Merge remote-tracking branch 'origin/master'

18 files changed, 610 insertions, 315 deletions

diff --git a/makefu/1systems/crapi/README b/makefu/1systems/crapi/README
new file mode 100644
index 000000000..9278c764a
--- /dev/null
+++ b/makefu/1systems/crapi/README
@@ -0,0 +1,4 @@
+1. flash arm6 image from https://www.cs.helsinki.fi/u/tmtynkky/nixos-arm/installer/ to sdcard
+2. passwd; systemctl start sshd; mkdir /var/src ; touch /var/src/.populate
+3. "environment.systemPackages = [ pkgs.rsync pkgs.git ];" in /etc/nixos/configuration.nix
+5. nixos-rebuild switch --fast --option binary-caches http://nixos-arm.dezgeg.me/channel --option binary-cache-public-keys nixos-arm.dezgeg.me-1:xBaUKS3n17BZPKeyxL4JfbTqECsT+ysbDJz29kLFRW0=%
diff --git a/makefu/1systems/crapi/config.nix b/makefu/1systems/crapi/config.nix
new file mode 100644
index 000000000..d96b872d5
--- /dev/null
+++ b/makefu/1systems/crapi/config.nix
@@ -0,0 +1,46 @@
+{ config, pkgs, lib, ... }:
+{
+  # :l <nixpkgs>
+  # builtins.readDir (pkgs.fetchFromGitHub { owner = "nixos"; repo = "nixpkgs-channels"; rev = "6c064e6b"; sha256 = "1rqzh475xn43phagrr30lb0fd292c1s8as53irihsnd5wcksnbyd"; })
+  imports = [
+    <stockholm/makefu>
+    <stockholm/makefu/2configs>
+    <stockholm/makefu/2configs/tinc/retiolum.nix>
+    <stockholm/makefu/2configs/save-diskspace.nix>
+
+  ];
+  krebs.build.host = config.krebs.hosts.crapi;
+  # NixOS wants to enable GRUB by default
+  boot.loader.grub.enable = false;
+
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_rpi;
+
+  nix.binaryCaches = [ "http://nixos-arm.dezgeg.me/channel" ];
+  nix.binaryCachePublicKeys = [ "nixos-arm.dezgeg.me-1:xBaUKS3n17BZPKeyxL4JfbTqECsT+ysbDJz29kLFRW0=%" ];
+
+  fileSystems = {
+    "/boot" = {
+      device = "/dev/disk/by-label/NIXOS_BOOT";
+      fsType = "vfat";
+    };
+    "/" = {
+      device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+    };
+  };
+
+  system.activationScripts.create-swap = ''
+    if [ ! -e /swapfile ]; then
+      fallocate -l 2G /swapfile
+      mkswap /swapfile
+    fi
+  '';
+  swapDevices = [ { device = "/swapfile"; size = 2048; } ];
+
+  nix.package = lib.mkForce pkgs.nixStable;
+  services.openssh.enable = true;
+
+}
diff --git a/makefu/1systems/crapi/source.nix b/makefu/1systems/crapi/source.nix
new file mode 100644
index 000000000..4a4359ee6
--- /dev/null
+++ b/makefu/1systems/crapi/source.nix
@@ -0,0 +1,3 @@
+{
+  arm6 = true;
+}
diff --git a/makefu/1systems/gum/config.nix b/makefu/1systems/gum/config.nix
index 351844482..36af23bb5 100644
--- a/makefu/1systems/gum/config.nix
+++ b/makefu/1systems/gum/config.nix
@@ -74,14 +74,8 @@ in {
       <stockholm/makefu/2configs/syncthing.nix>
 
       # <stockholm/makefu/2configs/opentracker.nix>
-      <stockholm/makefu/2configs/hub.nix>
-      { # ncdc
-        environment.systemPackages = [ pkgs.ncdc ];
-        networking.firewall = {
-          allowedUDPPorts = [ 51411 ];
-          allowedTCPPorts = [ 51411 ];
-        };
-      }
+      <stockholm/makefu/2configs/dcpp/hub.nix>
+      <stockholm/makefu/2configs/dcpp/client.nix>
 
       <stockholm/makefu/2configs/stats/client.nix>
       # <stockholm/makefu/2configs/logging/client.nix>
@@ -103,55 +97,7 @@ in {
       #    locations."/".proxyPass = "http://localhost:5000";
       #  };
       #}
-      { # wireguard server
-
-        # opkg install wireguard luci-proto-wireguard
-
-        # TODO: networking.nat
-
-        # boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-        # conf.all.proxy_arp =1
-        networking.firewall = {
-          allowedUDPPorts = [ 51820 ];
-          extraCommands = ''
-            iptables -t nat -A POSTROUTING -s 10.244.0.0/24 -o ${ext-if} -j MASQUERADE
-          '';
-        };
-
-        networking.wireguard.interfaces.wg0 = {
-          ips = [ "10.244.0.1/24" ];
-          listenPort = 51820;
-          privateKeyFile = (toString <secrets>) + "/wireguard.key";
-          allowedIPsAsRoutes = true;
-          peers = [
-          {
-            # x
-            allowedIPs = [ "10.244.0.2/32" ];
-            publicKey = "fe5smvKVy5GAn7EV4w4tav6mqIAKhGWQotm7dRuRt1g=";
-          }
-          {
-            # vbob
-            allowedIPs = [ "10.244.0.3/32" ];
-            publicKey = "Lju7EsCu1OWXhkhdNR7c/uiN60nr0TUPHQ+s8ULPQTw=";
-          }
-          {
-            # x-test
-            allowedIPs = [ "10.244.0.4/32" ];
-            publicKey = "vZ/AJpfDLJyU3DzvYeW70l4FNziVgSTumA89wGHG7XY=";
-          }
-          {
-            # work-router
-            allowedIPs = [ "10.244.0.5/32" ];
-            publicKey = "QJMwwYu/92koCASbHnR/vqe/rN00EV6/o7BGwLockDw=";
-          }
-          {
-            # workr
-            allowedIPs = [ "10.244.0.6/32" ];
-            publicKey = "OFhCF56BrV9tjqW1sxqXEKH/GdqamUT1SqZYSADl5GA=";
-          }
-          ];
-        };
-      }
+      <stockholm/makefu/2configs/wireguard/server.nix>
       { # iperf3
         networking.firewall.allowedUDPPorts = [ 5201 ];
         networking.firewall.allowedTCPPorts = [ 5201 ];
diff --git a/makefu/1systems/hardware/tsp-disk.json b/makefu/1systems/hardware/tsp-disk.json
new file mode 100644
index 000000000..5a4bd26ab
--- /dev/null
+++ b/makefu/1systems/hardware/tsp-disk.json
@@ -0,0 +1,23 @@
+{
+  "type": "devices",
+  "content": {
+    "sda": {
+      "type": "table",
+      "format": "msdos",
+      "partitions": [
+        { "type": "partition",
+          "part-type": "primary",
+          "start": "1M",
+          "end": "100%",
+          "bootable": true,
+          "content": {
+            "type": "filesystem",
+            "format": "ext4",
+            "mountpoint": "/"
+          }
+        }
+      ]
+    }
+  }
+}
+
diff --git a/makefu/1systems/iso/config.nix b/makefu/1systems/iso/config.nix
index f863321bd..34a75dbd3 100644
--- a/makefu/1systems/iso/config.nix
+++ b/makefu/1systems/iso/config.nix
@@ -11,6 +11,7 @@ with import <stockholm/lib>;
   # TODO: NIX_PATH and nix.nixPath are being set by default.nix right now
   # cd ~/stockholm ; nix-build -A config.system.build.isoImage -I nixos-config=makefu/1systems/iso.nix -I secrets=/home/makefu/secrets/iso /var/src/nixpkgs/nixos
   krebs.build.host = config.krebs.hosts.iso;
+  isoImage.isoBaseName = lib.mkForce "stockholm";
   krebs.hidden-ssh.enable = true;
   environment.systemPackages = with pkgs; [
     aria2
diff --git a/makefu/1systems/omo/config.nix b/makefu/1systems/omo/config.nix
index 109877bf1..be49db024 100644
--- a/makefu/1systems/omo/config.nix
+++ b/makefu/1systems/omo/config.nix
@@ -4,55 +4,23 @@
 
 { config, pkgs, lib, ... }:
 let
-  toMapper = id: "/media/crypt${builtins.toString id}";
-  byid = dev: "/dev/disk/by-id/" + dev;
-  keyFile = byid "usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
-  rootDisk = byid "ata-SanDisk_SD8SNAT128G1122_162099420904";
-  rootPartition = byid "ata-SanDisk_SD8SNAT128G1122_162099420904-part2";
-  primaryInterface = "enp2s0";
-  firetv = "192.168.1.238";
-  # cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
-  # cryptsetup luksAddKey $dev tmpkey
-  # cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096
-  # mkfs.xfs /dev/mapper/crypt0 -L crypt0
-
-  # omo Chassis:
-  # __FRONT_
-  # |* d0   |
-  # |       |
-  # |* d1   |
-  # |       |
-  # |* d3   |
-  # |       |
-  # |*      |
-  # |* d2   |
-  # |  *    |
-  # |  *    |
-  # |_______|
-  # cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
-  cryptDisk0 = byid "ata-ST8000DM004-2CX188_ZCT01PLV";
-  cryptDisk1 = byid "ata-TP02000GB_TPW151006050068";
-  cryptDisk2 = byid "ata-ST4000DM000-1F2168_Z303HVSG";
-  cryptDisk3 = byid "ata-ST8000DM004-2CX188_ZCT01SG4";
-  # cryptDisk3 = byid "ata-WDC_WD20EARS-00MVWB0_WD-WMAZA1786907";
-  # all physical disks
-
-  # TODO callPackage ../3modules/MonitorDisks { disks = allDisks }
-  dataDisks = [ cryptDisk0 cryptDisk1 cryptDisk2 cryptDisk3 ];
-  allDisks = [ rootDisk ] ++ dataDisks;
+  primaryInterface = config.makefu.server.primary-itf;
 in {
   imports =
     [
+      #./hw/omo.nix
+      ./hw/tsp.nix
       <stockholm/makefu>
-      # TODO: unlock home partition via ssh
-      <stockholm/makefu/2configs/fs/sda-crypto-root.nix>
       <stockholm/makefu/2configs/zsh-user.nix>
       <stockholm/makefu/2configs/backup.nix>
       <stockholm/makefu/2configs/exim-retiolum.nix>
-      <stockholm/makefu/2configs/smart-monitor.nix>
+      # <stockholm/makefu/2configs/smart-monitor.nix>
       <stockholm/makefu/2configs/mail-client.nix>
       <stockholm/makefu/2configs/mosh.nix>
+      <stockholm/makefu/2configs/tools/core.nix>
+      <stockholm/makefu/2configs/tools/desktop.nix>
       <stockholm/makefu/2configs/tools/mobility.nix>
+      { environment.systemPackages = [ pkgs.esniper ]; }
       # <stockholm/makefu/2configs/disable_v6.nix>
       #<stockholm/makefu/2configs/graphite-standalone.nix>
       #<stockholm/makefu/2configs/share-user-sftp.nix>
@@ -68,16 +36,17 @@ in {
       # logs to influx
       <stockholm/makefu/2configs/stats/external/aralast.nix>
       <stockholm/makefu/2configs/stats/telegraf>
-      <stockholm/makefu/2configs/stats/telegraf/europastats.nix>
+      # <stockholm/makefu/2configs/stats/telegraf/europastats.nix>
+      <stockholm/makefu/2configs/stats/telegraf/hamstats.nix>
       <stockholm/makefu/2configs/stats/arafetch.nix>
 
       # services
       <stockholm/makefu/2configs/syncthing.nix>
-      <stockholm/makefu/2configs/mqtt.nix>
       <stockholm/makefu/2configs/remote-build/slave.nix>
       <stockholm/makefu/2configs/deployment/google-muell.nix>
       <stockholm/makefu/2configs/virtualisation/docker.nix>
       <stockholm/makefu/2configs/bluetooth-mpd.nix>
+      <stockholm/makefu/2configs/deployment/homeautomation>
       {
         hardware.pulseaudio.systemWide = true;
         makefu.mpd.musicDirectory = "/media/cryptX/music";
@@ -99,75 +68,10 @@ in {
 
       # Temporary:
       # <stockholm/makefu/2configs/temp/rst-issue.nix>
-      { # ncdc
-        environment.systemPackages = [ pkgs.ncdc ];
-        networking.firewall = {
-          allowedUDPPorts = [ 51411 ];
-          allowedTCPPorts = [ 51411 ];
-        };
-      }
-      {
-        systemd.services.firetv = {
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            User = "nobody";
-            ExecStart = "${pkgs.python-firetv}/bin/firetv-server -d ${firetv}:5555";
-          };
-        };
-        nixpkgs.config.permittedInsecurePackages = [
-         "homeassistant-0.65.5"
-       ];
-        services.home-assistant = {
-          config = {
-            homeassistant = {
-              name = "Home"; time_zone = "Europe/Berlin";
-              latitude = "48.7687";
-              longitude = "9.2478";
-            };
-            media_player = [
-              { platform = "kodi";
-                host = firetv;
-              }
-              { platform = "firetv";
-                # assumes python-firetv running
-              }
-            ];
-            sensor = [
-              { platform = "luftdaten";
-                name = "Ditzingen";
-                sensorid = "663";
-                monitored_conditions = [ "P1" "P2" ];
-              }
-              # https://www.home-assistant.io/cookbook/automation_for_rainy_days/
-              { platform = "darksky";
-                api_key = "c73619e6ea79e553a585be06aacf3679";
-                language = "de";
-                monitored_conditions = [ "summary" "icon"
-                "nearest_storm_distance" "precip_probability"
-                "precip_intensity"
-                "temperature" # "temperature_high" "temperature_low"
-                "hourly_summary"
-                "uv_index" ];
-                units =  "si" ;
-                update_interval = {
-                      days = 0;
-                      hours = 0;
-                      minutes = 10;
-                      seconds = 0;
-                };
-              }
-            ];
-            frontend = { };
-            http = { };
-          };
-          enable = true;
-          #configDir = "/var/lib/hass";
-        };
-      }
+
     ];
-  makefu.full-populate = true;
-  makefu.server.primary-itf = primaryInterface;
-  krebs.rtorrent = {
+  makefu.full-populate =  true;
+  krebs.rtorrent = (builtins.trace (builtins.toJSON config.services.telegraf.extraConfig)) {
     downloadDir = lib.mkForce "/media/cryptX/torrent";
     extraConfig = ''
       upload_rate = 200
@@ -178,18 +82,6 @@ in {
     members = [ "makefu" "misa" ];
   };
   networking.firewall.trustedInterfaces = [ primaryInterface ];
-  # udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net
-  # tcp:80          - nginx for sharing files
-  # tcp:655 udp:655 - tinc
-  # tcp:8111        - graphite
-  # tcp:8112        - pyload
-  # tcp:9090        - sabnzbd
-  # tcp:9200        - elasticsearch
-  # tcp:5601        - kibana
-  networking.firewall.allowedUDPPorts = [ 655 ];
-  networking.firewall.allowedTCPPorts = [ 80 655 5601 8111 8112 9200 9090 ];
-
-  # services.openssh.allowSFTP = false;
 
   # copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/
   services.sabnzbd.enable = true;
@@ -199,90 +91,11 @@ in {
     enable = true;
     servedir = "/media/cryptX/emu/ps3";
   };
-  # HDD Array stuff
-  services.smartd.devices = builtins.map (x: { device = x; }) allDisks;
-
-  makefu.snapraid = {
-    enable = true;
-    # TODO: 3 is not protected
-    disks = map toMapper [ 0 1 ];
-    parity = toMapper 2;
-  };
-
-  # TODO create folders in /media
-  system.activationScripts.createCryptFolders = ''
-    ${lib.concatMapStringsSep "\n"
-      (d: "install -m 755 -d " + (toMapper d) )
-      [ 0 1 2 "X" ]}
-  '';
-  environment.systemPackages = with pkgs;[
-    mergerfs # hard requirement for mount
-    wol      # wake up filepimp
-    f3
-  ];
-  fileSystems = let
-    cryptMount = name:
-      { "/media/${name}" = {
-        device = "/dev/mapper/${name}"; fsType = "xfs";
-        options = [ "nofail" ];
-      };};
-  in   cryptMount "crypt0"
-    // cryptMount "crypt1"
-    // cryptMount "crypt2"
-    // cryptMount "crypt3"
-    // { "/media/cryptX" = {
-            device = (lib.concatMapStringsSep ":" (d: (toMapper d)) [ 0 1 2 3 ]);
-            fsType = "mergerfs";
-            noCheck = true;
-            options = [ "defaults" "allow_other" "nofail" "nonempty" ];
-          };
-       };
-
-  powerManagement.powerUpCommands = lib.concatStrings (map (disk: ''
-      ${pkgs.hdparm}/sbin/hdparm -S 100 ${disk}
-      ${pkgs.hdparm}/sbin/hdparm -B 127 ${disk}
-      ${pkgs.hdparm}/sbin/hdparm -y ${disk}
-    '') allDisks);
 
-  # crypto unlocking
-  boot = {
-    initrd.luks = {
-      devices = let
-        usbkey = name: device: {
-          inherit name device keyFile;
-          keyFileSize = 4096;
-          allowDiscards = true;
-        };
-      in [
-        (usbkey "luksroot" rootPartition)
-        (usbkey "crypt0" cryptDisk0)
-        (usbkey "crypt1" cryptDisk1)
-        (usbkey "crypt2" cryptDisk2)
-        (usbkey "crypt3" cryptDisk3)
-      ];
-    };
-    loader.grub.device = lib.mkForce rootDisk;
-
-    initrd.availableKernelModules = [
-      "ahci"
-      "ohci_pci"
-      "ehci_pci"
-      "pata_atiixp"
-      "firewire_ohci"
-      "usb_storage"
-      "usbhid"
-    ];
-
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
   users.users.misa = {
     uid = 9002;
     name = "misa";
   };
-  # hardware.enableAllFirmware = true;
-  hardware.enableRedistributableFirmware = true;
-  hardware.cpu.intel.updateMicrocode = true;
 
   zramSwap.enable = true;
 
@@ -290,23 +103,23 @@ in {
     nickname = "Reaktor|shack";
     workdir = "/var/lib/Reaktor/shack";
     channels = [ "#shackspace" ];
-    plugins = with pkgs.ReaktorPlugins;[
-                               shack-correct
-                               # stockholm-issue
-                               sed-plugin
-                               random-emoji ];
+    plugins = with pkgs.ReaktorPlugins;
+    [ shack-correct
+      # stockholm-issue
+      sed-plugin
+      random-emoji ];
   };
   krebs.Reaktor.reaktor-bgt = {
     nickname = "Reaktor|bgt";
     workdir = "/var/lib/Reaktor/bgt";
     channels = [ "#binaergewitter" ];
-    plugins = with pkgs.ReaktorPlugins;[
-                               titlebot
-                               # stockholm-issue
-                               nixos-version
-                               shack-correct
-                               sed-plugin
-                               random-emoji ];
+    plugins = with pkgs.ReaktorPlugins;
+    [ titlebot
+      # stockholm-issue
+      nixos-version
+      shack-correct
+      sed-plugin
+      random-emoji ];
   };
 
   krebs.build.host = config.krebs.hosts.omo;
diff --git a/makefu/1systems/omo/hw/omo.nix b/makefu/1systems/omo/hw/omo.nix
new file mode 100644
index 000000000..1b618a486
--- /dev/null
+++ b/makefu/1systems/omo/hw/omo.nix
@@ -0,0 +1,117 @@
+{ config, pkgs, lib, ... }:
+let
+  toMapper = id: "/media/crypt${builtins.toString id}";
+  byid = dev: "/dev/disk/by-id/" + dev;
+  keyFile = byid "usb-Verbatim_STORE_N_GO_070B3CEE0B223954-0:0";
+  rootDisk = byid "ata-SanDisk_SD8SNAT128G1122_162099420904";
+  rootPartition = byid "ata-SanDisk_SD8SNAT128G1122_162099420904-part2";
+  primaryInterface = "enp2s0";
+  # cryptsetup luksFormat $dev --cipher aes-xts-plain64 -s 512 -h sha512
+  # cryptsetup luksAddKey $dev tmpkey
+  # cryptsetup luksOpen $dev crypt0 --key-file tmpkey --keyfile-size=4096
+  # mkfs.xfs /dev/mapper/crypt0 -L crypt0
+
+  # omo Chassis:
+  # __FRONT_
+  # |* d0   |
+  # |       |
+  # |* d1   |
+  # |       |
+  # |* d3   |
+  # |       |
+  # |*      |
+  # |* d2   |
+  # |  *    |
+  # |  *    |
+  # |_______|
+  # cryptDisk0 = byid "ata-ST2000DM001-1CH164_Z240XTT6";
+  cryptDisk0 = byid "ata-ST8000DM004-2CX188_ZCT01PLV";
+  cryptDisk1 = byid "ata-TP02000GB_TPW151006050068";
+  cryptDisk2 = byid "ata-ST4000DM000-1F2168_Z303HVSG";
+  cryptDisk3 = byid "ata-ST8000DM004-2CX188_ZCT01SG4";
+  # cryptDisk3 = byid "ata-WDC_WD20EARS-00MVWB0_WD-WMAZA1786907";
+  # all physical disks
+
+  # TODO callPackage ../3modules/MonitorDisks { disks = allDisks }
+  dataDisks = [ cryptDisk0 cryptDisk1 cryptDisk2 cryptDisk3 ];
+  allDisks = [ rootDisk ] ++ dataDisks;
+in {
+  imports =
+    [ # TODO: unlock home partition via ssh
+      <stockholm/makefu/2configs/fs/sda-crypto-root.nix> ];
+  makefu.server.primary-itf = primaryInterface;
+  system.activationScripts.createCryptFolders = ''
+    ${lib.concatMapStringsSep "\n"
+      (d: "install -m 755 -d " + (toMapper d) )
+      [ 0 1 2 "X" ]}
+  '';
+
+  makefu.snapraid = {
+    enable = true;
+    # TODO: 3 is not protected
+    disks = map toMapper [ 0 1 ];
+    parity = toMapper 2;
+  };
+  fileSystems = let
+    cryptMount = name:
+      { "/media/${name}" = {
+        device = "/dev/mapper/${name}"; fsType = "xfs";
+        options = [ "nofail" ];
+      };};
+  in   cryptMount "crypt0"
+    // cryptMount "crypt1"
+    // cryptMount "crypt2"
+    // cryptMount "crypt3"
+    // { "/media/cryptX" = {
+            device = (lib.concatMapStringsSep ":" (d: (toMapper d)) [ 0 1 2 3 ]);
+            fsType = "mergerfs";
+            noCheck = true;
+            options = [ "defaults" "allow_other" "nofail" "nonempty" ];
+          };
+       };
+
+  powerManagement.powerUpCommands = lib.concatStrings (map (disk: ''
+      ${pkgs.hdparm}/sbin/hdparm -S 100 ${disk}
+      ${pkgs.hdparm}/sbin/hdparm -B 127 ${disk}
+      ${pkgs.hdparm}/sbin/hdparm -y ${disk}
+    '') allDisks);
+
+  # crypto unlocking
+  boot = {
+    initrd.luks = {
+      devices = let
+        usbkey = name: device: {
+          inherit name device keyFile;
+          keyFileSize = 4096;
+          allowDiscards = true;
+        };
+      in [
+        (usbkey "luksroot" rootPartition)
+        (usbkey "crypt0" cryptDisk0)
+        (usbkey "crypt1" cryptDisk1)
+        (usbkey "crypt2" cryptDisk2)
+        (usbkey "crypt3" cryptDisk3)
+      ];
+    };
+    loader.grub.device = lib.mkForce rootDisk;
+
+    initrd.availableKernelModules = [
+      "ahci"
+      "ohci_pci"
+      "ehci_pci"
+      "pata_atiixp"
+      "firewire_ohci"
+      "usb_storage"
+      "usbhid"
+    ];
+
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+  };
+  environment.systemPackages = with pkgs;[
+    mergerfs # hard requirement for mount
+  ];
+  hardware.enableRedistributableFirmware = true;
+  hardware.cpu.intel.updateMicrocode = true;
+}
+
diff --git a/makefu/1systems/omo/hw/tsp-tools.nix b/makefu/1systems/omo/hw/tsp-tools.nix
new file mode 100644
index 000000000..6579edd9d
--- /dev/null
+++ b/makefu/1systems/omo/hw/tsp-tools.nix
@@ -0,0 +1,11 @@
+let
+  disko = import (builtins.fetchGit {
+    url = https://cgit.lassul.us/disko/;
+    rev = "9c9b62e15e4ac11d4379e66b974f1389daf939fe";
+  });
+
+  cfg = builtins.fromJSON (builtins.readFile ../../hardware/tsp-disk.json);
+in ''
+${disko.create cfg}
+${disko.mount cfg}
+''
diff --git a/makefu/1systems/omo/hw/tsp.nix b/makefu/1systems/omo/hw/tsp.nix
new file mode 100644
index 000000000..a289fadce
--- /dev/null
+++ b/makefu/1systems/omo/hw/tsp.nix
@@ -0,0 +1,41 @@
+{ pkgs, ... }:
+with builtins;
+let
+  disko = import (builtins.fetchGit {
+    url = https://cgit.lassul.us/disko/;
+    rev = "9c9b62e15e4ac11d4379e66b974f1389daf939fe";
+  });
+  cfg = fromJSON (readFile ../../hardware/tsp-disk.json);
+  # primaryInterface = "enp1s0";
+  primaryInterface = "wlp2s0";
+  rootDisk = "/dev/sda"; # TODO same as disko uses
+in {
+  imports = [
+    (disko.config cfg)
+  ];
+  makefu.server.primary-itf = primaryInterface;
+  boot = {
+    loader.grub.device = rootDisk;
+
+    initrd.availableKernelModules = [
+      "ahci"
+      "ohci_pci"
+      "ehci_pci"
+      "pata_atiixp"
+      "firewire_ohci"
+      "usb_storage"
+      "usbhid"
+    ];
+
+    kernelModules = [ "kvm-intel" ];
+  };
+  networking.wireless.enable = true;
+  hardware.enableRedistributableFirmware = true;
+  hardware.cpu.intel.updateMicrocode = true;
+  services.logind.lidSwitch = "ignore";
+  services.logind.lidSwitchDocked = "ignore";
+  services.logind.extraConfig = ''
+    HandleSuspendKey = ignore
+  '';
+  powerManagement.enable = false;
+}
diff --git a/makefu/1systems/sdev/config.nix b/makefu/1systems/sdev/config.nix
index c2cd23d1e..2f289d500 100644
--- a/makefu/1systems/sdev/config.nix
+++ b/makefu/1systems/sdev/config.nix
@@ -6,13 +6,13 @@
     [ # Include the results of the hardware scan.
       <stockholm/makefu>
 
-     #  <stockholm/makefu/2configs/hw/vbox-guest.nix>
-      { # until virtualbox-image is fixed
-        imports = [
-            <stockholm/makefu/2configs/fs/single-partition-ext4.nix>
-          ];
-        boot.loader.grub.device = "/dev/sda";
-      }
+       <stockholm/makefu/2configs/hw/vbox-guest.nix>
+      #{ # until virtualbox-image is fixed
+      #  imports = [
+      #      <stockholm/makefu/2configs/fs/single-partition-ext4.nix>
+      #    ];
+      #  boot.loader.grub.device = lib.mkForce "/dev/sda";
+      #}
       <stockholm/makefu/2configs/main-laptop.nix>
       # <secrets/extra-hosts.nix>
 
diff --git a/makefu/1systems/shack-autoinstall/config.nix b/makefu/1systems/shack-autoinstall/config.nix
new file mode 100644
index 000000000..d53c411c0
--- /dev/null
+++ b/makefu/1systems/shack-autoinstall/config.nix
@@ -0,0 +1,49 @@
+{ config, pkgs, lib, ... }:
+
+with import <stockholm/lib>;
+let
+  disk = "/dev/sda";
+in {
+  imports = [
+    <stockholm/makefu>
+    <nixpkgs/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix>
+    <nixpkgs/nixos/modules/installer/cd-dvd/channel.nix>
+    <stockholm/makefu/2configs/tools/core.nix>
+  ];
+  # TODO: NIX_PATH and nix.nixPath are being set by default.nix right now
+  # cd ~/stockholm ; nix-build -A config.system.build.isoImage -I nixos-config=makefu/1systems/iso.nix -I secrets=/home/makefu/secrets/iso /var/src/nixpkgs/nixos
+  krebs.build.host = config.krebs.hosts.iso;
+  krebs.hidden-ssh.enable = true;
+
+  environment.extraInit = ''
+    EDITOR=vim
+  '';
+  # iso-specific
+  boot.kernelParams = [ "copytoram" ];
+
+
+  environment.systemPackages = [
+    pkgs.parted
+    (  pkgs.writeScriptBin "shack-install" ''
+      #! /bin/sh
+      echo "go ahead and try NIX_PATH=/root/.nix-defexpr/channels/ nixos-install"
+    '')
+  ];
+
+  systemd.services.wpa_supplicant.wantedBy = lib.mkForce [ "multi-user.target" ];
+
+  networking.wireless = {
+    enable = true;
+    networks.shack.psk = "welcome2shack";
+  };
+
+
+  services.openssh = {
+    enable = true;
+    hostKeys = [
+      { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
+    ];
+  };
+  # enable ssh in the iso boot process
+  systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ];
+}
diff --git a/makefu/1systems/shack-autoinstall/grub-partition.sh b/makefu/1systems/shack-autoinstall/grub-partition.sh
new file mode 100644
index 000000000..c23c89799
--- /dev/null
+++ b/makefu/1systems/shack-autoinstall/grub-partition.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+set -euf
+parted -s ${disk} mklabel msdos
+parted -s ${disk} -- mkpart primary linux-swap 1M 4096M
+parted -s ${disk} -- mkpart primary ext2 4096M 100%
diff --git a/makefu/1systems/shack-autoinstall/shack-config.nix b/makefu/1systems/shack-autoinstall/shack-config.nix
new file mode 100644
index 000000000..9fa54ae32
--- /dev/null
+++ b/makefu/1systems/shack-autoinstall/shack-config.nix
@@ -0,0 +1,231 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    # TODO:
+  ];
+
+  # shacks-specific
+  networking.wireless = {
+    enable = true;
+    networks.shack.psk = "181471eb97eb23f12c6871227bc4a7b13c8f6af56dcc0d0e8b71f4d7a510cb4e";
+  };
+  networking.hostName = "shackbook";
+
+  boot.tmpOnTmpfs = true;
+
+  users.users.shack = {
+    createHome = true;
+    useDefaultShell = true;
+    home = "/home/shack";
+    uid = 9001;
+    packages = with pkgs;[
+      chromium
+      firefox
+    ];
+    extraGroups = [ "audio" "wheel"  ];
+    hashedPassword = "$6$KIxlQTLEnKl7cwC$LrmbwZ64Mlm7zqUUZ0EObPJMES3C0mQ6Sw7ynTuXzUo7d9EWg/k5XCGkDHMFvL/Pz19Awcv0knHB1j3dHT6fh/" ;
+  };
+
+  environment.variables = let
+    ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+  in {
+    EDITOR = lib.mkForce "vim";
+    CURL_CA_BUNDLE = ca-bundle;
+    GIT_SSL_CAINFO = ca-bundle;
+    SSL_CERT_FILE  = ca-bundle;
+  };
+
+  services.printing = {
+    enable = true;
+    # TODO: shack-printer
+  };
+
+
+  environment.systemPackages = with pkgs;[
+    parted
+    ddrescue
+    tmux
+    jq git gnumake htop rxvt_unicode.terminfo
+    (pkgs.vim_configurable.customize {
+      name = "vim";
+      vimrcConfig.customRC = ''
+      set nocompatible
+      syntax on
+      set list
+      set listchars=tab:▸\ 
+      "set list listchars=tab:>-,trail:.,extends:>
+
+      filetype off
+      filetype plugin indent on
+
+      colorscheme darkblue
+      set background=dark
+
+      set number
+      set relativenumber
+      set mouse=a
+      set ignorecase
+      set incsearch
+      set wildignore=*.o,*.obj,*.bak,*.exe,*.os
+      set textwidth=79
+      set shiftwidth=2
+      set expandtab
+      set softtabstop=2
+      set shiftround
+      set smarttab
+      set tabstop=2
+      set et
+      set autoindent
+      set backspace=indent,eol,start
+
+
+      inoremap <F1> <ESC>
+      nnoremap <F1> <ESC>
+      vnoremap <F1> <ESC>
+
+      nnoremap <F5> :UndotreeToggle<CR>
+      set undodir  =~/.vim/undo
+      set undofile
+      "maximum number of changes that can be undone
+      set undolevels=1000000
+      "maximum number lines to save for undo on a buffer reload
+      set undoreload=10000000
+
+      nnoremap <F2> :set invpaste paste?<CR>
+      set pastetoggle=<F2>
+      set showmode
+
+      set showmatch
+      set matchtime=3
+      set hlsearch
+
+      autocmd ColorScheme * highlight ExtraWhitespace ctermbg=red guibg=red
+
+
+      " save on focus lost
+      au FocusLost * :wa
+
+      autocmd BufRead *.json set filetype=json
+      au  BufNewFile,BufRead *.mustache set syntax=mustache
+
+      cnoremap SudoWrite w !sudo tee > /dev/null %
+
+      " create Backup/tmp/undo dirs
+      set backupdir=~/.vim/backup
+      set directory=~/.vim/tmp