Merge remote-tracking branch 'lass/master'

31 files changed, 798 insertions, 167 deletions

diff --git a/lass/1systems/hilum/config.nix b/lass/1systems/hilum/config.nix
index 7a506591b..3f25991d9 100644
--- a/lass/1systems/hilum/config.nix
+++ b/lass/1systems/hilum/config.nix
@@ -33,4 +33,6 @@
 
   services.logind.lidSwitch = "ignore";
   services.logind.lidSwitchDocked = "ignore";
+
+  boot.tmpOnTmpfs = true;
 }
diff --git a/lass/1systems/icarus/physical.nix b/lass/1systems/icarus/physical.nix
index 861bd8b0b..bd74c29f3 100644
--- a/lass/1systems/icarus/physical.nix
+++ b/lass/1systems/icarus/physical.nix
@@ -46,6 +46,15 @@
   '';
 
   services.thinkfan.enable = true;
+  services.thinkfan.levels = ''
+    (0,     0,      55)
+    (1,     48,     60)
+    (2,     50,     61)
+    (3,     52,     63)
+    (6,     60,     65)
+    (7,     80,     85)
+    (127,   90,     32767)
+  '';
 
   services.logind.lidSwitch = "ignore";
   services.logind.lidSwitchDocked = "ignore";
diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index 03ff42132..fe0b6d85b 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -49,17 +49,17 @@ with import <stockholm/lib>;
       ];
     }
     {
-      krebs.syncthing = {
-        peers.schasch.addresses = [ "schasch.r:22000" ];
+      services.syncthing.declarative = {
+        devices.schasch.addresses = [ "schasch.r:22000" ];
         folders = {
           the_playlist = {
             path = "/home/lass/tmp/the_playlist";
-            peers = [ "mors" "phone" "prism" "xerxes" ];
+            devices = [ "mors" "phone" "prism" "xerxes" ];
           };
           free_music = {
             id = "mu9mn-zgvsw";
             path = "/home/lass/tmp/free_music";
-            peers = [ "mors" "schasch" ];
+            devices = [ "mors" "schasch" ];
           };
         };
       };
diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index cde65ea6c..d8bb14d0a 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -263,8 +263,6 @@ with import <stockholm/lib>;
     }
     {
       users.users.download.openssh.authorizedKeys.keys = [
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDB0d0JA20Vqn7I4lCte6Ne2EOmLZyMJyS9yIKJYXNLjbLwkQ4AYoQKantPBkTxR75M09E7d3j5heuWnCjWH45TrfQfe1EOSSC3ppCI6C6aIVlaNs+KhAYZS0m2Y8WkKn+TT5JLEa8yybYVN/RlZPOilpj/1QgjU6CQK+eJ1k/kK+QFXcwN82GDVh5kbTVcKUNp2tiyxFA+z9LY0xFDg/JHif2ROpjJVLQBJ+YPuOXZN5LDnVcuyLWKThjxy5srQ8iDjoxBg7dwLHjby5Mv41K4W61Gq6xM53gDEgfXk4cQhJnmx7jA/pUnsn2ZQDeww3hcc7vRf8soogXXz2KC9maiq0M/svaATsa9Ul4hrKnqPZP9Q8ScSEAUX+VI+x54iWrnW0p/yqBiRAzwsczdPzaQroUFTBxrq8R/n5TFdSHRMX7fYNOeVMjhfNca/gtfw9dYBVquCvuqUuFiRc0I7yK44rrMjjVQRcAbw6F8O7+04qWCmaJ8MPlmApwu2c05VMv9hiJo5p6PnzterRSLCqF6rIdhSnuOwrUIt1s/V+EEZXHCwSaNLaQJnYL0H9YjaIuGz4c8kVzxw4c0B6nl+hqW5y5/B2cuHiumnlRIDKOIzlv8ufhh21iN7QpIsPizahPezGoT1XqvzeXfH4qryo8O4yTN/PWoA+f7o9POU7L6hQ== lhebendanz@nixos"
-        config.krebs.users.palo.pubkey
       ];
     }
     {
@@ -338,30 +336,36 @@ with import <stockholm/lib>;
         localAddress = "10.233.2.14";
       };
 
-      services.nginx.virtualHosts."lassul.us".locations."^~ /flix/".extraConfig = ''
-        if ($scheme != "https") {
-          rewrite ^ https://$host$request_uri permanent;
-        }
-        auth_basic "Restricted Content";
-        auth_basic_user_file ${pkgs.writeText "flix-user-pass" ''
-          krebs:$apr1$1Fwt/4T0$YwcUn3OBmtmsGiEPlYWyq0
-        ''};
-        proxy_pass http://10.233.2.14:80/;
-        proxy_set_header Accept-Encoding "";
-        sub_filter "https://lassul.us/" "https://lassul.us/flix/";
-        sub_filter_once off;
-      '';
-      services.nginx.virtualHosts."lassul.us".locations."^~ /transmission".extraConfig = ''
-        if ($scheme != "https") {
-          rewrite ^ https://$host$request_uri permanent;
-        }
-        auth_basic "Restricted Content";
-        auth_basic_user_file ${pkgs.writeText "transmission-user-pass" ''
-          krebs:$apr1$1Fwt/4T0$YwcUn3OBmtmsGiEPlYWyq0
-        ''};
-        proxy_pass_header X-Transmission-Session-Id;
-        proxy_pass http://10.233.2.14:9091;
-      '';
+      services.nginx.virtualHosts."lassul.us" = {
+        locations."^~ /flix/".extraConfig = ''
+          if ($scheme != "https") {
+            rewrite ^ https://$host$request_uri permanent;
+          }
+          auth_basic "Restricted Content";
+          auth_basic_user_file ${pkgs.writeText "flix-user-pass" ''
+            krebs:$apr1$1Fwt/4T0$YwcUn3OBmtmsGiEPlYWyq0
+          ''};
+          proxy_pass http://10.233.2.14:80/;
+          proxy_set_header Accept-Encoding "";
+          sub_filter "https://lassul.us/" "https://lassul.us/flix/";
+          sub_filter_once off;
+        '';
+        locations."^~ /chatty/".extraConfig = ''
+          rewrite ^ https://$host/flix/$request_uri permanent;
+        '';
+        #locations."^~ /transmission".return = "301 https://$host/transmission/web/";
+        locations."^~ /transmission/".extraConfig = ''
+          if ($scheme != "https") {
+            rewrite ^ https://$host$request_uri permanent;
+          }
+          auth_basic "Restricted Content";
+          auth_basic_user_file ${pkgs.writeText "transmission-user-pass" ''
+            krebs:$apr1$1Fwt/4T0$YwcUn3OBmtmsGiEPlYWyq0
+          ''};
+          proxy_pass_header X-Transmission-Session-Id;
+          proxy_pass http://10.233.2.14:9091;
+        '';
+      };
 
       users.groups.download = {};
       users.users = {
@@ -376,6 +380,9 @@ with import <stockholm/lib>;
             lass.pubkey
             lass-android.pubkey
             makefu.pubkey
+            palo.pubkey
+            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDB0d0JA20Vqn7I4lCte6Ne2EOmLZyMJyS9yIKJYXNLjbLwkQ4AYoQKantPBkTxR75M09E7d3j5heuWnCjWH45TrfQfe1EOSSC3ppCI6C6aIVlaNs+KhAYZS0m2Y8WkKn+TT5JLEa8yybYVN/RlZPOilpj/1QgjU6CQK+eJ1k/kK+QFXcwN82GDVh5kbTVcKUNp2tiyxFA+z9LY0xFDg/JHif2ROpjJVLQBJ+YPuOXZN5LDnVcuyLWKThjxy5srQ8iDjoxBg7dwLHjby5Mv41K4W61Gq6xM53gDEgfXk4cQhJnmx7jA/pUnsn2ZQDeww3hcc7vRf8soogXXz2KC9maiq0M/svaATsa9Ul4hrKnqPZP9Q8ScSEAUX+VI+x54iWrnW0p/yqBiRAzwsczdPzaQroUFTBxrq8R/n5TFdSHRMX7fYNOeVMjhfNca/gtfw9dYBVquCvuqUuFiRc0I7yK44rrMjjVQRcAbw6F8O7+04qWCmaJ8MPlmApwu2c05VMv9hiJo5p6PnzterRSLCqF6rIdhSnuOwrUIt1s/V+EEZXHCwSaNLaQJnYL0H9YjaIuGz4c8kVzxw4c0B6nl+hqW5y5/B2cuHiumnlRIDKOIzlv8ufhh21iN7QpIsPizahPezGoT1XqvzeXfH4qryo8O4yTN/PWoA+f7o9POU7L6hQ== lhebendanz@nixos"
+            "AAAAB3NzaC1yc2EAAAADAQABAAABgQC4ECL9NSCWqs4KVe+FF+2BPtl5Bv5aQPHqnXllCyiESZykwRKLx6/AbF5SbUAUMVZtp9oDSdp28m3BvVeWJ/q7hAbIxUtfd/jp+JBRZ8Kj6K5GzUO7Bhgl/o0A7xEjAeOKHiYuLjdPMcFUyl6Ah4ey/mcQYf6AdU0+hYUDeUlKe/YxxYD6202W0GJq2xGdIqs/TbopT9iaX+sv0wdXDVfFY72nFqOUwJW3u6O2viKKRugrz/eo50Eo3ts7pYz/FpDXExrUvV9Vu/bQ34pa8nKgF3/AKQHgmzljNQSVZKyAV8OY0UFonjBMXCBg2tXtwfnlzdx2SyuQVv55x+0AuRKsi85G2xLpXu1A3921pseBTW6Q6kbYK9eqxAay2c/kNbwNqFnO+nCvQ6Ier/hvGddOtItMu96IuU2E7mPN6WgvM8/3fjJRFWnZxFxqu/k7iH+yYT8qwRgdiSqZc76qvkYEuabdk2itstTRY0A3SpI3hFMZDw/7bxgMZtqpfyoRk5s= philip@shiki11:15 <Profpatsch> AAAAB3NzaC1yc2EAAAADAQABAAABgQC4ECL9NSCWqs4KVe+FF+2BPtl5Bv5aQPHqnXllCyiESZykwRKLx6/AbF5SbUAUMVZtp9oDSdp28m3BvVeWJ/q7hAbIxUtfd/jp+JBRZ8Kj6K5GzUO7Bhgl/o0A7xEjAeOKHiYuLjdPMcFUyl6Ah4ey/mcQYf6AdU0+hYUDeUlKe/YxxYD6202W0GJq2xGdIqs/TbopT9iaX+sv0wdXDVfFY72nFqOUwJW3u6O2viKKRugrz/eo50Eo3ts7pYz/FpDXExrUvV9Vu/bQ34pa8nKgF3/AKQHgmzljNQSVZKyAV8OY0UFonjBMXCBg2tXtwfnlzdx2SyuQVv55x+0AuRKsi85G2xLpXu1A3921pseBTW6Q6kbYK9eqxAay2c/kNbwNqFnO+nCvQ6Ier/hvGddOtItMu96IuU2E7mPN6WgvM8/3fjJRFWnZxFxqu/k7iH+yYT8qwRgdiSqZc76qvkYEuabdk2itstTRY0A3SpI3hFMZDw/7bxgMZtqpfyoRk5s= philip@shiki"
           ];
         };
       };
diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix
index 9bb31191c..831e03f79 100644
--- a/lass/1systems/shodan/config.nix
+++ b/lass/1systems/shodan/config.nix
@@ -19,7 +19,9 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/ssh-cryptsetup.nix>
     <stockholm/lass/2configs/nfs-dl.nix>
     <stockholm/lass/2configs/gg23.nix>
+    <stockholm/lass/2configs/hass>
     <stockholm/lass/2configs/br.nix>
+    <stockholm/lass/2configs/fetchWallpaper.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.shodan;
diff --git a/lass/1systems/xerxes/config.nix b/lass/1systems/xerxes/config.nix
index 8630d0f4b..e4a4fb505 100644
--- a/lass/1systems/xerxes/config.nix
+++ b/lass/1systems/xerxes/config.nix
@@ -41,11 +41,11 @@
     displayManager.lightdm.autoLogin.user = "lass";
   };
 
-  krebs.syncthing = {
+  services.syncthing.declarative = {
     folders = {
       the_playlist = {
         path = "/home/lass/tmp/the_playlist";
-        peers = [ "mors" "phone" "prism" "xerxes" ];
+        devices = [ "mors" "phone" "prism" "xerxes" ];
       };
     };
   };
diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix
index abbc0045b..82fe3fac5 100644
--- a/lass/1systems/yellow/config.nix
+++ b/lass/1systems/yellow/config.nix
@@ -54,12 +54,107 @@ with import <stockholm/lib>;
         root = "/var/download/finished";
         extraConfig = ''
           fancyindex on;
-          dav_methods PUT DELETE MKCOL COPY MOVE;
-
+          fancyindex_footer "/fancy.html";
+          include ${pkgs.nginx}/conf/mime.types;
+          include ${pkgs.writeText "extrMime" ''
+            types {
+              video/webm mkv;
+            }
+          ''};
           create_full_put_path on;
-          dav_access all:r;
         '';
       };
+      locations."/chatty" = {
+        proxyPass = "http://localhost:3000";
+        extraConfig = ''
+          rewrite /chatty/(.*) /$1  break;
+          proxy_set_header Host $host;
+        '';
+      };
+      locations."= /fancy.html".extraConfig = ''
+        alias ${pkgs.writeText "nginx_footer" ''
+          <div id="mydiv">
+            <!-- Include a header DIV with the same name as the draggable DIV, followed by "header" -->
+            <div id="mydivheader">Click here to move</div>
+              <iframe src="/chatty/index.html"></iframe>
+          </div>
+          <style>
+          #mydiv {
+            position: absolute;
+            z-index: 9;
+            background-color: #f1f1f1;
+            border: 1px solid #d3d3d3;
+            text-align: center;
+          }
+
+          #mydivheader {
+            padding: 10px;
+            cursor: move;
+            z-index: 10;
+            background-color: #2196F3;
+            color: #fff;
+          }
+          </style>
+          <script>
+            // Make the DIV element draggable:
+            dragElement(document.getElementById("mydiv"));
+
+            function dragElement(elmnt) {
+              var pos1 = 0, pos2 = 0, pos3 = 0, pos4 = 0;
+              if (document.getElementById(elmnt.id + "header")) {
+                // if present, the header is where you move the DIV from:
+                document.getElementById(elmnt.id + "header").onmousedown = dragMouseDown;
+              } else {
+                // otherwise, move the DIV from anywhere inside the DIV:
+                elmnt.onmousedown = dragMouseDown;
+              }
+
+              function dragMouseDown(e) {
+                e = e || window.event;
+                e.preventDefault();
+                // get the mouse cursor position at startup:
+                pos3 = e.clientX;
+                pos4 = e.clientY;
+                document.onmouseup = closeDragElement;
+                // call a function whenever the cursor moves:
+                document.onmousemove = elementDrag;
+              }
+
+              function elementDrag(e) {
+                e = e || window.event;
+                e.preventDefault();
+                // calculate the new cursor position:
+                pos1 = pos3 - e.clientX;
+                pos2 = pos4 - e.clientY;
+                pos3 = e.clientX;
+                pos4 = e.clientY;
+                // set the element's new position:
+                elmnt.style.top = (elmnt.offsetTop - pos2) + "px";
+                elmnt.style.left = (elmnt.offsetLeft - pos1) + "px";
+              }
+
+              function closeDragElement() {
+                // stop moving when mouse button is released:
+                document.onmouseup = null;
+                document.onmousemove = null;
+              }
+            }
+          </script>
+        ''};
+      '';
+    };
+  };
+
+  systemd.services.bruellwuerfel = {
+    wantedBy = [ "multi-user.target" ];
+    environment = {
+      IRC_CHANNEL = "#flix";
+      IRC_NICK = "bruelli";
+      IRC_SERVER = "irc.r";
+      IRC_HISTORY_FILE = "/tmp/bruelli.history";
+    };
+    serviceConfig = {
+      ExecStart = "${pkgs.bruellwuerfel}/bin/bruellwuerfel";
     };
   };
 
diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix
index 52d694c46..b3340cb31 100644
--- a/lass/2configs/baseX.nix
+++ b/lass/2configs/baseX.nix
@@ -71,12 +71,14 @@ in {
     gitAndTools.qgit
     git-preview
     gnome3.dconf
+    iodine
     lm_sensors
     ncdu
     nix-index
     nix-review
     nmap
     pavucontrol
+    ponymix
     powertop
     rxvt_unicode-with-plugins
     sxiv
diff --git a/lass/2configs/blue.nix b/lass/2configs/blue.nix
index aad8411b1..a4000cada 100644
--- a/lass/2configs/blue.nix
+++ b/lass/2configs/blue.nix
@@ -19,6 +19,7 @@ with (import <stockholm/lib>);
   ];
 
   services.tor.enable = true;
+  services.tor.client.enable = true;
 
   krebs.iptables.tables.filter.INPUT.rules = [
     { predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";}
diff --git a/lass/2configs/exim-smarthost.nix b/lass/2configs/exim-smarthost.nix
index 565608633..82839beba 100644
--- a/lass/2configs/exim-smarthost.nix
+++ b/lass/2configs/exim-smarthost.nix
@@ -102,9 +102,19 @@
     "microsoft@lassul.us"
     "stickers@lassul.us"
     "nextbike@lassul.us"
+    "mytello@lassul.us"
+    "camp@lassul.us"
+    "urlwatch@lassul.us"
+    "lidl@lassul.us"
+    "geizhals@lassul.us"
+    "auschein@lassul.us"
+    "tleech@lassul.us"
+    "durstexpress@lassul.us"
   ];
 
 in {
+  environment.systemPackages = [ pkgs.review-mail-queue ];
+
   krebs.exim-smarthost = {
     enable = true;
     dkim = [
diff --git a/lass/2configs/gg23.nix b/lass/2configs/gg23.nix
index b23494b28..3d4c1e306 100644
--- a/lass/2configs/gg23.nix
+++ b/lass/2configs/gg23.nix
@@ -20,12 +20,13 @@ with import <stockholm/lib>;
       }
     '';
     machines = [
-      { ethernetAddress = "c8:3d:d4:2c:40:ae"; hostName = "tv"; ipAddress = "10.42.0.3"; }
+      { ethernetAddress = "a8:a6:48:65:ce:4c"; hostName = "tv"; ipAddress = "10.42.0.3"; }
       { ethernetAddress = "3c:2a:f4:22:28:37"; hostName = "drucker"; ipAddress = "10.42.0.4"; }
-      { ethernetAddress = "80:7d:3a:67:b7:01"; hostName = "s20-bett"; ipAddress = "10.42.0.10"; }
+      { ethernetAddress = "80:7d:3a:67:b7:01"; hostName = "s20-tv"; ipAddress = "10.42.0.10"; }
       { ethernetAddress = "80:7d:3a:68:04:f0"; hostName = "s20-drucker"; ipAddress = "10.42.0.11"; }
-      { ethernetAddress = "80:7d:3a:68:11:a5"; hostName = "s20-kueche"; ipAddress = "10.42.0.12"; }
+      { ethernetAddress = "80:7d:3a:68:11:a5"; hostName = "s20-wasch"; ipAddress = "10.42.0.12"; }
       { ethernetAddress = "80:7d:3a:67:bb:69"; hostName = "s20-stereo"; ipAddress = "10.42.0.13"; }
+      { ethernetAddress = "ec:b5:fa:07:78:16"; hostName = "hue-bridge"; ipAddress = "10.42.0.21"; }
       { ethernetAddress = "80:8d:b7:c5:80:dc"; hostName = "arubaAP"; ipAddress = "10.42.0.99"; }
     ];
   };
@@ -45,9 +46,6 @@ with import <stockholm/lib>;
 
   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
   krebs.iptables.tables.filter.INPUT.rules = [
-    { predicate = "-i int0 -p tcp --dport 8123"; target = "ACCEPT"; } # hass
-    { predicate = "-i retiolum -p tcp --dport 8123"; target = "ACCEPT"; } # hass
-    { predicate = "-i int0 -p tcp --dport 1883"; target = "ACCEPT"; } # mosquitto
     { predicate = "-i int0 -p udp --dport 53"; target = "ACCEPT"; } # dns
   ];
   krebs.iptables.tables.filter.FORWARD.rules = [
@@ -62,72 +60,5 @@ with import <stockholm/lib>;
   krebs.iptables.tables.nat.POSTROUTING.rules = [
     { v6 = false; predicate = "-s 10.42.0.0/24 ! -d 10.42.0.0/24"; target = "MASQUERADE"; }
   ];
-
-  services.home-assistant = let
-    tasmota_s20 = name: topic: {
-      platform = "mqtt";
-      inherit name;
-      state_topic = "stat/${topic}/POWER";
-      command_topic = "cmnd/${topic}/POWER";
-      payload_on = "ON";
-      payload_off = "OFF";
-    };
-  in {
-    enable = true;
-    package = pkgs.home-assistant.override {
-      #extraComponents = [
-      #  (pkgs.fetchgit {
-      #    url = "https://github.com/marcschumacher/dwd_pollen";
-      #    rev = "0.1";
-      #    sha256 = "12vldwsds27c9l15ffc6svk9mj17jhypcz736pvpmpqbsymllz2p";
-      #  })
-      #];
-    };
-    config = {
-      homeassistant = {
-        name = "Home"; time_zone = "Europe/Berlin";
-        latitude = "48.7687";
-        longitude = "9.2478";
-        elevation = 247;
-      };
-      sun.elevation = 66;
-      discovery = {};
-      frontend = { };
-      mqtt = {
-        broker = "localhost";
-        port = 1883;
-        client_id = "home-assistant";
-        username = "gg23";
-        password = "gg23-mqtt";
-        keepalive = 60;
-        protocol = 3.1;
-      };
-      sensor = [
-      ];
-      switch = [
-        (tasmota_s20 "Drucker Strom" "drucker")
-        (tasmota_s20 "Bett Licht" "bett")
-        (tasmota_s20 "Kueche Licht" "kueche")
-      ];
-      device_tracker = [
-        {
-          platform = "luci";
-        }
-      ];
-    };
-  };
-
-  services.mosquitto = {
-    enable = true;
-    host = "0.0.0.0";
-    allowAnonymous = false;
-    checkPasswords = true;
-    users.gg23 = {
-      password = "gg23-mqtt";
-      acl = [ "topic readwrite #" ];
-    };
-  };
-  environment.systemPackages = [ pkgs.mosquitto ];
-
 }
 
diff --git a/lass/2configs/green-host.nix b/lass/2configs/green-host.nix
index 1421eede7..0cccbc30e 100644
--- a/lass/2configs/green-host.nix
+++ b/lass/2configs/green-host.nix
@@ -20,7 +20,7 @@ with import <stockholm/lib>;
     }
   ];
 
-  krebs.syncthing.folders."/var/lib/sync-containers".peers = [ "icarus" "skynet" "littleT" "shodan" ];
+  services.syncthing.declarative.folders."/var/lib/sync-containers".devices = [ "icarus" "skynet" "littleT" "shodan" ];
   krebs.permown."/var/lib/sync-containers" = {
     owner = "root";
     group = "syncthing";
diff --git a/lass/2configs/hass/default.nix b/lass/2configs/hass/default.nix
new file mode 100644
index 000000000..ef9361102
--- /dev/null
+++ b/lass/2configs/hass/default.nix
@@ -0,0 +1,86 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    ./zigbee.nix
+    ./rooms/bett.nix
+  ];
+
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-i int0 -p tcp --dport 1883"; target = "ACCEPT"; } # mosquitto
+    { predicate = "-i docker0 -p tcp --dport 1883"; target = "ACCEPT"; } # mosquitto
+    { predicate = "-i int0 -p tcp --dport 8123"; target = "ACCEPT"; } # hass
+    { predicate = "-i retiolum -p tcp --dport 8123"; target = "ACCEPT"; } # hass
+  ];
+
+  services.home-assistant = {
+    enable = true;
+    package = pkgs.home-assistant.override {
+      # extraComponents = [ "hue" ];
+    };
+    configWritable = true;
+  };
+
+  lass.hass.config = let
+    tasmota_s20 = name: topic: {
+      platform = "mqtt";
+      inherit name;
+      state_topic = "stat/${topic}/POWER";
+      command_topic = "cmnd/${topic}/POWER";
+      payload_on = "ON";
+      payload_off = "OFF";
+    };
+  in {
+    homeassistant = {
+      name = "Home";
+      time_zone = "Europe/Berlin";
+      latitude = "48.7687";
+      longitude = "9.2478";
+      elevation = 247;
+    };
+    config = {};
+    sun.elevation = 66;
+    discovery = {};
+    frontend = {};
+    mqtt = {
+      broker = "localhost";
+      port = 1883;
+      client_id = "home-assistant";
+      username = "gg23";
+      password = "gg23-mqtt";
+      keepalive = 60;
+      protocol = 3.1;
+
+      discovery = true;
+      birth_message = {
+        topic = "/hass/status";
+        payload = "online";
+      };
+      will_message = {
+        topic = "/hass/status";
+        payload = "offline";
+      };
+    };
+    sensor = [
+    ];
+    switch = [
+      (tasmota_s20 "TV" "tv")
+      (tasmota_s20 "Drucker Strom" "drucker")
+      (tasmota_s20 "Waschmaschine" "wasch")
+      (tasmota_s20 "Stereo Anlage" "stereo")
+    ];
+    mobile_app = {};
+  };
+
+  services.mosquitto = {
+    enable = true;
+    host = "0.0.0.0";
+    allowAnonymous = false;
+    checkPasswords = true;
+    users.gg23 = {
+      password = "gg23-mqtt";
+      acl = [ "topic readwrite #" ];
+    };
+  };
+
+  environment.systemPackages = [ pkgs.mosquitto ];
+}
diff --git a/lass/2configs/hass/lib.nix b/lass/2configs/hass/lib.nix
new file mode 100644
index 000000000..c69f5e887
--- /dev/null
+++ b/lass/2configs/hass/lib.nix
@@ -0,0 +1,83 @@
+{
+  lights = {
+    bett = "light.0x0017880106ed3bd8_light";
+    essen = "light.0x0017880108327622_light";
+    arbeit = "light.0x0017880106ee2865_light";
+    nass = "light.0x00178801082e9f2f_light";
+  };
+
+  sensors = {
+    bett = "0x00178801086ac38c";
+  };
+
+  lightswitch = switch: light: {
+    automation = [
+      {
+        trigger = {
+          platform = "mqtt";
+          topic = "zigbee/${switch}";
+        };
+        condition = {
+          condition = "or";
+          conditions = [
+            {
+              condition = "template";
+              value_template = "{{ trigger.payload_json.action == 'on-press' }}";
+            }
+            {
+              condition = "template";
+              value_template = "{{ trigger.payload_json.action == 'up-press' }}";
+            }
+            {
+              condition = "and";
+              conditions = [
+                {
+                  condition = "template";
+                  value_template = "{{ trigger.payload_json.action == 'down-press' }}";
+                }
+                {
+                  condition = "template";
+                  value_template = "{{ trigger.payload_json.brightness > 30 }}";
+                }
+              ];
+            }
+          ];
+        };
+        action = [
+          {
+            service = "light.turn_on";
+            data_template = {
+              entity_id = light;
+              brightness = "{{ trigger.payload_json.brightness }}";
+            };
+          }
+        ];
+      }
+      {
+        trigger = {
+          platform = "mqtt";
+          topic = "zigbee/${switch}";
+        };
+        condition = {
+          condition = "or";
+          conditions = [
+            {
+              condition = "template";
+              value_template = "{{ trigger.payload_json.action == 'off-press' }}";
+            }
+            {
+              condition = "template";
+              value_template = "{{ trigger.payload_json.brightness < 30 }}";
+            }
+          ];
+        };
+        action = {
+          service = "light.turn_off";
+          data_template = {
+            entity_id = light;
+          };
+        };
+      }
+    ];
+  };
+}
diff --git a/lass/2configs/hass/rooms/bett.nix b/lass/2configs/hass/rooms/bett.nix
new file mode 100644
index 000000000..21092ef5f
--- /dev/null
+++ b/lass/2configs/hass/rooms/bett.nix
@@ -0,0 +1,27 @@
+{ lib, ... }:
+with import ../lib.nix;
+
+{
+  lass.hass.config = lib.lists.fold lib.recursiveUpdate {} [
+    {
+      #automation = [{
+      #  trigger = {
+      #    platform = "mqtt";
+      #    topic = "zigbee/0x00178801086ac38c/action";
+      #    payload = "on-press";
+      #  };
+      #  action = {
+      #    service = "light.turn_on";
+      #    data = {
+      #      brightness = 150;
+      #      rgb_color = [ 255 0 0 ];
+      #      entity_id = [
+      #        "light.0x0017880108327622_light"
+      #      ];
+      #    };
+      #  };
+      #}];
+    }
+    (lightswitch sensors.bett lights.bett)
+  ];
+}
diff --git a/lass/2configs/hass/zigbee.nix b/lass/2configs/hass/zigbee.nix
new file mode 100644
index 000000000..4d57f9ca4
--- /dev/null
+++ b/lass/2configs/hass/zigbee.nix
@@ -0,0 +1,152 @@
+{config, pkgs, lib, ...}: let
+
+  zigbee2mqtt_cfg = pkgs.writeText "zigbee2mqtt.json" (builtins.toJSON {
+    homeassistant = true;
+    permit_join = true;
+    mqtt = {
+      discovery = true;
+      base_topic = "zigbee";
+      server = "mqtt://10.42.0.1";
+      user = "gg23";
+      password = "gg23-mqtt";
+    };
+    serial.port = "/dev/cc2531";
+  });
+
+in {
+  # symlink the zigbee controller
+  services.udev.extraRules = ''
+    SUBSYSTEM=="tty", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="16a8", SYMLINK+="cc2531", MODE="0660", GROUP="dailout"
+  '';
+
+  system.activationScripts.installZigbee = ''
+    install -d /var/lib/zigbee2mqtt
+    install ${zigbee2mqtt_cfg} /var/lib/zigbee2mqtt/configuration.yaml
+  '';
+
+  # hack to restart docker container on config change
+  systemd.services.docker-zigbee2mqtt.environment.cfg = zigbee2mqtt_cfg;
+
+  docker-containers.zigbee2mqtt = {
+    image = "koenkk/zigbee2mqtt";
+    extraDockerOptions = [
+      "--device=/dev/cc2531:/dev/cc2531"
+    ];
+    volumes = ["/var/lib/zigbee2mqtt:/app/data"];
+  };
+
+  lass.hass.config = {
+    sensor = [
+      # Sensor for monitoring the bridge state
+      {
+        platform = "mqtt";
+        name = "Zigbee2mqtt Bridge state";
+        state_topic = "/zigbee/bridge/state";
+        icon = "mdi:router-wireless";
+      }
+      # Sensor for Showing the Zigbee2mqtt Version
+      {