Merge remote-tracking branch 'cloudkrebs/master'

17 files changed, 428 insertions, 66 deletions

diff --git a/lass/1systems/dishfire.nix b/lass/1systems/dishfire.nix
new file mode 100644
index 00000000..cc9836df
--- /dev/null
+++ b/lass/1systems/dishfire.nix
@@ -0,0 +1,45 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
+    ../2configs/base.nix
+    ../2configs/git.nix
+    ../2configs/websites/fritz.nix
+    {
+      boot.loader.grub = {
+        device = "/dev/vda";
+        splashImage = null;
+      };
+
+      boot.initrd.availableKernelModules = [
+        "ata_piix"
+        "ehci_pci"
+        "uhci_hcd"
+        "virtio_pci"
+        "virtio_blk"
+      ];
+
+      fileSystems."/" = {
+        device = "/dev/mapper/pool-nix";
+        fsType = "ext4";
+      };
+
+      fileSystems."/boot" = {
+        device = "/dev/vda1";
+        fsType = "ext4";
+      };
+    }
+    {
+      networking.dhcpcd.allowInterfaces = [
+        "enp*"
+        "eth*"
+      ];
+    }
+    {
+      sound.enable = false;
+    }
+  ];
+
+  krebs.build.host = config.krebs.hosts.dishfire;
+}
diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix
new file mode 100644
index 00000000..67e3738e
--- /dev/null
+++ b/lass/1systems/helios.nix
@@ -0,0 +1,73 @@
+{ config, pkgs, ... }:
+
+with builtins;
+{
+  imports = [
+    ../2configs/baseX.nix
+    ../2configs/browsers.nix
+    ../2configs/programs.nix
+    ../2configs/git.nix
+    #{
+    #  users.extraUsers = {
+    #    root = {
+    #      openssh.authorizedKeys.keys = map readFile [
+    #        ../../krebs/Zpubkeys/uriel.ssh.pub
+    #      ];
+    #    };
+    #  };
+    #}
+  ];
+
+  krebs.build.host = config.krebs.hosts.helios;
+
+  networking.wireless.enable = true;
+
+  hardware.enableAllFirmware = true;
+  nixpkgs.config.allowUnfree = true;
+
+  boot = {
+    loader.grub.enable = true;
+    loader.grub.version = 2;
+    loader.grub.device = "/dev/sda";
+
+    initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; } ];
+    initrd.luks.cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
+    initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
+    #kernelModules = [ "kvm-intel" "msr" ];
+    kernelModules = [ "msr" ];
+  };
+  fileSystems = {
+    "/" = {
+      device = "/dev/pool/nix";
+      fsType = "ext4";
+    };
+
+    "/boot" = {
+      device = "/dev/sda1";
+    };
+  };
+
+  #services.udev.extraRules = ''
+  #  SUBSYSTEM=="net", ATTR{address}=="64:27:37:7d:d8:ae", NAME="wl0"
+  #  SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:b8:c8:2e", NAME="et0"
+  #'';
+
+  services.xserver = {
+    videoDriver = "intel";
+    vaapiDrivers = [ pkgs.vaapiIntel ];
+    deviceSection = ''
+      Option "AccelMethod" "sna"
+      BusID "PCI:0:2:0"
+    '';
+  };
+
+  services.xserver.synaptics = {
+    enable = true;
+    twoFingerScroll = true;
+    accelFactor = "0.035";
+    additionalOptions = ''
+      Option "FingerHigh" "60"
+      Option "FingerLow"  "60"
+    '';
+  };
+}
diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index 61f57f1f..ebce9395 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -17,7 +17,6 @@
     #../2configs/ircd.nix
     ../2configs/chromium-patched.nix
     ../2configs/git.nix
-    ../2configs/retiolum.nix
     #../2configs/wordpress.nix
     ../2configs/bitlbee.nix
     ../2configs/firefoxPatched.nix
@@ -25,6 +24,7 @@
     ../2configs/teamviewer.nix
     ../2configs/libvirt.nix
     ../2configs/fetchWallpaper.nix
+    ../2configs/buildbot-standalone.nix
     {
       #risk of rain port
       krebs.iptables.tables.filter.INPUT.rules = [
@@ -32,51 +32,70 @@
       ];
     }
     {
-      #wordpress-test
-      #imports = singleton (sitesGenerators.createWordpress "testserver.de");
+      #static-nginx-test
       imports = [
-        ../3modules/wordpress_nginx.nix
+        ../3modules/static_nginx.nix
       ];
-      lass.wordpress."testserver.de" = {
-        multiSite = {
-          "1" = "testserver.de";
-          "2" = "bla.testserver.de";
+      lass.staticPage."testserver.de" = {
+        #sslEnable = true;
+        #certificate = "${toString <secrets>}/testserver.de/server.cert";
+        #certificate_key = "${toString <secrets>}/testserver.de/server.pem";
+        ssl = {
+          enable = true;
+          certificate = "${toString <secrets>}/testserver.de/server.cert";
+          certificate_key = "${toString <secrets>}/testserver.de/server.pem";
         };
       };
-
-      services.mysql = {
-        enable = true;
-        package = pkgs.mariadb;
-        rootPassword = "<secrets>/mysql_rootPassword";
-      };
       networking.extraHosts = ''
         10.243.0.2 testserver.de
       '';
-      krebs.iptables.tables.filter.INPUT.rules = [
-        { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; precedence = 9998; }
-      ];
     }
-    {
-      #owncloud-test
-      #imports = singleton (sitesGenerators.createWordpress "testserver.de");
-      imports = [
-        ../3modules/owncloud_nginx.nix
-      ];
-      lass.owncloud."owncloud-test.de" = {
-      };
+    #{
+    #  #wordpress-test
+    #  #imports = singleton (sitesGenerators.createWordpress "testserver.de");
+    #  imports = [
+    #    ../3modules/wordpress_nginx.nix
+    #  ];
+    #  lass.wordpress."testserver.de" = {
+    #    multiSite = {
+    #      "1" = "testserver.de";
+    #      "2" = "bla.testserver.de";
+    #    };
+    #  };
 
-      #services.mysql = {
-      #  enable = true;
-      #  package = pkgs.mariadb;
-      #  rootPassword = "<secrets>/mysql_rootPassword";
-      #};
-      networking.extraHosts = ''
-        10.243.0.2 owncloud-test.de
-      '';
-      krebs.iptables.tables.filter.INPUT.rules = [
-        { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; precedence = 9998; }
-      ];
-    }
+    #  services.mysql = {
+    #    enable = true;
+    #    package = pkgs.mariadb;
+    #    rootPassword = "<secrets>/mysql_rootPassword";
+    #  };
+    #  networking.extraHosts = ''
+    #    10.243.0.2 testserver.de
+    #  '';
+    #  krebs.iptables.tables.filter.INPUT.rules = [
+    #    { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; precedence = 9998; }
+    #  ];
+    #}
+    #{
+    #  #owncloud-test
+    #  #imports = singleton (sitesGenerators.createWordpress "testserver.de");
+    #  imports = [
+    #    ../3modules/owncloud_nginx.nix
+    #  ];
+    #  lass.owncloud."owncloud-test.de" = {
+    #  };
+
+    #  #services.mysql = {
+    #  #  enable = true;
+    #  #  package = pkgs.mariadb;
+    #  #  rootPassword = "<secrets>/mysql_rootPassword";
+    #  #};
+    #  networking.extraHosts = ''
+    #    10.243.0.2 owncloud-test.de
+    #  '';
+    #  krebs.iptables.tables.filter.INPUT.rules = [
+    #    { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; precedence = 9998; }
+    #  ];
+    #}
   ];
 
   krebs.build.host = config.krebs.hosts.mors;
@@ -207,7 +226,7 @@
   };
 
   environment.systemPackages = with pkgs; [
-    cac
+    cac-api
     sshpass
     get
     teamspeak_client
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index 1b008cbf..d53e783d 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -13,6 +13,7 @@ with builtins;
     ../2configs/retiolum.nix
     ../2configs/bitlbee.nix
     ../2configs/weechat.nix
+    ../2configs/skype.nix
     {
       users.extraUsers = {
         root = {
diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 66e12b26..4c73fc0c 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -17,7 +17,8 @@ with lib;
         root = {
           openssh.authorizedKeys.keys = [
             config.krebs.users.lass.pubkey
-            config.krebs.users.uriel.pubkey
+            config.krebs.users.lass-uriel.pubkey
+            config.krebs.users.lass-helios.pubkey
           ];
         };
         mainUser = {
@@ -31,7 +32,7 @@ with lib;
           ];
           openssh.authorizedKeys.keys = [
             config.krebs.users.lass.pubkey
-            config.krebs.users.uriel.pubkey
+            config.krebs.users.lass-uriel.pubkey
           ];
         };
       };
@@ -47,20 +48,21 @@ with lib;
     exim-retiolum.enable = true;
     build = {
       user = config.krebs.users.lass;
-      source = {
-        git.nixpkgs = {
+      source = mapAttrs (_: mkDefault) ({
+        nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix";
+        nixpkgs = symlink:stockholm/nixpkgs;
+        secrets = "/home/lass/secrets/${config.krebs.build.host.name}";
+        #secrets-common = "/home/lass/secrets/common";
+        stockholm = "/home/lass/stockholm";
+        stockholm-user = "symlink:stockholm/lass";
+        upstream-nixpkgs = {
           url = https://github.com/Lassulus/nixpkgs;
-          rev = "93d8671e2c6d1d25f126ed30e5e6f16764330119";
+          rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
+          dev = "/home/lass/src/nixpkgs";
         };
-        dir.secrets = {
-          host = config.krebs.hosts.mors;
-          path = "/home/lass/secrets/${config.krebs.build.host.name}";
-        };
-        dir.stockholm = {
-          host = config.krebs.hosts.mors;
-          path = "/home/lass/stockholm";
-        };
-      };
+      } // optionalAttrs config.krebs.build.host.secure {
+        #secrets-master = "/home/lass/secrets/master";
+      });
     };
   };
 
@@ -89,6 +91,7 @@ with lib;
     git
     jq
     parallel
+    proot
 
   #style
     most
@@ -176,4 +179,10 @@ with lib;
     noipv4ll
   '';
 
+  #CVE-2016-0777 and CVE-2016-0778 workaround
+  #https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt
+  programs.ssh.extraConfig = ''
+    UseRoaming no
+  '';
+
 }
diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix
index 0596682d..ede1c7b7 100644
--- a/lass/2configs/baseX.nix
+++ b/lass/2configs/baseX.nix
@@ -31,6 +31,7 @@ in {
 
   environment.systemPackages = with pkgs; [
 
+    dmenu
     gitAndTools.qgit
     mpv
     much
diff --git a/lass/2configs/bitcoin.nix b/lass/2configs/bitcoin.nix
index d3bccbf5..2f4cd571 100644
--- a/lass/2configs/bitcoin.nix
+++ b/lass/2configs/bitcoin.nix
@@ -1,6 +1,8 @@
 { config, pkgs, ... }:
 
-{
+let
+  mainUser = config.users.extraUsers.mainUser;
+in {
   environment.systemPackages = with pkgs; [
     electrum
   ];
@@ -14,4 +16,7 @@
       createHome = true;
     };
   };
+  security.sudo.extraConfig = ''
+    ${mainUser.name} ALL=(bitcoin) NOPASSWD: ALL
+  '';
 }
diff --git a/lass/2configs/browsers.nix b/lass/2configs/browsers.nix
index d3680186..61016fed 100644
--- a/lass/2configs/browsers.nix
+++ b/lass/2configs/browsers.nix
@@ -54,8 +54,6 @@ in {
   ];
 
   imports = [
-    ../3modules/per-user.nix
-  ] ++ [
     ( createFirefoxUser "ff" [ "audio" ] [ ] )
     ( createChromiumUser "cr" [ "audio" ] [ pkgs.chromium ] )
     ( createChromiumUser "fb" [ ] [ pkgs.chromium ] )
diff --git a/lass/2configs/buildbot-standalone.nix b/lass/2configs/buildbot-standalone.nix
new file mode 100644
index 00000000..8c71553f
--- /dev/null
+++ b/lass/2configs/buildbot-standalone.nix
@@ -0,0 +1,78 @@
+{ lib, config, pkgs, ... }:
+{
+  #networking.firewall.allowedTCPPorts = [ 8010 9989 ];
+  krebs.buildbot.master = {
+    slaves = {
+      testslave = "lasspass";
+    };
+    change_source.stockholm = ''
+      stockholm_repo = 'http://cgit.mors/stockholm'
+      cs.append(changes.GitPoller(
+              stockholm_repo,
+              workdir='stockholm-poller', branch='master',
+              project='stockholm',
+              pollinterval=120))
+    '';
+    scheduler = {
+      force-scheduler = ''
+        sched.append(schedulers.ForceScheduler(
+                                    name="force",
+                                    builderNames=["fast-tests"]))
+      '';
+      fast-tests-scheduler = ''
+        # test the master real quick
+        sched.append(schedulers.SingleBranchScheduler(
+                                    change_filter=util.ChangeFilter(branch="master"),
+                                    name="fast-master-test",
+                                    builderNames=["fast-tests"]))
+      '';
+    };
+    builder_pre = ''
+      # prepare grab_repo step for stockholm
+      grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental')
+
+      env = {"LOGNAME": "lass", "NIX_REMOTE": "daemon"}
+
+      # prepare nix-shell
+      # the dependencies which are used by the test script
+      deps = [ "gnumake", "jq","nix","rsync" ]
+      # TODO: --pure , prepare ENV in nix-shell command:
+      #                   SSL_CERT_FILE,LOGNAME,NIX_REMOTE
+      nixshell = ["nix-shell", "-I", "stockholm=.", "-p" ] + deps + [ "--run" ]
+
+      # prepare addShell function
+      def addShell(factory,**kwargs):
+        factory.addStep(steps.ShellCommand(**kwargs))
+    '';
+    builder = {
+      fast-tests = ''
+        f = util.BuildFactory()
+        f.addStep(grab_repo)
+        addShell(f,name="mors-eval",env=env,
+                  command=nixshell + ["make -s eval get=krebs.deploy filter=json system=mors"])
+
+        bu.append(util.BuilderConfig(name="fast-tests",
+              slavenames=slavenames,
+              factory=f))
+      '';
+    };
+    enable = true;
+    web.enable = true;
+    irc = {
+      enable = true;
+      nick = "buildbot-lass";
+      server = "cd.retiolum";
+      channels = [ "retiolum" ];
+      allowForce = true;
+    };
+  };
+
+  krebs.buildbot.slave = {
+    enable = true;
+    masterhost = "localhost";
+    username = "testslave";
+    password = "lasspass";
+    packages = with pkgs;[ git nix ];
+    extraEnviron = { NIX_PATH="nixpkgs=${toString <nixpkgs>}"; };
+  };
+}
diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index 16ecaefe..ac6aae44 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -69,12 +69,12 @@ let
     with git // config.krebs.users;
     repo:
       singleton {
-        user = lass;
+        user = [ lass lass-helios lass-uriel ];
         repo = [ repo ];
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
       optional repo.public {
-        user = [ tv makefu uriel ];
+        user = [ tv makefu miefda ];
         repo = [ repo ];
         perm = fetch;
       } ++
diff --git a/lass/2configs/newsbot-js.nix b/lass/2configs/newsbot-js.nix
index 74d09b7f..4482c4e9 100644
--- a/lass/2configs/newsbot-js.nix
+++ b/lass/2configs/newsbot-js.nix
@@ -161,7 +161,7 @@ let
     torrentfreak|http://feeds.feedburner.com/Torrentfreak|#news
     torr_news|http://feed.torrentfreak.com/Torrentfreak/|#news
     travel_warnings|http://feeds.travel.state.gov/ca/travelwarnings-alerts|#news
-    truther|http://truthernews.wordpress.com/feed/|#news
+    #truther|http://truthernews.wordpress.com/feed/|#news
     un_afr|http://www.un.org/apps/news/rss/rss_africa.asp|#news
     un_am|http://www.un.org/apps/news/rss/rss_americas.asp|#news
     un_eu|http://www.un.org/apps/news/rss/rss_europe.asp|#news
diff --git a/lass/2configs/websites/fritz.nix b/lass/2configs/websites/fritz.nix
new file mode 100644
index 00000000..073f3de1
--- /dev/null
+++ b/lass/2configs/websites/fritz.nix
@@ -0,0 +1,33 @@
+{ config, pkgs, ... }:
+
+{
+
+  imports = [
+    ../../3modules/static_nginx.nix
+    ../../3modules/owncloud_nginx.nix
+    ../../3modules/wordpress_nginx.nix
+  ];
+
+  lass.staticPage = {
+    "biostase.de" = {};
+    "gs-maubach.de" = {};
+    "spielwaren-kern.de" = {};
+    "societyofsimtech.de" = {};
+    "ttf-kleinaspach.de" = {};
+    "edsn.de" = {};
+    "eab.berkeley.edu" = {};
+    "habsys.de" = {};
+  };
+
+  #lass.owncloud = {
+  #  "o.ubikmedia.de" = {
+  #    instanceid = "oc8n8ddbftgh";
+  #  };
+  #};
+
+  #services.mysql = {
+  #  enable = true;
+  #  package = pkgs.mariadb;
+  #  rootPassword = toString (<secrets/mysql_rootPassword>);
+  #};
+}
diff --git a/lass/2configs/websites/wohnprojekt-rhh.de.nix b/lass/2configs/websites/wohnprojekt-rhh.de.nix
index cd31450c..ac784d4c 100644
--- a/lass/2configs/websites/wohnprojekt-rhh.de.nix
+++ b/lass/2configs/websites/wohnprojekt-rhh.de.nix
@@ -8,5 +8,11 @@
   lass.staticPage = {
     "wohnprojekt-rhh.de" = {};
   };
+
+  users.users.laura = {
+    home = "/srv/http/wohnprojekt-rhh.de";
+    createHome = true;
+    useDefaultShell = true;
+  };
 }
 
diff --git a/lass/2configs/xserver/default.nix b/lass/2configs/xserver/default.nix
index 04d14c7c..c407bb59 100644
--- a/lass/2configs/xserver/default.nix
+++ b/lass/2configs/xserver/default.nix
@@ -44,7 +44,7 @@ let
       "slock"
     ];
 
-    systemd.services.display-manager = mkForce {};
+    systemd.services.display-manager.enable = false;
 
     services.xserver.enable = true;
 
@@ -93,9 +93,11 @@ let
   xmonad-start = pkgs.writeScriptBin "xmonad" ''
     #! ${pkgs.bash}/bin/bash
     set -efu
-    export PATH; PATH=${makeSearchPath "bin" ([
+    export PATH; PATH=${makeSearchPath "bin" [
+      pkgs.alsaUtils
+      pkgs.pulseaudioLight
       pkgs.rxvt_unicode
-    ] ++ config.environment.systemPackages)}:/var/setuid-wrappers
+    ]}:/var/setuid-wrappers
     settle() {(
       # Use PATH for a clean journal
       command=''${1##*/}
diff --git a/lass/3modules/owncloud_nginx.nix b/lass/3modules/owncloud_nginx.nix
index 0cb11846..79c9de1d 100644
--- a/lass/3modules/owncloud_nginx.nix
+++ b/lass/3modules/owncloud_nginx.nix
@@ -46,8 +46,22 @@ let
           type = str;
         };
         ssl = mkOption {
-          type = bool;
-          default = false;
+          type = with types; submodule ({
+            options = {
+              enable = mkEnableOption "ssl";
+              certificate = mkOption {
+                type = str;
+              };
+              certificate_key = mkOption {
+                type = str;
+              };
+              ciphers = mkOption {
+                type = str;
+                default = "AES128+EECDH:AES128+EDH";
+              };
+            };
+          });
+          default = {};
         };
       };
     }));
@@ -58,7 +72,7 @@ let
   group = config.services.nginx.group;
 
   imp = {
-    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ... }: {
+    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ssl, ... }: {
       server-names = [
         "${domain}"
         "www.${domain}"
@@ -102,7 +116,16 @@ let
 
         error_page 403 /core/templates/403.php;
         error_page 404 /core/templates/404.php;
+        ${if ssl.enable then ''
+          ssl_certificate ${ssl.certificate};
+          ssl_certificate_key ${ssl.certificate_key};
+        '' else ""}
       '';
+      listen = (if ssl.enable then
+          [ "80" "443 ssl" ]
+        else
+          "80"
+      );
     });
     services.phpfpm.poolConfigs = flip mapAttrs cfg (name: { domain, folder, ... }: ''
       listen = ${folder}/phpfpm.pool
diff --git a/lass/3modules/static_nginx.nix b/lass/3modules/static_nginx.nix
index cc2641af..fd5cfdfd 100644
--- a/lass/3modules/static_nginx.nix
+++ b/lass/3modules/static_nginx.nix
@@ -21,6 +21,35 @@ let
           type = str;
           default = "/srv/http/${config.domain}";
         };
+        #sslEnable = mkEnableOption "ssl";
+        #certificate = mkOption {
+        #  type = str;
+        #};
+        #certificate_key = mkOption {
+        #  type = str;
+        #};
+        #ciphers = mkOption {
+        #  type = str;
+        #  default = "AES128+EECDH:AES128+EDH";
+        #};
+        ssl = mkOption {
+          type = with types; submodule ({
+            options = {
+              enable = mkEnableOption "ssl";
+              certificate = mkOption {
+                type = str;
+              };
+              certificate_key = mkOption {
+                type = str;
+              };
+              ciphers = mkOption {
+                type = str;
+                default = "AES128+EECDH:AES128+EDH";
+              };
+            };
+          });
+          default = {};
+        };
       };
     }));
     default = {};
@@ -29,8 +58,10 @@ let
   user = config.services.nginx.user;
   group = config.services.nginx.group;
 
+  external-ip = head config.krebs.build.host.nets.internet.addrs4;
+
   imp = {
-    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ... }: {
+    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, ssl, ... }: {
       server-names = [
         "${domain}"
         "www.${domain}"
@@ -43,6 +74,17 @@ let
           deny all;
         '')
       ];
+
+      listen = (if ssl.enable then
+          [ "80" "443 ssl" ]
+        else
+          "80"
+      );
+      extraConfig = (if ssl.enable then ''
+        ssl_certificate ${ssl.certificate};
+        ssl_certificate_key ${ssl.certificate_key};
+      '' else "");
+
     });
   };
 
diff --git a/lass/3modules/wordpress_nginx.nix b/lass/3modules/wordpress_nginx.nix
index 974aacd8..bfed9e7c 100644
--- a/lass/3modules/wordpress_nginx.nix
+++ b/lass/3modules/wordpress_nginx.nix
@@ -53,6 +53,23 @@ let
             "1" = "test.testsite.de";
           };
         };
+        ssl = mkOption {
+          type = with types; submodule ({
+            options = {
+              enable = mkEnableOption "ssl";
+              certificate = mkOption {
+                type = str;
+              };
+              certificate_key = mkOption {
+                type = str;
+              };
+              ciphers = mkOption {
+                type = str;
+                default = "AES128+EECDH:AES128+EDH";
+              };
+            };
+          });
+        };
       };
     }));
     default = {};
@@ -68,7 +85,7 @@ let
     #  }
     #'';
 
-    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, multiSite, ... }: {
+    krebs.nginx.servers = flip mapAttrs cfg ( name: { domain, folder, multiSite, ssl, ... }: {
       server-names = [
         "${domain}"
         "www.${domain}"
@@ -114,7 +131,17 @@ let
         error_log /tmp/nginx_err.log;
         error_page 404 /404.html;
         error_page 500 502 503 504 /50x.html;
+        ${if ssl.enable then ''
+          ssl_certificate ${ssl.certificate};
+          ssl_certificate_key ${ssl.certificate_key};
+        '' else ""}
+
       '';
+      listen = (if ssl.enable then
+          [ "80" "443 ssl" ]
+        else
+          "80"
+      );
     });
     services.phpfpm.poolConfigs = flip mapAttrs cfg (name: { domain, folder, ... }: ''
       listen = ${folder}/phpfpm.pool