Merge remote-tracking branch 'gum/master'

51 files changed, 913 insertions, 267 deletions

diff --git a/makefu/0tests/data/secrets/mqtt/hass b/makefu/0tests/data/secrets/mqtt/hass
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/0tests/data/secrets/mqtt/hass
diff --git a/makefu/0tests/data/secrets/mqtt/sensor b/makefu/0tests/data/secrets/mqtt/sensor
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/0tests/data/secrets/mqtt/sensor
diff --git a/makefu/0tests/data/secrets/mqtt/stats b/makefu/0tests/data/secrets/mqtt/stats
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/0tests/data/secrets/mqtt/stats
diff --git a/makefu/1systems/crapi/README b/makefu/1systems/crapi/README
new file mode 100644
index 000000000..9278c764a
--- /dev/null
+++ b/makefu/1systems/crapi/README
@@ -0,0 +1,4 @@
+1. flash arm6 image from https://www.cs.helsinki.fi/u/tmtynkky/nixos-arm/installer/ to sdcard
+2. passwd; systemctl start sshd; mkdir /var/src ; touch /var/src/.populate
+3. "environment.systemPackages = [ pkgs.rsync pkgs.git ];" in /etc/nixos/configuration.nix
+5. nixos-rebuild switch --fast --option binary-caches http://nixos-arm.dezgeg.me/channel --option binary-cache-public-keys nixos-arm.dezgeg.me-1:xBaUKS3n17BZPKeyxL4JfbTqECsT+ysbDJz29kLFRW0=%
diff --git a/makefu/1systems/crapi/config.nix b/makefu/1systems/crapi/config.nix
new file mode 100644
index 000000000..d96b872d5
--- /dev/null
+++ b/makefu/1systems/crapi/config.nix
@@ -0,0 +1,46 @@
+{ config, pkgs, lib, ... }:
+{
+  # :l <nixpkgs>
+  # builtins.readDir (pkgs.fetchFromGitHub { owner = "nixos"; repo = "nixpkgs-channels"; rev = "6c064e6b"; sha256 = "1rqzh475xn43phagrr30lb0fd292c1s8as53irihsnd5wcksnbyd"; })
+  imports = [
+    <stockholm/makefu>
+    <stockholm/makefu/2configs>
+    <stockholm/makefu/2configs/tinc/retiolum.nix>
+    <stockholm/makefu/2configs/save-diskspace.nix>
+
+  ];
+  krebs.build.host = config.krebs.hosts.crapi;
+  # NixOS wants to enable GRUB by default
+  boot.loader.grub.enable = false;
+
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  boot.kernelPackages = pkgs.linuxPackages_rpi;
+
+  nix.binaryCaches = [ "http://nixos-arm.dezgeg.me/channel" ];
+  nix.binaryCachePublicKeys = [ "nixos-arm.dezgeg.me-1:xBaUKS3n17BZPKeyxL4JfbTqECsT+ysbDJz29kLFRW0=%" ];
+
+  fileSystems = {
+    "/boot" = {
+      device = "/dev/disk/by-label/NIXOS_BOOT";
+      fsType = "vfat";
+    };
+    "/" = {
+      device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+    };
+  };
+
+  system.activationScripts.create-swap = ''
+    if [ ! -e /swapfile ]; then
+      fallocate -l 2G /swapfile
+      mkswap /swapfile
+    fi
+  '';
+  swapDevices = [ { device = "/swapfile"; size = 2048; } ];
+
+  nix.package = lib.mkForce pkgs.nixStable;
+  services.openssh.enable = true;
+
+}
diff --git a/makefu/1systems/crapi/source.nix b/makefu/1systems/crapi/source.nix
new file mode 100644
index 000000000..4a4359ee6
--- /dev/null
+++ b/makefu/1systems/crapi/source.nix
@@ -0,0 +1,3 @@
+{
+  arm6 = true;
+}
diff --git a/makefu/1systems/omo/config.nix b/makefu/1systems/omo/config.nix
index 47e815e77..be49db024 100644
--- a/makefu/1systems/omo/config.nix
+++ b/makefu/1systems/omo/config.nix
@@ -17,7 +17,10 @@ in {
       # <stockholm/makefu/2configs/smart-monitor.nix>
       <stockholm/makefu/2configs/mail-client.nix>
       <stockholm/makefu/2configs/mosh.nix>
+      <stockholm/makefu/2configs/tools/core.nix>
+      <stockholm/makefu/2configs/tools/desktop.nix>
       <stockholm/makefu/2configs/tools/mobility.nix>
+      { environment.systemPackages = [ pkgs.esniper ]; }
       # <stockholm/makefu/2configs/disable_v6.nix>
       #<stockholm/makefu/2configs/graphite-standalone.nix>
       #<stockholm/makefu/2configs/share-user-sftp.nix>
@@ -33,12 +36,12 @@ in {
       # logs to influx
       <stockholm/makefu/2configs/stats/external/aralast.nix>
       <stockholm/makefu/2configs/stats/telegraf>
-      <stockholm/makefu/2configs/stats/telegraf/europastats.nix>
+      # <stockholm/makefu/2configs/stats/telegraf/europastats.nix>
+      <stockholm/makefu/2configs/stats/telegraf/hamstats.nix>
       <stockholm/makefu/2configs/stats/arafetch.nix>
 
       # services
       <stockholm/makefu/2configs/syncthing.nix>
-      <stockholm/makefu/2configs/mqtt.nix>
       <stockholm/makefu/2configs/remote-build/slave.nix>
       <stockholm/makefu/2configs/deployment/google-muell.nix>
       <stockholm/makefu/2configs/virtualisation/docker.nix>
@@ -67,8 +70,8 @@ in {
       # <stockholm/makefu/2configs/temp/rst-issue.nix>
 
     ];
-  makefu.full-populate = true;
-  krebs.rtorrent = {
+  makefu.full-populate =  true;
+  krebs.rtorrent = (builtins.trace (builtins.toJSON config.services.telegraf.extraConfig)) {
     downloadDir = lib.mkForce "/media/cryptX/torrent";
     extraConfig = ''
       upload_rate = 200
diff --git a/makefu/1systems/omo/hw/tsp.nix b/makefu/1systems/omo/hw/tsp.nix
index 4af0d73fc..a289fadce 100644
--- a/makefu/1systems/omo/hw/tsp.nix
+++ b/makefu/1systems/omo/hw/tsp.nix
@@ -6,7 +6,8 @@ let
     rev = "9c9b62e15e4ac11d4379e66b974f1389daf939fe";
   });
   cfg = fromJSON (readFile ../../hardware/tsp-disk.json);
-  primaryInterface = "enp1s0";
+  # primaryInterface = "enp1s0";
+  primaryInterface = "wlp2s0";
   rootDisk = "/dev/sda"; # TODO same as disko uses
 in {
   imports = [
@@ -28,5 +29,13 @@ in {
 
     kernelModules = [ "kvm-intel" ];
   };
-
+  networking.wireless.enable = true;
+  hardware.enableRedistributableFirmware = true;
+  hardware.cpu.intel.updateMicrocode = true;
+  services.logind.lidSwitch = "ignore";
+  services.logind.lidSwitchDocked = "ignore";
+  services.logind.extraConfig = ''
+    HandleSuspendKey = ignore
+  '';
+  powerManagement.enable = false;
 }
diff --git a/makefu/1systems/sdev/config.nix b/makefu/1systems/sdev/config.nix
index c2cd23d1e..2f289d500 100644
--- a/makefu/1systems/sdev/config.nix
+++ b/makefu/1systems/sdev/config.nix
@@ -6,13 +6,13 @@
     [ # Include the results of the hardware scan.
       <stockholm/makefu>
 
-     #  <stockholm/makefu/2configs/hw/vbox-guest.nix>
-      { # until virtualbox-image is fixed
-        imports = [
-            <stockholm/makefu/2configs/fs/single-partition-ext4.nix>
-          ];
-        boot.loader.grub.device = "/dev/sda";
-      }
+       <stockholm/makefu/2configs/hw/vbox-guest.nix>
+      #{ # until virtualbox-image is fixed
+      #  imports = [
+      #      <stockholm/makefu/2configs/fs/single-partition-ext4.nix>
+      #    ];
+      #  boot.loader.grub.device = lib.mkForce "/dev/sda";
+      #}
       <stockholm/makefu/2configs/main-laptop.nix>
       # <secrets/extra-hosts.nix>
 
diff --git a/makefu/1systems/shack-autoinstall/config.nix b/makefu/1systems/shack-autoinstall/config.nix
new file mode 100644
index 000000000..d53c411c0
--- /dev/null
+++ b/makefu/1systems/shack-autoinstall/config.nix
@@ -0,0 +1,49 @@
+{ config, pkgs, lib, ... }:
+
+with import <stockholm/lib>;
+let
+  disk = "/dev/sda";
+in {
+  imports = [
+    <stockholm/makefu>
+    <nixpkgs/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix>
+    <nixpkgs/nixos/modules/installer/cd-dvd/channel.nix>
+    <stockholm/makefu/2configs/tools/core.nix>
+  ];
+  # TODO: NIX_PATH and nix.nixPath are being set by default.nix right now
+  # cd ~/stockholm ; nix-build -A config.system.build.isoImage -I nixos-config=makefu/1systems/iso.nix -I secrets=/home/makefu/secrets/iso /var/src/nixpkgs/nixos
+  krebs.build.host = config.krebs.hosts.iso;
+  krebs.hidden-ssh.enable = true;
+
+  environment.extraInit = ''
+    EDITOR=vim
+  '';
+  # iso-specific
+  boot.kernelParams = [ "copytoram" ];
+
+
+  environment.systemPackages = [
+    pkgs.parted
+    (  pkgs.writeScriptBin "shack-install" ''
+      #! /bin/sh
+      echo "go ahead and try NIX_PATH=/root/.nix-defexpr/channels/ nixos-install"
+    '')
+  ];
+
+  systemd.services.wpa_supplicant.wantedBy = lib.mkForce [ "multi-user.target" ];
+
+  networking.wireless = {
+    enable = true;
+    networks.shack.psk = "welcome2shack";
+  };
+
+
+  services.openssh = {
+    enable = true;
+    hostKeys = [
+      { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
+    ];
+  };
+  # enable ssh in the iso boot process
+  systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ];
+}
diff --git a/makefu/1systems/shack-autoinstall/grub-partition.sh b/makefu/1systems/shack-autoinstall/grub-partition.sh
new file mode 100644
index 000000000..c23c89799
--- /dev/null
+++ b/makefu/1systems/shack-autoinstall/grub-partition.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+set -euf
+parted -s ${disk} mklabel msdos
+parted -s ${disk} -- mkpart primary linux-swap 1M 4096M
+parted -s ${disk} -- mkpart primary ext2 4096M 100%
diff --git a/makefu/1systems/shack-autoinstall/shack-config.nix b/makefu/1systems/shack-autoinstall/shack-config.nix
new file mode 100644
index 000000000..9fa54ae32
--- /dev/null
+++ b/makefu/1systems/shack-autoinstall/shack-config.nix
@@ -0,0 +1,231 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    # TODO:
+  ];
+
+  # shacks-specific
+  networking.wireless = {
+    enable = true;
+    networks.shack.psk = "181471eb97eb23f12c6871227bc4a7b13c8f6af56dcc0d0e8b71f4d7a510cb4e";
+  };
+  networking.hostName = "shackbook";
+
+  boot.tmpOnTmpfs = true;
+
+  users.users.shack = {
+    createHome = true;
+    useDefaultShell = true;
+    home = "/home/shack";
+    uid = 9001;
+    packages = with pkgs;[
+      chromium
+      firefox
+    ];
+    extraGroups = [ "audio" "wheel"  ];
+    hashedPassword = "$6$KIxlQTLEnKl7cwC$LrmbwZ64Mlm7zqUUZ0EObPJMES3C0mQ6Sw7ynTuXzUo7d9EWg/k5XCGkDHMFvL/Pz19Awcv0knHB1j3dHT6fh/" ;
+  };
+
+  environment.variables = let
+    ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+  in {
+    EDITOR = lib.mkForce "vim";
+    CURL_CA_BUNDLE = ca-bundle;
+    GIT_SSL_CAINFO = ca-bundle;
+    SSL_CERT_FILE  = ca-bundle;
+  };
+
+  services.printing = {
+    enable = true;
+    # TODO: shack-printer
+  };
+
+
+  environment.systemPackages = with pkgs;[
+    parted
+    ddrescue
+    tmux
+    jq git gnumake htop rxvt_unicode.terminfo
+    (pkgs.vim_configurable.customize {
+      name = "vim";
+      vimrcConfig.customRC = ''
+      set nocompatible
+      syntax on
+      set list
+      set listchars=tab:▸\ 
+      "set list listchars=tab:>-,trail:.,extends:>
+
+      filetype off
+      filetype plugin indent on
+
+      colorscheme darkblue
+      set background=dark
+
+      set number
+      set relativenumber
+      set mouse=a
+      set ignorecase
+      set incsearch
+      set wildignore=*.o,*.obj,*.bak,*.exe,*.os
+      set textwidth=79
+      set shiftwidth=2
+      set expandtab
+      set softtabstop=2
+      set shiftround
+      set smarttab
+      set tabstop=2
+      set et
+      set autoindent
+      set backspace=indent,eol,start
+
+
+      inoremap <F1> <ESC>
+      nnoremap <F1> <ESC>
+      vnoremap <F1> <ESC>
+
+      nnoremap <F5> :UndotreeToggle<CR>
+      set undodir  =~/.vim/undo
+      set undofile
+      "maximum number of changes that can be undone
+      set undolevels=1000000
+      "maximum number lines to save for undo on a buffer reload
+      set undoreload=10000000
+
+      nnoremap <F2> :set invpaste paste?<CR>
+      set pastetoggle=<F2>
+      set showmode
+
+      set showmatch
+      set matchtime=3
+      set hlsearch
+
+      autocmd ColorScheme * highlight ExtraWhitespace ctermbg=red guibg=red
+
+
+      " save on focus lost
+      au FocusLost * :wa
+
+      autocmd BufRead *.json set filetype=json
+      au  BufNewFile,BufRead *.mustache set syntax=mustache
+
+      cnoremap SudoWrite w !sudo tee > /dev/null %
+
+      " create Backup/tmp/undo dirs
+      set backupdir=~/.vim/backup
+      set directory=~/.vim/tmp
+
+      function! InitBackupDir()
+        let l:parent = $HOME    . '/.vim/'
+        let l:backup = l:parent . 'backup/'
+        let l:tmpdir = l:parent . 'tmp/'
+        let l:undodir= l:parent . 'undo/'
+
+
+        if !isdirectory(l:parent)
+          call mkdir(l:parent)
+        endif
+        if !isdirectory(l:backup)
+          call mkdir(l:backup)
+        endif
+        if !isdirectory(l:tmpdir)
+          call mkdir(l:tmpdir)
+        endif
+        if !isdirectory(l:undodir)
+          call mkdir(l:undodir)
+        endif
+      endfunction
+      call InitBackupDir()
+
+      augroup Binary
+        " edit binaries in xxd-output, xxd is part of vim
+        au!
+        au BufReadPre  *.bin let &bin=1
+        au BufReadPost *.bin if &bin | %!xxd
+        au BufReadPost *.bin set ft=xxd | endif
+        au BufWritePre *.bin if &bin | %!xxd -r
+        au BufWritePre *.bin endif
+        au BufWritePost *.bin if &bin | %!xxd
+        au BufWritePost *.bin set nomod | endif
+      augroup END
+      '';
+      vimrcConfig.vam.knownPlugins = pkgs.vimPlugins;
+      vimrcConfig.vam.pluginDictionaries = [
+        { names = [ "undotree" ]; }
+        # vim-nix handles indentation better but does not perform sanity
+        { names = [ "vim-addon-nix" ]; ft_regex = "^nix\$"; }
+      ];
+    })
+
+  ];
+  programs.bash = {
+    enableCompletion = true;
+    interactiveShellInit = ''
+      HISTCONTROL='erasedups:ignorespace'
+      HISTSIZE=900001
+      HISTFILESIZE=$HISTSIZE
+      shopt -s checkhash
+      shopt -s histappend histreedit histverify
+      shopt -s no_empty_cmd_completion
+      PS1='\[\e[1;32m\]\w\[\e[0m\] '
+    '';
+  };
+
+  services.journald.extraConfig = ''
+    SystemMaxUse=1G
+    RuntimeMaxUse=128M
+  '';
+  nix = {
+    package = pkgs.nixUnstable;
+    optimise.automatic = true;
+    useSandbox = true;
+    gc.automatic = true;
+  };
+
+  system.autoUpgrade.enable = true;
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.device = "/dev/sda";
+  fileSystems."/".options = [ "noatime" "nodiratime" "discard" ];
+
+
+  # gui and stuff
+  i18n = {
+    consoleFont = "Lat2-Terminus16";
+    consoleKeyMap = "us";
+    defaultLocale = "en_US.UTF-8";
+  };
+
+  fonts = {
+    enableFontDir = true;
+    enableGhostscriptFonts = true;
+    fonts = [ pkgs.terminus_font ];
+  };
+
+  time.timeZone = "Europe/Berlin";
+  services.timesyncd.enable = true;
+
+
+  # GUI
+  hardware.pulseaudio.enable = true;
+  services.xserver = {
+    enable = true;
+    displayManager.auto.enable = true;
+    displayManager.auto.user = "shack";
+
+    desktopManager.xfce.enable = true;
+
+    layout = "us";
+    xkbVariant = "altgr-intl";
+    xkbOptions = "ctrl:nocaps, eurosign:e";
+  };
+
+  services.openssh = {
+    enable = true;
+    hostKeys = [
+      { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
+    ];
+  };
+}
diff --git a/makefu/1systems/shack-autoinstall/uefi-partition.sh b/makefu/1systems/shack-autoinstall/uefi-partition.sh
new file mode 100644
index 000000000..4566b7dce
--- /dev/null
+++ b/makefu/1systems/shack-autoinstall/uefi-partition.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+set -euf
+p(){
+  parted -s ${disk} -- $@
+}
+p mklabel gpt
+p mkpart primary fat32 1M 551M
+p set 1 boot on
+p mkpart primary linux-swap 51M 4647M
+p mkpart primary ext2 4647M 100%
+udevadm settle
+mkfs.fat -nboot -F32 /dev/sda1
+
+udevadm settle
+mkswap ${disk}2 -L swap
+swapon -L swap
+mkfs.ext4 -L nixos ${disk}3
+mount LABEL=nixos /mnt
+mkdir /mnt/boot
+mount LABEL=boot /mnt/boot
+
+mkdir -p /mnt/etc/nixos
+cp ${./shack-config.nix} /mnt/etc/nixos/configuration.nix
+nixos-generate-config --root /mnt
diff --git a/makefu/1systems/tsp/config.nix b/makefu/1systems/tsp/config.nix
index 680fa2cbc..2921e2bcf 100644
--- a/makefu/1systems/tsp/config.nix
+++ b/makefu/1systems/tsp/config.nix
@@ -8,57 +8,32 @@
     [ # Include the results of the hardware scan.
       <stockholm/makefu>
       <stockholm/makefu/2configs/main-laptop.nix>
-      <stockholm/makefu/2configs/tools/all.nix>
-      <stockholm/makefu/2configs/fs/sda-crypto-root.nix>
+      # <stockholm/makefu/2configs/tools/all.nix>
+      <stockholm/makefu/2configs/fs/single-partition-ext4.nix>
       # hardware specifics are in here
       # imports tp-x2x0.nix
-      # <stockholm/makefu/2configs/hw/tp-x200.nix>
+      <stockholm/makefu/2configs/hw/tp-x230.nix>
+      <stockholm/makefu/2configs/hw/bluetooth.nix>
+      <stockholm/makefu/2configs/hw/network-manager.nix>
 
       # <stockholm/makefu/2configs/rad1o.nix>
 
       <stockholm/makefu/2configs/zsh-user.nix>
       <stockholm/makefu/2configs/exim-retiolum.nix>
       <stockholm/makefu/2configs/tinc/retiolum.nix>
+
+      <stockholm/makefu/2configs/sshd-totp.nix>
+      {
+        programs.adb.enable = true;
+      }
     ];
-  # not working in vm
   krebs.build.host = config.krebs.hosts.tsp;
-  boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }];
-  boot.loader.grub.copyKernels = true;
+  boot.loader.grub.device = "/dev/sda";
 
   networking.firewall.allowedTCPPorts = [
     25
   ];
 
-  # acer aspire
-  networking.wireless.enable = lib.mkDefault true;
-
-  services.xserver.synaptics.enable = true;
-
   hardware.enableAllFirmware = true;
   nixpkgs.config.allowUnfree = true;
-
-  hardware.cpu.intel.updateMicrocode = true;
-
-  zramSwap.enable = true;
-  zramSwap.numDevices = 2;
-
-  services.tlp.enable = true;
-  services.tlp.extraConfig = ''
-    # BUG: http://linrunner.de/en/tlp/docs/tlp-faq.html#erratic-battery
-    START_CHARGE_THRESH_BAT0=67
-    STOP_CHARGE_THRESH_BAT0=100
-
-
-    CPU_SCALING_GOVERNOR_ON_AC=performance
-    CPU_SCALING_GOVERNOR_ON_BAT=ondemand
-    CPU_MIN_PERF_ON_AC=0
-    CPU_MAX_PERF_ON_AC=100
-    CPU_MIN_PERF_ON_BAT=0
-    CPU_MAX_PERF_ON_BAT=30
-  '';
-
-  powerManagement.resumeCommands = ''
-    ${pkgs.rfkill}/bin/rfkill unblock all
-  '';
-
 }
diff --git a/makefu/1systems/x/config.nix b/makefu/1systems/x/config.nix
index 54a16a931..97d11fbd3 100644
--- a/makefu/1systems/x/config.nix
+++ b/makefu/1systems/x/config.nix
@@ -1,9 +1,7 @@
 #
 #
 #
-{ config, pkgs, ... }:
-with import <stockholm/lib>;
-
+{ config, pkgs, lib, ... }:
 {
   imports =
     [ # base
@@ -43,6 +41,7 @@ with import <stockholm/lib>;
       <stockholm/makefu/2configs/mail-client.nix>
       <stockholm/makefu/2configs/printer.nix>
       <stockholm/makefu/2configs/task-client.nix>
+      # <stockholm/makefu/2configs/syncthing.nix>
 
       # Virtualization
       <stockholm/makefu/2configs/virtualisation/libvirt.nix>
@@ -149,4 +148,6 @@ with import <stockholm/lib>;
     "/home/makefu/backup/borgun"
     "/home/makefu/.mail/"
   ];
+  services.syncthing.user = lib.mkForce "makefu";
+  services.syncthing.dataDir = lib.mkForce "/home/makefu/.config/syncthing/";
 }
diff --git a/makefu/2configs/deployment/bureautomation/hass.nix b/makefu/2configs/deployment/bureautomation/hass.nix
index d5793f886..4605e8933 100644
--- a/makefu/2configs/deployment/bureautomation/hass.nix
+++ b/makefu/2configs/deployment/bureaut