! ${pkgs.bash}/bin/bash
-    set -efu
-    export PATH; PATH=${makeSearchPath "bin" ([
-      pkgs.rxvt_unicode
-    ] ++ config.environment.systemPackages)}:/var/setuid-wrappers
-    settle() {(
-      # Use PATH for a clean journal
-      command=''${1##*/}
-      PATH=''${1%/*}; export PATH
-      shift
-      until "$command" "$@"; do
-        ${pkgs.coreutils}/bin/sleep 1
-      done
-    )&}
-    settle ${pkgs.xorg.xhost}/bin/xhost +LOCAL:
-    settle ${pkgs.xorg.xrdb}/bin/xrdb -merge