Merge remote-tracking branch 'gum/master'

25 files changed, 403 insertions, 102 deletions

diff --git a/makefu/1systems/gum/config.nix b/makefu/1systems/gum/config.nix
index 98d5d2988..b66ef1ab8 100644
--- a/makefu/1systems/gum/config.nix
+++ b/makefu/1systems/gum/config.nix
@@ -46,7 +46,7 @@ in {
 
       # services
       <stockholm/makefu/2configs/share/gum.nix>
-      <stockholm/makefu/2configs/sabnzbd.nix>
+      # <stockholm/makefu/2configs/sabnzbd.nix>
       <stockholm/makefu/2configs/torrent.nix>
       <stockholm/makefu/2configs/iodined.nix>
       <stockholm/makefu/2configs/vpn/openvpn-server.nix>
@@ -65,6 +65,8 @@ in {
       <stockholm/makefu/2configs/deployment/graphs.nix>
       <stockholm/makefu/2configs/deployment/owncloud.nix>
       <stockholm/makefu/2configs/deployment/boot-euer.nix>
+      <stockholm/makefu/2configs/deployment/bgt/hidden_service.nix>
+
       {
         services.taskserver.enable = true;
         services.taskserver.fqdn = config.krebs.build.host.name;
@@ -84,13 +86,40 @@ in {
 
       # Temporary:
       # <stockholm/makefu/2configs/temp/rst-issue.nix>
+      <stockholm/makefu/2configs/virtualisation/docker.nix>
+
+      #{
+      #  services.dockerRegistry.enable = true;
+      #  networking.firewall.allowedTCPPorts = [ 8443 ];
+
+      #  services.nginx.virtualHosts."euer.krebsco.de" = {
+      #    forceSSL = true;
+      #    enableACME = true;
+      #    extraConfig = ''
+      #      client_max_body_size 1000M;
+      #    '';
+      #    locations."/".proxyPass = "http://localhost:5000";
+      #  };
+      #}
+      { # wireguard server
+        networking.firewall.allowedUDPPorts = [ 51820 ];
+        #networking.wireguard.interfaces.wg0 = {
+        #  ips = [ "10.244.0.1/24" ];
+        #  privateKeyFile = (toString <secrets>) + "/wireguard.key";
+        #  allowedIPsAsRoutes = true;
+        #  peers = [{
+        #    allowedIPs = [ "0.0.0.0/0" "::/0" ];
+        #    publicKey = "fe5smvKVy5GAn7EV4w4tav6mqIAKhGWQotm7dRuRt1g=";
+        #  }];
+        #};
+      }
 
   ];
   makefu.dl-dir = "/var/download";
 
   services.openssh.hostKeys = [
-    { bits = 4096; path = <secrets/ssh_host_rsa_key>; type = "rsa"; }
-    { path = <secrets/ssh_host_ed25519_key>; type = "ed25519"; } ];
+    { bits = 4096; path = (toString <secrets/ssh_host_rsa_key>); type = "rsa"; }
+    { path = (toString <secrets/ssh_host_ed25519_key>); type = "ed25519"; } ];
   ###### stable
   services.nginx.virtualHosts.cgit.serverAliases = [ "cgit.euer.krebsco.de" ];
   krebs.build.host = config.krebs.hosts.gum;
diff --git a/makefu/1systems/omo/config.nix b/makefu/1systems/omo/config.nix
index 1d157460b..4af87dc10 100644
--- a/makefu/1systems/omo/config.nix
+++ b/makefu/1systems/omo/config.nix
@@ -61,6 +61,7 @@ in {
       # logs to influx
       <stockholm/makefu/2configs/stats/external/aralast.nix>
       <stockholm/makefu/2configs/stats/telegraf>
+      <stockholm/makefu/2configs/stats/telegraf/europastats.nix>
 
       # services
       <stockholm/makefu/2configs/syncthing.nix>
diff --git a/makefu/1systems/tsp/config.nix b/makefu/1systems/tsp/config.nix
index 7b751e514..680fa2cbc 100644
--- a/makefu/1systems/tsp/config.nix
+++ b/makefu/1systems/tsp/config.nix
@@ -32,6 +32,8 @@
   # acer aspire
   networking.wireless.enable = lib.mkDefault true;
 
+  services.xserver.synaptics.enable = true;
+
   hardware.enableAllFirmware = true;
   nixpkgs.config.allowUnfree = true;
 
diff --git a/makefu/1systems/wbob/config.nix b/makefu/1systems/wbob/config.nix
index ac51fd9ca..c30ee4c58 100644
--- a/makefu/1systems/wbob/config.nix
+++ b/makefu/1systems/wbob/config.nix
@@ -3,6 +3,7 @@ let
   rootdisk = "/dev/disk/by-id/ata-TS256GMTS800_C613840115";
   datadisk = "/dev/disk/by-id/ata-HGST_HTS721010A9E630_JR10006PH3A02F";
   user = config.makefu.gui.user;
+  primaryIP = "192.168.8.11";
 in {
 
   imports =
@@ -10,16 +11,18 @@ in {
       <stockholm/makefu>
       <stockholm/makefu/2configs/zsh-user.nix>
       <stockholm/makefu/2configs/tools/core.nix>
-      <stockholm/makefu/2configs/tools/core-gui.nix>
-      <stockholm/makefu/2configs/tools/extra-gui.nix>
-      <stockholm/makefu/2configs/tools/media.nix>
+      <stockholm/makefu/2configs/disable_v6.nix>
+      # <stockholm/makefu/2configs/tools/core-gui.nix>
+      # <stockholm/makefu/2configs/tools/extra-gui.nix>
+      # <stockholm/makefu/2configs/tools/media.nix>
       <stockholm/makefu/2configs/virtualisation/libvirt.nix>
       <stockholm/makefu/2configs/tinc/retiolum.nix>
       <stockholm/makefu/2configs/mqtt.nix>
-      <stockholm/makefu/2configs/deployment/led-fader.nix>
       # <stockholm/makefu/2configs/gui/wbob-kiosk.nix>
+
       <stockholm/makefu/2configs/stats/client.nix>
 
+
       # <stockholm/makefu/2configs/gui/studio-virtual.nix>
       # <stockholm/makefu/2configs/audio/jack-on-pulse.nix>
       # <stockholm/makefu/2configs/audio/realtime-audio.nix>
@@ -27,6 +30,41 @@ in {
 
       # Services
       <stockholm/makefu/2configs/remote-build/slave.nix>
+      <stockholm/makefu/2configs/share/wbob.nix>
+
+      <stockholm/makefu/2configs/stats/telegraf>
+      <stockholm/makefu/2configs/deployment/led-fader.nix>
+      <stockholm/makefu/2configs/stats/external/aralast.nix>
+      <stockholm/makefu/2configs/stats/telegraf/airsensor.nix>
+      <stockholm/makefu/2configs/deployment/bureautomation>
+      (let
+          collectd-port = 25826;
+          influx-port = 8086;
+          grafana-port = 3000; # TODO nginx forward
+          db = "collectd_db";
+          logging-interface = "enp0s25";
+        in {
+          services.grafana.enable = true;
+          services.grafana.addr = "0.0.0.0";
+
+          services.influxdb.enable = true;
+          services.influxdb.extraConfig = {
+            meta.hostname = config.krebs.build.host.name;
+            # meta.logging-enabled = true;
+            http.bind-address = ":${toString influx-port}";
+            admin.bind-address = ":8083";
+            collectd = [{
+              enabled = true;
+              typesdb = "${pkgs.collectd}/share/collectd/types.db";
+              database = db;
+              bind-address = ":${toString collectd-port}";
+            }];
+          };
+
+          networking.firewall.extraCommands = ''
+            iptables -A INPUT -i ${logging-interface} -p tcp --dport ${toString grafana-port} -j ACCEPT
+          '';
+      })
 
       # temporary
       # <stockholm/makefu/2configs/temp/rst-issue.nix>
diff --git a/makefu/1systems/wbob/source.nix b/makefu/1systems/wbob/source.nix
index 6f079d712..b768aa87d 100644
--- a/makefu/1systems/wbob/source.nix
+++ b/makefu/1systems/wbob/source.nix
@@ -1,4 +1,4 @@
 import <stockholm/makefu/source.nix> {
   name="wbob";
-  musnix = true;
+  # musnix = true;
 }
diff --git a/makefu/2configs/deployment/bgt/hidden_service.nix b/makefu/2configs/deployment/bgt/hidden_service.nix
new file mode 100644
index 000000000..c1a31b8dc
--- /dev/null
+++ b/makefu/2configs/deployment/bgt/hidden_service.nix
@@ -0,0 +1,48 @@
+{ pkgs, lib, ... }:
+
+with lib;
+let
+  name = "bgt_cyberwar_hidden_service";
+  sec = (toString <secrets>) + "/";
+  secdir = sec + name;
+  srvdir = "/var/lib/tor/onion/";
+  basedir = srvdir + name;
+  hn = builtins.readFile (secdir + "/hostname");
+in
+{
+  systemd.services.prepare-hidden-service = {
+    wantedBy = [ "local-fs.target" ];
+    before = [ "tor.service" ];
+    serviceConfig = {
+      ExecStart = pkgs.writeScript "prepare-euer-blog-service" ''
+        #!/bin/sh
+        set -euf
+        if ! test -d "${basedir}" ;then
+          mkdir -p "${srvdir}"
+          cp -r "${secdir}" "${srvdir}"
+          chown -R tor:tor "${srvdir}"
+          chmod -R 700 "${basedir}"
+        else
+          echo "not overwriting ${basedir}"
+        fi
+      '';
+      Type = "oneshot";
+      RemainAfterExit = "yes";
+      TimeoutSec = "0";
+    };
+  };
+  services.nginx.virtualHosts."${hn}".locations."/" = {
+    proxyPass = "https://blog.binaergewitter.de";
+    extraConfig = ''
+        proxy_set_header  Host blog.binaergewitter.de;
+        proxy_ssl_server_name on;
+    '';
+  };
+  services.tor = {
+    enable = true;
+    hiddenServices."${name}".map = [
+     { port = "80"; }
+     # { port = "443"; toHost = "blog.binaergewitter.de"; }
+    ];
+  };
+}
diff --git a/makefu/2configs/deployment/bureautomation/default.nix b/makefu/2configs/deployment/bureautomation/default.nix
new file mode 100644
index 000000000..3897537ea
--- /dev/null
+++ b/makefu/2configs/deployment/bureautomation/default.nix
@@ -0,0 +1,41 @@
+{ pkgs, lib, ... }:
+
+with lib;
+let
+  port = 3001;
+  runit = pkgs.writeDash "runit" ''
+    set -xeuf
+    PATH=${pkgs.curl}/bin:${pkgs.coreutils}/bin
+    name=''${1?must provide name as first arg}
+    state=''${2?must provide state as second arg}
+    # val=''${3?must provide val as third arg}
+
+    # we ignore non-alerting events
+    test $state = alerting || exit 0
+
+    echo $name - $state
+    curl 'http://bauarbeiterlampe/ay?o=1'
+    sleep 5
+    curl 'http://bauarbeiterlampe/ay?o=1'
+  '';
+in {
+  services.logstash = {
+    package = pkgs.logstash5;
+    enable = true;
+    inputConfig = ''
+       http {
+        port => ${toString port}
+        host => "127.0.0.1"
+      }
+    '';
+    filterConfig = ''
+    '';
+    outputConfig = ''
+      stdout { codec => json }
+      exec { command => "${runit} '%{ruleName}' '%{state}'" }
+    '';
+    extraSettings = ''
+      path.plugins: [ "${pkgs.logstash-output-exec}" ]
+    '';
+  };
+}
diff --git a/makefu/2configs/deployment/led-fader.nix b/makefu/2configs/deployment/led-fader.nix
index 4c17a1d50..292b6679d 100644
--- a/makefu/2configs/deployment/led-fader.nix
+++ b/makefu/2configs/deployment/led-fader.nix
@@ -1,27 +1,25 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, buildPythonPackage, ... }:
 
-with import <stockholm/lib>;
 let
   mq = "192.168.8.11";
 
-  pkg = pkgs.stdenv.mkDerivation {
+  pkg = pkgs.python3Packages.buildPythonPackage {
     name = "ampel-master";
+
     src = pkgs.fetchgit {
       url = "http://cgit.euer.krebsco.de/ampel";
-      rev = "07a6791de368e16cc0864d2676fd255eba522cee";
-      sha256 = "1jxjapvkfglvgapy7gjbr1nra3ay418nvz70bvypcmv7wc8d4h8q";
+      rev = "531741b";
+      sha256 = "110yij53jz074zbswylbzcd8jy7z49r9fg6i3j1gk2y3vl91g81c";
     };
-    buildInputs = [
-      (pkgs.python35.withPackages (pythonPackages: with pythonPackages; [
+    propagatedBuildInputs = with pkgs.python3Packages; [
         docopt
         paho-mqtt
-      ]))
+        requests
+        pytz
+        influxdb
+        httplib2
+        google_api_python_client
     ];
-    installPhase = ''
-      install -m755 -D fade.py  $out/bin/fade.py
-      install -m755 -D ampel.py $out/bin/ampel
-      install -m755 -D times.json $out/share/times.json
-    '';
   };
 in {
   systemd.services.led-fader  = {
@@ -34,7 +32,9 @@ in {
     serviceConfig = {
       # User = "nobody"; # need a user with permissions to run nix-shell
       ExecStartPre = pkgs.writeDash "sleep.sh" "sleep 2";
-      ExecStart = "${pkg}/bin/ampel 4 ${pkg}/share/times.json";
+      ExecStart = "${pkg}/bin/ampel 4";
+      Restart = "always";
+      RestartSec = 10;
       PrivateTmp = true;
     };
   };
diff --git a/makefu/2configs/deployment/scrape/default.nix b/makefu/2configs/deployment/scrape/default.nix
new file mode 100644
index 000000000..c7a5b5c14
--- /dev/null
+++ b/makefu/2configs/deployment/scrape/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./elkstack.nix
+    ./selenium.nix
+  ];
+}
diff --git a/makefu/2configs/deployment/scrape/selenium.nix b/makefu/2configs/deployment/scrape/selenium.nix
new file mode 100644
index 000000000..d700259ba
--- /dev/null
+++ b/makefu/2configs/deployment/scrape/selenium.nix
@@ -0,0 +1,65 @@
+{config, pkgs, lib, ...}:
+with <stockholm/lib>;
+let
+  selenium-pw = <secrets/selenium-vncpasswd>;
+in {
+  services.jenkinsSlave.enable = true;
+  users.users.selenium = {
+    uid = genid "selenium";
+    extraGroups = [ "plugdev" ];
+  };
+
+  fonts.enableFontDir = true;
+
+  # networking.firewall.allowedTCPPorts = [ 5910 ];
+
+  systemd.services.selenium-X11 =
+  {
+    description = "X11 vnc for selenium";
+    wantedBy = [ "multi-user.target" ];
+    path = [ pkgs.xorg.xorgserver pkgs.tightvnc pkgs.dwm ];
+    environment =
+    {
+      DISPLAY = ":10";
+    };
+    script = ''
+      set -ex
+      [ -e /tmp/.X10-lock ] && ( set +e ; chmod u+w /tmp/.X10-lock ; rm /tmp/.X10-lock )
+      [ -e /tmp/.X11-unix/X10 ] && ( set +e ; chmod u+w /tmp/.X11-unix/X10 ; rm /tmp/.X11-unix/X10 )
+      mkdir -p ~/.vnc
+      cp -f ${selenium-pw} ~/.vnc/passwd
+      chmod go-rwx ~/.vnc/passwd
+      echo > ~/.vnc/xstartup
+      chmod u+x ~/.vnc/xstartup
+      vncserver $DISPLAY -geometry 1280x1024 -depth 24 -name jenkins -ac
+      dwm
+    '';
+    preStop = ''
+      vncserver -kill $DISPLAY
+    '';
+    serviceConfig = {
+      User = "selenium";
+    };
+  };
+
+  systemd.services.selenium-server =
+  {
+    description = "selenium-server";
+    wantedBy = [ "multi-user.target" ];
+    requires = [ "selenium-X11.service" ];
+    path = [ pkgs.chromium
+             pkgs.firefoxWrapper ];
+    environment =
+    {
+      DISPLAY = ":10";
+    };
+    script = ''
+      ${pkgs.selenium-server-standalone}/bin/selenium-server -Dwebdriver.enable.native.events=1
+    '';
+    serviceConfig = {
+      User = "selenium";
+    };
+  };
+
+
+}
diff --git a/makefu/2configs/share/omo.nix b/makefu/2configs/share/omo.nix
index 7d7a4ec57..e4fef7c3c 100644
--- a/makefu/2configs/share/omo.nix
+++ b/makefu/2configs/share/omo.nix
@@ -30,20 +30,14 @@ in {
         browseable = "yes";
         "guest ok" = "yes";
       };
-      usenet = {
-        path = "/media/crypt0/usenet/dst";
-        "read only" = "yes";
-        browseable = "yes";
-        "guest ok" = "yes";
-      };
-      pyload = {
-        path = "/media/crypt0/pyload";
+      crypt0 = {
+        path = "/media/crypt0";
         "read only" = "yes";
         browseable = "yes";
         "guest ok" = "yes";
       };
-      crypt0 = {
-        path = "/media/crypt0";
+      crypX-games = {
+        path = "/media/cryptX/games";
         "read only" = "yes";
         browseable = "yes";
         "guest ok" = "yes";
diff --git a/makefu/2configs/share/wbob.nix b/makefu/2configs/share/wbob.nix
new file mode 100644
index 000000000..7d3fc38fe
--- /dev/null
+++ b/makefu/2configs/share/wbob.nix
@@ -0,0 +1,38 @@
+{config, ... }:{
+  networking.firewall.allowedUDPPorts = [ 137 138 ];
+  networking.firewall.allowedTCPPorts = [ 139 445 ];
+  users.users.smbguest = {
+    name = "smbguest";
+    uid = config.ids.uids.smbguest;
+    description = "smb guest user";
+    home = "/home/share";
+    createHome = true;
+  };
+  services.samba = {
+    enable = true;
+    enableNmbd = true;
+    shares = {
+      incoming = {
+        path = "/data/incoming";
+        "read only" = "no";
+        browseable = "yes";
+        "guest ok" = "yes";
+      };
+      data = {
+        path = "/data/";
+        "read only" = "yes";
+        browseable = "yes";
+        "guest ok" = "yes";
+      };
+    };
+    extraConfig = ''
+      guest account = smbguest
+      map to guest = bad user
+      # disable printing
+      load printers = no
+      printing = bsd
+      printcap name = /dev/null
+      disable spoolss = yes
+    '';
+  };
+}
diff --git a/makefu/2configs/stats/telegraf/airsensor.nix b/makefu/2configs/stats/telegraf/airsensor.nix
new file mode 100644
index 000000000..09d23e7d4
--- /dev/null
+++ b/makefu/2configs/stats/telegraf/airsensor.nix
@@ -0,0 +1,19 @@
+{ pkgs, ...}:
+
+{
+  services.udev.extraRules = ''
+    SUBSYSTEMS=="usb", ATTRS{product}=="iAQ Stick", GROUP="input"
+  '';
+  users.users.telegraf.extraGroups = [ "input" ];
+  services.telegraf.extraConfig.inputs.exec = [
+    {
+      commands = [ "${pkgs.airsensor-py}/bin/airsensor-py"];
+      timeout = "10s";
+      data_format = "value";
+      data_type = "integer";
+      name_override = "airquality";
+      interval = "10s";
+      tags.unit="VOC";
+    }
+  ];
+}
diff --git a/makefu/2configs/stats/telegraf/default.nix b/makefu/2configs/stats/telegraf/default.nix
index 4da6561d6..049a9c037 100644
--- a/makefu/2configs/stats/telegraf/default.nix
+++ b/makefu/2configs/stats/telegraf/default.nix
@@ -2,9 +2,6 @@
 let
   url = "http://localhost:8086";
 in {
-  imports = [
-    ./europastats.nix
-  ];
   services.telegraf = {
     enable = true;
     extraConfig = {
diff --git a/makefu/2configs/tools/dev.nix b/makefu/2configs/tools/dev.nix
index 46872279a..26e9808b2 100644
--- a/makefu/2configs/tools/dev.nix
+++ b/makefu/2configs/tools/dev.nix
@@ -13,10 +13,12 @@
     esptool
     cac-api
     cac-panel
+    krebszones
     ovh-zone
     whatsupnix
     brain
     gen-oath-safe
     cdrtools
+    stockholm
   ];
 }
diff --git a/makefu/2configs/tools/extra-gui.nix b/makefu/2configs/tools/extra-gui.nix
index bcc068d82..e25290297 100644
--- a/makefu/2configs/tools/extra-gui.nix
+++ b/makefu/2configs/tools/extra-gui.nix
@@ -14,5 +14,6 @@
     saleae-logic
     arduino-user-env
     gitAndTools.gitFull
+    signal-desktop
   ];
 }
diff --git a/makefu/2configs/tools/games.nix b/makefu/2configs/tools/games.nix
index 8da615963..40ea4523d 100644
--- a/makefu/2configs/tools/games.nix
+++ b/makefu/2configs/tools/games.nix
@@ -7,5 +7,6 @@
   users.users.makefu.packages = with pkgs; [
     games-user-env
     wine
+    pkg2zip
   ];
 }
diff --git a/makefu/2configs/zsh-user.nix b/makefu/2configs/zsh-user.nix
index f280fc852..6be078f6a 100644
--- a/makefu/2configs/zsh-user.nix
+++ b/makefu/2configs/zsh-user.nix
@@ -8,11 +8,12 @@ in
   users.extraUsers.${mainUser}.shell = "/run/current-system/sw/bin/zsh";
   programs.zsh= {
     enable = true;
-    enableCompletion = false ; #manually at the end
+    enableCompletion = true ; #manually at the end
     interactiveShellInit = ''
       HISTSIZE=900001
       HISTFILESIZE=$HISTSIZE
       SAVEHIST=$HISTSIZE
+      HISTFILE=$HOME/.zsh_history
 
       setopt HIST_IGNORE_ALL_DUPS
       setopt HIST_IGNORE_SPACE
@@ -65,13 +66,15 @@ in
       zle     -N   fzf-file-widget
       bindkey '^T' fzf-file-widget
 
-      # Auto-Completion
-      for p in ''${(z)NIX_PROFILES}; do
-        fpath+=($p/share/zsh/site-functions $p/share/zsh/$ZSH_VERSION/functions $p/share/zsh/vendor-completions)
-      done
-      autoload -U compinit && compinit
       compdef _pass brain
       zstyle ':completion::complete:brain::' prefix "$HOME/brain"
+
+      # ctrl-x ctrl-e
+      autoload -U edit-command-line
+      zle -N edit-command-line
+      bindkey '^xe' edit-command-line
+      bindkey '^x^e' edit-command-line
+
     '';
 
     promptInit = ''
diff --git a/makefu/5pkgs/PkgDecrypt/default.nix b/makefu/5pkgs/PkgDecrypt/default.nix
new file mode 100644
index 000000000..80bcbcac1
--- /dev/null
+++ b/makefu/5pkgs/PkgDecrypt/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, lib, pkgs, fetchFromGitHub, ... }:
+stdenv.mkDerivation rec {
+  name = "PkgDecrypt-2017-12-01";
+  rev = "e2f9518";
+
+  src = fetchFromGitHub {
+    owner = "St4rk";
+    repo = "PkgDecrypt";
+    inherit rev;
+    sha256 = "0dk13qamxyny0vc990s06vqddxwwc6xmikb1pkc3rnys98yda29p";
+  };
+
+  installPhase = ''
+    install -m755 -D pkg_dec $out/bin/pkg_dec
+    install -m755 -D make_key $out/bin/make_key
+  '';
+
+  buildInputs = with pkgs;[
+    zlib
+  ];
+
+  meta = {
+    homepage = https://github.com/St4rk/PkgDecrypt;
+    description = "St4rk's Vita pkg decrypter";
+    license = lib.licenses.gpl2;
+  };
+}
diff --git a/makefu/5pkgs/airsensor-py/default.nix b/makefu/5pkgs/airsensor-py/default.nix
new file mode 100644
index 000000000..4eae26c0d
--- /dev/null
+++ b/makefu/5pkgs/airsensor-py/default.nix
@@ -0,0 +1,17 @@
+{ pkgs, fetchFromGitHub, ... }:
+with pkgs.python3Packages;
+buildPythonApplication rec {
+    name = "airsensor-py-${version}";
+    version = "2017-12-05";
+    propagatedBuildInputs = [
+      pyusb
+      click
+    ];
+
+    src = fetchFromGitHub {
+      owner = "makefu";
+      repo = "airsensor-py";
+      rev = "7ac5f185dc848fca1b556e4c0396dd73f6a93995";
+      sha256 = "0387b025y8kb0zml7916p70hmzc3y18kqh46b9xv5qayljxymq2w";
+    };
+}
diff --git a/makefu/5pkgs/default.nix b/makefu/5pkgs/default.nix
index 80a453ddc..80a0d33cd 100644
--- a/makefu/5pkgs/default.nix
+++ b/makefu/5pkgs/default.nix
@@ -24,7 +24,7 @@ in {
     alsa-hdspmixer = callPackage ./custom/alsa-tools { alsaToolTarget="hdspmixer";};
     alsa-hdsploader = callPackage ./custom/alsa-tools { alsaToolTarget="hdsploader";};
     qcma = super.pkgs.libsForQt5.callPackage ./custom/qcma { };
-    inherit (callPackage ./devpi {}) devpi-web devpi-server;
+    inherit (callPackage ./devpi {}) devpi-web ;
     nodemcu-uploader = super.pkgs.callPackage ./nodemcu-uploader {};
     inkscape = super.pkgs.stdenv.lib.overrideDerivation super.inkscape (old: {
       patches = [ ./custom/inkscape/dxf_fix.patch ];
diff --git a/makefu/5pkgs/devpi/default.nix b/makefu/5pkgs/devpi/default.nix
index e7c26da55..3ddcd9641 100644
--- a/makefu/5pkgs/devpi/default.nix
+++ b/makefu/5pkgs/devpi/default.nix
@@ -14,18 +14,6 @@ let
     propagatedBuildInputs = with pkgs.python3Packages; [ docutils bleach pygments ];
 
   };
-  devpi-client = pkgs.python3Packages.buildPythonPackage rec {
-    name = "devpi-client";
-    version = "2.7.0";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/d/devpi-client/devpi-client-${version}.tar.gz";
-      sha256 = "0z7vaf0a66n82mz0vx122pbynjvkhp2mjf9lskgyv09y3bxzzpj3";
-    };
-    patches = [ ./py3-fix-encoding.patch ];
-    buildInputs = with pkgs.python3Packages; [ tox check-manifest pkginfo ];
-    propagatedBuildInputs = with pkgs.python3Packages; [ devpi-common py ];
-  };
   devpi-web = pkgs.python3Packages.buildPythonPackage rec {
     name = "devpi-web";
     version = "3.1.1";
@@ -37,7 +25,7 @@ let
     };
 
     propagatedBuildInputs = with pkgs.python3Packages;
-      [ devpi-server pyramid_chameleon beautifulsoup4 defusedxml readme-renderer ];
+      [ pkgs.devpi-server pyramid_chameleon beautifulsoup4 defusedxml readme-renderer ];
 
     meta = {
       homepage = https://bitbucket.org/hpk42/devpi;
@@ -47,53 +35,7 @@ let
     };
   };
 
-  devpi-common-3 = pkgs.python3Packages.buildPythonPackage rec {
-    name = "devpi-common";
-    version = "3.0.1";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/d/devpi-common/devpi-common-${version}.tar.gz";
-      sha256 = "0l3a7iyk596x6pvzg7604lzzi012qszr804fqn6f517zcy1xz23j";
-    };
-
-    propagatedBuildInputs = with pkgs.python3Packages; [ requests py ];
-
-    meta = {
-      homepage = https://bitbucket.org/hpk42/devpi;
-      description = "Utilities jointly used by devpi-server and devpi-client";
-      license = licenses.mit;
-      maintainers = with maintainers; [ lewo makefu ];
-    };
-  };
-
-  devpi-server = pkgs.python3Packages.buildPythonPackage rec {
-    name = "devpi-server";
-    version = "4.1.1";
-
-    # original postFixup adds "import sys; sys.argv[0] = 'devpi-server'" to
-    # `.devpi-server-wrapped` which
-    # results in "not existing devpi-server: 'devpi-server'"
-    postFixup = "";
-
-    src = pkgs.fetchurl {
-      url = "mirror://pypi/d/devpi-server/devpi-server-${version}.tar.gz";
-      sha256 = "1icbn1nw6w0sc5150fr69rlhs0j5ldnnxfzl2qabq2wi0dbar8hf";
-    };
-
-    propagatedBuildInputs = with pkgs.python3Packages;
-      [ devpi-common-3 execnet itsdangerous pluggy waitress pyramid ];
-    buildInputs = with pkgs.python3Packages; [ pytest beautifulsoup4 webtest ];
-
-    meta = {
-      homepage = https://bitbucket.org/hpk42/devpi;
-      description = "Devpi Server";
-      license = licenses.mit;
-      maintainers = with maintainers; [ makefu ];
-    };
-  };
-
 in {
-  inherit devpi-server devpi-client;
   devpi-web =  pkgs.python3.buildEnv.override {
       extraLibs = [ devpi-web devpi-server ];
     };
diff --git a/makefu/5pkgs/pkg2zip/default.nix b/makefu/5pkgs/pkg2zip/default.nix
new file mode 100644
index 000000000..36c3d7176
--- /dev/null
+++ b/makefu/5pkgs/pkg2zip/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, lib, pkgs, fetchFromGitHub, ... }:
+stdenv.mkDerivation rec {
+  name = "pkg2zip-2017-12-01";
+  rev = "fccad26";
+
+  src = fetchFromGitHub {
+    owner = "mmozeiko";
+    repo = "pkg2zip";
+    inherit rev;
+    sha256 = "1sq9yx5cbllmc0yyxhvb6c0yq1mkd1mn8njgkkgxz8alw9zwlarp";
+  };
+
+  installPhase = ''
+    install -m755 -D pkg2zip $out/bin/pkg2zip
+
+    install -m755 -D rif2zrif.py $out/bin/rif2zrif
+    install -m755 -D zrif2rif.py $out/bin/zrif2rif
+  '';
+
+  buildInputs = with pkgs;[
+    python3
+  ];
+
+  meta = {
+    homepage = https://github.com/St4rk/PkgDecrypt;
+    description = "St4rk's Vita pkg decrypter";
+    license = lib.licenses.gpl2;
+  };
+}
diff --git a/makefu/6tests/data/secrets/bgt_cyberwar_hidden_service/hostname b/makefu/6tests/data/secrets/bgt_cyberwar_hidden_service/hostname
new file mode 100644
index 000000000..2ae3807f1
--- /dev/null
+++ b/makefu/6tests/data/secrets/bgt_cyberwar_hidden_service/hostname
@@ -0,0 +1 @@
+dickbutt2342.onion
diff --git a/makefu/source.nix b/makefu/source.nix
index aa49062e9..ce5855430 100644
--- a/makefu/source.nix
+++ b/makefu/source.nix
@@ -11,7 +11,7 @@ let
               then "buildbot"
               else "makefu";
   _file = <stockholm> + "/makefu/1systems/${name}/source.nix";
-  ref = "6778819"; # unstable @ 2017-11-14
+  ref = "3874de4"; # unstable @ 2017-12-08
                    # + do_sqlite3 ruby: 55a952be5b5
 
 in