Merge remote-tracking branch 'lass/master'

34 files changed, 973 insertions, 387 deletions

diff --git a/lass/1systems/coaxmetal/config.nix b/lass/1systems/coaxmetal/config.nix
index dd8308bbd..2c88b68cc 100644
--- a/lass/1systems/coaxmetal/config.nix
+++ b/lass/1systems/coaxmetal/config.nix
@@ -16,7 +16,7 @@
     <stockholm/lass/2configs/steam.nix>
     <stockholm/lass/2configs/wine.nix>
     <stockholm/lass/2configs/fetchWallpaper.nix>
-    <stockholm/lass/2configs/prism-mounts/samba.nix>
+    <stockholm/lass/2configs/yellow-mounts/samba.nix>
     <stockholm/lass/2configs/pass.nix>
     <stockholm/lass/2configs/mail.nix>
     <stockholm/lass/2configs/bitcoin.nix>
diff --git a/lass/1systems/green/config.nix b/lass/1systems/green/config.nix
index 4c98091f1..cd38c3585 100644
--- a/lass/1systems/green/config.nix
+++ b/lass/1systems/green/config.nix
@@ -57,7 +57,7 @@ with import <stockholm/lib>;
   ];
 
   krebs.iptables.tables.nat.PREROUTING.rules = [
-    { predicate = "-i eth0 -p tcp -m tcp --dport 22"; target = "ACCEPT"; precedence = 101; }
+    { predicate = "-i eth0 -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
   ];
 
   # workaround for ssh access from yubikey via android
diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index dd479f267..6d0d177ec 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -41,6 +41,7 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/ppp/umts-stick.nix>
     # <stockholm/lass/2configs/remote-builder/morpheus.nix>
     # <stockholm/lass/2configs/remote-builder/prism.nix>
+    <stockholm/lass/2configs/autotether.nix>
     {
       krebs.iptables.tables.filter.INPUT.rules = [
         #risk of rain
diff --git a/lass/1systems/neoprism/config.nix b/lass/1systems/neoprism/config.nix
new file mode 100644
index 000000000..8e5a60c36
--- /dev/null
+++ b/lass/1systems/neoprism/config.nix
@@ -0,0 +1,18 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    <stockholm/lass>
+    <stockholm/lass/2configs/retiolum.nix>
+
+    # sync-containers
+    <stockholm/lass/2configs/consul.nix>
+    <stockholm/lass/2configs/yellow-host.nix>
+    <stockholm/lass/2configs/radio/container-host.nix>
+
+    # other containers
+    <stockholm/lass/2configs/riot.nix>
+  ];
+
+  krebs.build.host = config.krebs.hosts.neoprism;
+}
diff --git a/lass/1systems/neoprism/disk.nix b/lass/1systems/neoprism/disk.nix
new file mode 100644
index 000000000..cf9a8cef4
--- /dev/null
+++ b/lass/1systems/neoprism/disk.nix
@@ -0,0 +1,116 @@
+{ lib, ... }:
+{
+  disk = (lib.genAttrs [ "/dev/nvme0n1" "/dev/nvme1n1" ] (disk: {
+    type = "disk";
+    device = disk;
+    content = {
+      type = "table";
+      format = "gpt";
+      partitions = [
+        {
+          name = "boot";
+          type = "partition";
+          start = "0";
+          end = "1M";
+          part-type = "primary";
+          flags = ["bios_grub"];
+        }
+        {
+          type = "partition";
+          name = "ESP";
+          start = "1M";
+          end = "1GiB";
+          fs-type = "fat32";
+          bootable = true;
+          content = {
+            type = "mdraid";
+            name = "boot";
+          };
+        }
+        {
+          type = "partition";
+          name = "zfs";
+          start = "1GiB";
+          end = "100%";
+          content = {
+            type = "zfs";
+            pool = "zroot";
+          };
+        }
+      ];
+    };
+  })) // {
+    hdd1 = {
+      type = "disk";
+      device = "/dev/sda";
+      content = {
+        type = "zfs";
+        pool = "tank";
+      };
+    };
+  };
+  mdadm = {
+    boot = {
+      type = "mdadm";
+      level = 1;
+      metadata = "1.0";
+      content = {
+        type = "filesystem";
+        format = "vfat";
+        mountpoint = "/boot";
+      };
+    };
+  };
+  zpool = {
+    zroot = {
+      type = "zpool";
+      mode = "mirror";
+      mountpoint = "/";
+      rootFsOptions = {
+      };
+      datasets.reserved = {
+        zfs_type = "filesystem";
+        options.refreservation = "1G";
+      };
+    };
+    tank = {
+      type = "zpool";
+      datasets = {
+        reserved = {
+          zfs_type = "filesystem";
+          options.refreservation = "1G";
+        };
+        containers = {
+          zfs_type = "filesystem";
+          mountpoint = "/var/lib/containers";
+        };
+        home = {
+          zfs_type = "filesystem";
+          mountpoint = "/home";
+        };
+        srv = {
+          zfs_type = "filesystem";
+          mountpoint = "/srv";
+        };
+        libvirt = {
+          zfs_type = "filesystem";
+          mountpoint = "/var/lib/libvirt";
+        };
+        # encrypted = {
+        #   zfs_type = "filesystem";
+        #   options = {
+        #     mountpoint = "none";
+        #     encryption = "aes-256-gcm";
+        #     keyformat = "passphrase";
+        #     keylocation = "prompt";
+        #   };
+        # };
+
+        # "encrypted/download" = {
+        #   zfs_type = "filesystem";
+        #   mountpoint = "/var/download";
+        # };
+      };
+    };
+  };
+}
diff --git a/lass/1systems/neoprism/physical.nix b/lass/1systems/neoprism/physical.nix
new file mode 100644
index 000000000..4ffb749f1
--- /dev/null
+++ b/lass/1systems/neoprism/physical.nix
@@ -0,0 +1,42 @@
+{ config, lib, pkgs, ... }:
+
+{
+
+  imports = [
+    ./config.nix
+    <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
+  ];
+
+  disko.devices = import ./disk.nix;
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.efiSupport = true;
+  boot.loader.grub.devices = [ "/dev/nvme0n1" "/dev/nvme1n1" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "sd_mod" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  # networking config
+  boot.kernelParams = [ "net.ifnames=0" ];
+  networking.bridges."ext-br".interfaces = [ "eth0" ];
+  networking = {
+    hostId = "2283aaae";
+    defaultGateway = "95.217.192.1";
+    defaultGateway6 = { address = "fe80::1"; interface = "ext-br"; };
+    # Use google's public DNS server
+    nameservers = [ "8.8.8.8" ];
+    interfaces.ext-br.ipv4.addresses = [
+      {
+        address = "95.217.192.59";
+        prefixLength = 26;
+      }
+    ];
+    interfaces.ext-br.ipv6.addresses = [
+      {
+        address = "2a01:4f9:4a:4f1a::1";
+        prefixLength = 64;
+      }
+    ];
+  };
+
+}
diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index 594a21c02..bcc8c1a08 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -33,9 +33,9 @@ with import <stockholm/lib>;
           "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
         ];
       };
-      krebs.iptables.tables.filter.FORWARD.rules = [
-        { v6 = false; precedence = 1000; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; }
-        { v6 = false; precedence = 1000; predicate = "--source 95.216.1.130"; target = "ACCEPT"; }
+      krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
+        { v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; }
+        { v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; }
       ];
     }
     {
@@ -97,9 +97,35 @@ with import <stockholm/lib>;
         localAddress = "10.233.2.2";
       };
     }
+    {
+      services.nginx.virtualHosts."radio.lassul.us" = {
+        enableACME = true;
+        addSSL = true;
+        locations."/" = {
+          # recommendedProxySettings = true;
+          proxyWebsockets = true;
+          proxyPass = "http://radio.r";
+          extraConfig = ''
+            proxy_set_header Host radio.r;
+            # get source ip for weather reports
+            proxy_set_header user-agent "$http_user_agent; client-ip=$remote_addr";
+          '';
+        };
+      };
+      krebs.htgen.radio-redirect = {
+        port = 8000;
+        scriptFile = pkgs.writers.writeDash "redir" ''
+          printf 'HTTP/1.1 301 Moved Permanently\r\n'
+          printf "Location: http://radio.lassul.us''${Request_URI}\r\n"
+          printf '\r\n'
+        '';
+      };
+      krebs.iptables.tables.filter.INPUT.rules = [
+        { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; }
+      ];
+    }
     <stockholm/lass/2configs/exim-smarthost.nix>
     <stockholm/lass/2configs/privoxy-retiolum.nix>
-    <stockholm/lass/2configs/radio>
     <stockholm/lass/2configs/binary-cache/server.nix>
     <stockholm/lass/2configs/iodined.nix>
     <stockholm/lass/2configs/paste.nix>
@@ -227,13 +253,13 @@ with import <stockholm/lib>;
       imports = [
         <stockholm/lass/2configs/wiregrill.nix>
       ];
-      krebs.iptables.tables.nat.PREROUTING.rules = [
-        { v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; }
-        { v4 = false; precedence = 1000; predicate = "-s 42:1::/32"; target = "ACCEPT"; }
+      krebs.iptables.tables.nat.PREROUTING.rules = mkOrder 999 [
+        { v6 = false; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; }
+        { v4 = false; predicate = "-s 42:1::/32"; target = "ACCEPT"; }
       ];
-      krebs.iptables.tables.filter.FORWARD.rules = [
-        { precedence = 1000; predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
-        { precedence = 1000; predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
+      krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
+        { predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
+        { predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
       ];
       krebs.iptables.tables.nat.POSTROUTING.rules = [
         { v4 = false; predicate = "-s 42:1::/32 ! -d 42:1::/48"; target = "MASQUERADE"; }
@@ -252,7 +278,7 @@ with import <stockholm/lib>;
     }
     {
       krebs.iptables.tables.filter.INPUT.rules = [
-        { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT";}
+        { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; }
       ];
     }
     <stockholm/lass/2configs/murmur.nix>
diff --git a/lass/1systems/radio/config.nix b/lass/1systems/radio/config.nix
new file mode 100644
index 000000000..2fd23a448
--- /dev/null
+++ b/lass/1systems/radio/config.nix
@@ -0,0 +1,24 @@
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    <stockholm/lass>
+    <stockholm/lass/2configs>
+    <stockholm/lass/2configs/retiolum.nix>
+
+    <stockholm/lass/2configs/syncthing.nix>
+    <stockholm/lass/2configs/radio>
+  ];
+
+  krebs.build.host = config.krebs.hosts.radio;
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "acme@lassul.us";
+  };
+
+  lass.sync-containers3.inContainer = {
+    enable = true;
+    pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvPKdbVwMEFCDMyNAzR8NdVjTbQL2G+03Xomxn6KKFt";
+  };
+}
diff --git a/lass/1systems/radio/physical.nix b/lass/1systems/radio/physical.nix
new file mode 100644
index 000000000..8577daf34
--- /dev/null
+++ b/lass/1systems/radio/physical.nix
@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./config.nix
+  ];
+  boot.isContainer = true;
+  networking.useDHCP = true;
+}
diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix
index ef538f339..5e48c216a 100644
--- a/lass/1systems/shodan/config.nix
+++ b/lass/1systems/shodan/config.nix
@@ -16,7 +16,7 @@
     <stockholm/lass/2configs/blue-host.nix>
     <stockholm/lass/2configs/green-host.nix>
     <stockholm/krebs/2configs/news-host.nix>
-    <stockholm/lass/2configs/prism-mounts/samba.nix>
+    <stockholm/lass/2configs/yellow-mounts/samba.nix>
     <stockholm/lass/2configs/fetchWallpaper.nix>
     <stockholm/lass/2configs/consul.nix>
     <stockholm/lass/2configs/red-host.nix>
diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix
index c8077e5ea..06561e9cf 100644
--- a/lass/1systems/yellow/config.nix
+++ b/lass/1systems/yellow/config.nix
@@ -9,20 +9,23 @@ in {
 
   krebs.build.host = config.krebs.hosts.yellow;
 
+  lass.sync-containers3.inContainer = {
+    enable = true;
+    pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL";
+  };
+
   users.groups.download.members = [ "transmission" ];
 
   networking.useHostResolvConf = false;
   networking.useNetworkd = true;
-  systemd.services.transmission.bindsTo = [ "openvpn-nordvpn.service" ];
-  systemd.services.transmission.after = [ "openvpn-nordvpn.service" ];
   services.transmission = {
     enable = true;
+    home = "/var/state/transmission";
     group = "download";
     downloadDirPermissions = "775";
     settings = {
-      download-dir = "/var/download/finished";
-      incomplete-dir = "/var/download/incoming";
-      incomplete-dir-enable = true;
+      download-dir = "/var/download/transmission";
+      incomplete-dir-enabled = false;
       rpc-bind-address = "::";
       message-level = 1;
       umask = 18;
@@ -31,6 +34,12 @@ in {
     };
   };
 
+  security.acme.defaults.email = "spam@krebsco.de";
+  security.acme.acceptTerms = true;
+  security.acme.certs."yellow.r".server = config.krebs.ssl.acmeURL;
+  security.acme.certs."jelly.r".server = config.krebs.ssl.acmeURL;
+  security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL;
+  security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL;
   services.nginx = {
     enable = true;
     package = pkgs.nginx.override {
@@ -38,13 +47,12 @@ in {
         fancyindex
       ];
     };
-    virtualHosts.default = {
+    virtualHosts."yellow.r" = {
       default = true;
-      locations."/dl".extraConfig = ''
-        return 301 /;
-      '';
+      enableACME = true;
+      addSSL = true;
       locations."/" = {
-        root = "/var/download/finished";
+        root = "/var/download";
         extraConfig = ''
           fancyindex on;
           fancyindex_footer "/fancy.html";
@@ -136,9 +144,87 @@ in {
         ''};
       '';
     };
+    virtualHosts."jelly.r" = {
+      enableACME = true;
+      addSSL = true;
+      locations."/".extraConfig = ''
+        proxy_pass http://localhost:8096/;
+        proxy_set_header Accept-Encoding "";
+      '';
+    };
+    virtualHosts."radar.r" = {
+      enableACME = true;
+      addSSL = true;
+      locations."/" = {
+        proxyWebsockets = true;
+        proxyPass = "http://localhost:7878";
+      };
+    };
+    virtualHosts."sonar.r" = {
+      enableACME = true;
+      addSSL = true;
+      locations."/" = {
+        proxyWebsockets = true;
+        proxyPass = "http://localhost:8989";
+      };
+    };
   };
 
-  systemd.services.bruellwuerfel = {
+  services.samba = {
+    enable = true;
+    enableNmbd = false;
+    extraConfig = ''
+      workgroup = WORKGROUP
+      server string = ${config.networking.hostName}
+      # only allow retiolum addresses
+      hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16
+
+      # Use sendfile() for performance gain
+      use sendfile = true
+
+      # No NetBIOS is needed
+      disable netbios = true
+
+      # Only mangle non-valid NTFS names, don't care about DOS support
+      mangled names = illegal
+
+      # Performance optimizations
+      socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
+
+      # Disable all printing
+      load printers = false
+      disable spoolss = true
+      printcap name = /dev/null
+
+      map to guest = Bad User
+      max log size = 50
+      dns proxy = no
+      security = user
+
+      [global]
+      syslog only = yes
+    '';
+    shares.public = {
+      comment = "Warez";
+      path = "/var/download";
+      public = "yes";
+      "only guest" = "yes";
+      "create mask" = "0644";
+      "directory mask" = "2777";
+      writable = "no";
+      printable = "no";
+    };
+  };
+
+  systemd.services.bruellwuerfel =
+  let
+    bruellwuerfelSrc = pkgs.fetchFromGitHub {
+      owner = "krebs";
+      repo = "bruellwuerfel";
+      rev = "dc73adf69249fb63a4b024f1f3fbc9e541b27015";
+      sha256 = "078jp1gbavdp8lnwa09xa5m6bbbd05fi4x5ldkkgin5z04hwlhmd";
+    };
+  in {
     wantedBy = [ "multi-user.target" ];
     environment = {
       IRC_CHANNEL = "#flix";
@@ -147,7 +233,7 @@ in {
       IRC_HISTORY_FILE = "/tmp/bruelli.history";
     };
     serviceConfig = {
-      ExecStart = "${pkgs.bruellwuerfel}/bin/bruellwuerfel";
+      ExecStart = "${pkgs.deno}/bin/deno run -A ${bruellwuerfelSrc}/src/index.ts";
     };
   };
 
@@ -155,15 +241,36 @@ in {
     enable = true;
     tables.filter.INPUT.rules = [
       { predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir
+      { predicate = "-p tcp --dport 443"; target = "ACCEPT"; } # nginx web dir
       { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web
-      { predicate = "-p tcp --dport 9092"; target = "ACCEPT"; } # magnetico webinterface
       { predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
       { predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
       { predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin
+      { predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr
+      { predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr
+      { predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr
+      { predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr
+
+      # smbd
+      { predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; }
+      { predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; }
+      { predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; }
+      { predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; }
+      { predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; }
+      { predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; }
+      { predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; }
+      { predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; }
+      { predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; }
+      { predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; }
+      { predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; }
+      { predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; }
+      { predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; }
+      { predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; }
     ];
     tables.filter.OUTPUT = {
       policy = "DROP";
       rules = [
+        { predicate = "-o lo"; target = "ACCEPT"; }
         { v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; }
         { predicate = "-o tun0"; target = "ACCEPT"; }
         { predicate = "-o retiolum"; target = "ACCEPT"; }
@@ -271,7 +378,7 @@ in {
       ExecStart = pkgs.writers.writeDash "flix-index" ''
         set -efu
 
-        DIR=/var/download/finished
+        DIR=/var/download
         cd "$DIR"
         while inotifywait -rq -e create -e move -e delete "$DIR"; do
           find . -type f > "$DIR"/index.tmp
@@ -286,9 +393,22 @@ in {
     group = "download";
   };
 
-  services.magnetico = {
+  services.radarr = {
+    enable = true;
+    group = "download";
+  };
+
+  services.sonarr = {
+    enable = true;
+    group = "download";
+  };
+
+  services.prowlarr = {
     enable = true;
-    web.address = "0.0.0.0";
-    web.port = 9092;
+  };
+
+  services.bazarr = {
+    enable = true;
+    group = "download";
   };
 }
diff --git a/lass/2configs/AP.nix b/lass/2configs/AP.nix
index dfffbfdf9..e38475381 100644
--- a/lass/2configs/AP.nix
+++ b/lass/2configs/AP.nix
@@ -68,8 +68,8 @@ in {
     { v6 = false; predicate = "-o br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
     { v6 = false; predicate = "-i br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
   ];
-  krebs.iptables.tables.nat.PREROUTING.rules = [
-    { v6 = false; predicate = "-s 10.99.0.0/24"; target = "ACCEPT"; precedence = 1000; }
+  krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
+    { v6 = false; predicate = "-s 10.99.0.0/24"; target = "ACCEPT"; }
   ];
   krebs.iptables.tables.nat.POSTROUTING.rules = [
     #TODO find out what this is about?
diff --git a/lass/2configs/autotether.nix b/lass/2configs/autotether.nix
new file mode 100644
index 000000000..98712303e
--- /dev/null
+++ b/lass/2configs/autotether.nix
@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+{
+  systemd.services.usb_tether = {
+    script = ''
+      ${pkgs.android-tools}/bin/adb -s QV770FAMEK wait-for-device
+      ${pkgs.android-tools}/bin/adb -s QV770FAMEK shell svc usb setFunctions rndis
+    '';
+  };
+  services.udev.extraRules = ''
+    ACTION=="add", SUBSYSTEM=="usb", ENV{PRODUCT}=="fce/320d/510", TAG+="systemd", ENV{SYSTEMD_WANTS}="usb_tether.service"
+  '';
+  systemd.network.networks.android = {
+    matchConfig.Name = "enp0s20u1";
+    DHCP = "yes";
+  };
+}
diff --git a/lass/2configs/c-base.nix b/lass/2configs/c-base.nix
index 3e533fb74..a8dd3dd1d 100644
--- a/lass/2configs/c-base.nix
+++ b/lass/2configs/c-base.nix
@@ -1,97 +1,115 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (import <stockholm/lib>) genid;
-
 in {
 
-  users.extraUsers = {
-    cbasevpn = rec {
-      name = "cbasevpn";
-      uid = genid "cbasevpn";
-      description = "user for running c-base openvpn";
-      home = "/home/${name}";
-    };
-  };
-
-  users.extraGroups.cbasevpn.gid = genid "cbasevpn";
-
   environment.systemPackages = [
     pkgs.cifs-utils
   ];
 
-  services.openvpn.servers = {
-    c-base = {
-      config = ''
-        client
-        dev tap
-        proto tcp
-        remote vpn.ext.c-base.org 1194
-        resolv-retry infinite
-        nobind
-        user cbasevpn
-        group cbasevpn
-        persist-key
-        persist-tun
-
-        auth-nocache
-        #auth-user-pass
-        auth-user-pass ${toString <secrets/cbase.txt>}
-
-        comp-lzo
-        verb 3
-
-        #script-security 2
-        #up /etc/openvpn/update-resolv-conf
-        #down /etc/openvpn/update-resolv-conf
-
-        <ca>
-        -----BEGIN CERTIFICATE-----
-        MIIDUjCCArugAwIBAgIJAOOk8EXgjsf5MA0GCSqGSIb3DQEBBQUAMHoxCzAJBgNV
-        BAYTAkRFMQswCQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGluMQ8wDQYDVQQKEwZj
-        LWJhc2UxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJ
-        ARYQYWRtYXhAYy1iYXNlLm9yZzAeFw0wOTAyMTMwOTE1MzdaFw0xOTAyMTEwOTE1
-        MzdaMHoxCzAJBgNVBAYTAkRFMQswCQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGlu
-        MQ8wDQYDVQQKEwZjLWJhc2UxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEf
-        MB0GCSqGSIb3DQEJARYQYWRtYXhAYy1iYXNlLm9yZzCBnzANBgkqhkiG9w0BAQEF
-        AAOBjQAwgYkCgYEAt3wEgXbqFKxs8z/E4rv13hkRi6J+QdshNzntm7rTOmUsXKE7
-        IEwoJSglrmsDPv4UqE86A7bjW7YYSFjhzxFRkTEHJanyOCF48ZPItVl7Eq7T81co
-        uR+6lAhxnLDrwnPJCC83NzAa6lw8U1DsQRDkayKlrQrtZq6++pFFEvZvt1cCAwEA
-        AaOB3zCB3DAdBgNVHQ4EFgQUqkSbdXS90+HtqXDeAI+PcyTSSHEwgawGA1UdIwSB
-        pDCBoYAUqkSbdXS90+HtqXDeAI+PcyTSSHGhfqR8MHoxCzAJBgNVBAYTAkRFMQsw
-        CQYDVQQIEwJERTEPMA0GA1UEBxMGQmVybGluMQ8wDQYDVQQKEwZjLWJhc2UxGzAZ
-        BgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJARYQYWRtYXhA
-        Yy1iYXNlLm9yZ4IJAOOk8EXgjsf5MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF
-        BQADgYEAOBANG1H4uEEWk3sbeQoSMeA3LFG1+6MgFGk2WAdeHYuV9GKYBq6/PLP5
-        ffw+FNkiDjLSeSQO88vHYJr2V1v8n/ZoCIT+1VBcDWXTpGz0YxDI1iBauO3tUPzK
-        wGs46RA/S0YwiZw64MaUHd88ZVadjKy9kNoO3w6/vpAS6s/Mh+o=
-        -----END CERTIFICATE-----
-        </ca>
-        key-direction 1
-        <tls-auth>
-        #
-        # 2048 bit OpenVPN static key
-        #
-        -----BEGIN OpenVPN Static key V1-----
-        5d49aa8c9cec18de7ab6e0b5cd09a368
-        d3f1b8b77e055e448804fa0e14f487cb
-        491681742f96b54a23fb8639aa9ed14e
-        c40b86a5546b888c4f3873f23c956e87
-        169076ec869127ffc85353fd5928871c
-        da19776b79f723abb366fae6cdfe4ad6
-        7ef667b7d05a7b78dfd5ea1d2da276dc
-        5f6c82313fe9c1178c7256b8d1d081b0
-        4c80bc8f21add61fbc52c158579edc1d
-        bbde230afb9d0e531624ce289a17098a
-        3261f9144a9a2a6f0da4250c9eed4086
-        187ec6fa757a454de743a349e32af193
-        e9f8b49b010014bdfb3240d992f2f234
-        581d0ce05d4e07a2b588ad9b0555b704
-        9d5edc28efde59226ec8942feed690a1
-        2acd0c8bc9424d6074d0d495391023b6
-        -----END OpenVPN Static key V1-----
-        </tls-auth>
-      '';
+  systemd.network.networks.c-base = {
+    matchConfig.Name = "c-base";
+    networkConfig = {
+      IgnoreCarrierLoss = "3s";
+      KeepConfiguration = "static";
+      DNS = "10.0.1.254";
+      Domains = "cbrp3.c-base.org";
     };
+    routes = [
+      { routeConfig = {
+        Destination = "10.0.1.0/24";
+        Gateway = "172.31.77.1";
+      };}
+      { routeConfig = {
+        Destination = "91.102.9.99/32"; # vorstand.c-base.org
+        Gateway = "172.31.77.1";
+      };}
+    ];
+  };
+  services.openvpn.servers.c-base = {
+    config = ''
+      remote vpn.ext.c-base.org 1194
+      verify-x509-name vpn.ext.c-base.org name