Merge remote-tracking branch 'gum/master'

15 files changed, 608 insertions, 36 deletions

diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
new file mode 100644
index 000000000..6ae79398a
--- /dev/null
+++ b/makefu/1systems/omo.nix
@@ -0,0 +1,37 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ../2configs/fs/single-partition-ext4.nix
+      ../2configs/tinc-basic-retiolum.nix
+      ../2configs/exim-retiolum.nix
+    ];
+  krebs.build.host = config.krebs.hosts.omo;
+
+  # AMD E350
+  boot = {
+    loader.grub.device = "/dev/sda";
+
+    initrd.availableKernelModules = [
+      "usb_storage"
+      "ahci"
+      "xhci_hcd"
+      "ata_piix"
+      "uhci_hcd"
+      "ehci_pci"
+    ];
+
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+  };
+
+  hardware.enableAllFirmware = true;
+  hardware.cpu.amd.updateMicrocode = true;
+
+  networking.firewall.allowPing = true;
+}
diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix
index 977289470..28b77d330 100644
--- a/makefu/1systems/pornocauster.nix
+++ b/makefu/1systems/pornocauster.nix
@@ -6,14 +6,12 @@
 {
   imports =
     [ # Include the results of the hardware scan.
-      ../2configs/main-laptop.nix #< base-gui
+      ../2configs/main-laptop.nix #< base-gui + zsh
 
       # Krebs
       ../2configs/tinc-basic-retiolum.nix
       #../2configs/disable_v6.nix
 
-      # environment
-      ../2configs/zsh-user.nix
 
       # applications
 
@@ -36,11 +34,17 @@
       # ../2configs/mediawiki.nix
       #../2configs/wordpress.nix
     ];
-  nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
+  nixpkgs.config.packageOverrides = pkgs: {
+    tinc = pkgs.tinc_pre;
+    buildbot = let
+      pkgs1509 = import (fetchTarball https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz) {};
+      in pkgs1509.buildbot;
+  };
+  makefu.buildbot.master.enable = true;
+
   #krebs.Reaktor.enable = true;
   #krebs.Reaktor.nickname = "makefu|r";
-
-  krebs.build.host = config.krebs.hosts.pornocauster;
+  # nix.binaryCaches = [ "http://acng.shack/nixos" "https://cache.nixos.org" ];
 
   environment.systemPackages = with pkgs;[
     get
@@ -58,4 +62,5 @@
     25
   ];
 
+  krebs.build.host = config.krebs.hosts.pornocauster;
 }
diff --git a/makefu/1systems/vbob.nix b/makefu/1systems/vbob.nix
index 4d8e8ced1..5b03d40a8 100644
--- a/makefu/1systems/vbob.nix
+++ b/makefu/1systems/vbob.nix
@@ -1,9 +1,10 @@
 #
 #
 #
-{ config, pkgs, ... }:
-
-{
+{ lib, config, pkgs, ... }:
+let
+    pkgs-unst = import (fetchTarball https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz) {};
+in {
   krebs.build.host = config.krebs.hosts.vbob;
   krebs.build.target = "root@10.10.10.220";
   imports =
@@ -12,13 +13,52 @@
       ../2configs/main-laptop.nix #< base-gui
 
       # environment
-      ../2configs/zsh-user.nix
-      ../2configs/virtualization.nix
+
     ];
-  nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
+  nixpkgs.config.packageOverrides = pkgs: {
+    tinc = pkgs.tinc_pre;
+    buildbot = pkgs-unst.buildbot;
+    buildbot-slave = pkgs-unst.buildbot-slave;
+  };
+
+  makefu.buildbot.master = {
+    enable = true;
+    irc = {
+      enable = true;
+      server = "cd.retiolum";
+      channel = "retiolum";
+      allowForce = true;
+    };
+  };
+  makefu.buildbot.slave = {
+    enable = true;
+    masterhost = "localhost";
+    username = "testslave";
+    password = "krebspass";
+  };
+
+  krebs.build.source.git.nixpkgs = {
+    #url = https://github.com/nixos/nixpkgs;
+    # HTTP Everywhere
+    rev = "a3974e";
+  };
+  fileSystems."/nix" = {
+    device ="/dev/disk/by-label/nixstore";
+    fsType = "ext4";
+  };
+  #makefu.buildbot.master.enable = true;
+  # allow vbob to deploy self
+  users.extraUsers = {
+    root = {
+        openssh.authorizedKeys.keys = [ config.krebs.users.makefu-vbob.pubkey  ];
+    };
+  };
   environment.systemPackages = with pkgs;[
+    buildbot
+    buildbot-slave
     get
-    ];
+    genid
+  ];
 
   networking.firewall.allowedTCPPorts = [
     25
@@ -32,8 +72,8 @@
     connectTo = [
       "gum"
     ];
-
   };
+
   networking.proxy.default = "http://global.proxy.alcatel-lucent.com:8000";
   fileSystems."/media/share" = {
     fsType = "vboxsf";
@@ -42,3 +82,4 @@
   };
 
 }
+
diff --git a/makefu/2configs/Reaktor/full.nix b/makefu/2configs/Reaktor/full.nix
new file mode 100644
index 000000000..50620890f
--- /dev/null
+++ b/makefu/2configs/Reaktor/full.nix
@@ -0,0 +1,18 @@
+_:
+{
+  # implementation of the complete Reaktor bot
+  imports = [
+      #./stockholmLentil.nix
+      ./simpleExtend.nix
+      ./random-emoji.nix
+      ./titlebot.nix
+      ./shack-correct.nix
+      ./sed-plugin.nix
+  ];
+  krebs.Reaktor.nickname = "Reaktor|bot";
+  krebs.Reaktor.enable = true;
+
+  krebs.Reaktor.extraEnviron = {
+    REAKTOR_CHANNELS = "#krebs,#binaergewitter,#shackspace";
+  };
+}
diff --git a/makefu/2configs/Reaktor/sed-plugin.nix b/makefu/2configs/Reaktor/sed-plugin.nix
index 1ec977116..a451e0d3e 100644
--- a/makefu/2configs/Reaktor/sed-plugin.nix
+++ b/makefu/2configs/Reaktor/sed-plugin.nix
@@ -7,7 +7,7 @@ in {
   #TODO: this will eat up the last regex, fix Reaktor
   krebs.Reaktor.extraConfig = ''
   public_commands.append({
-    'capname' : "shack-correct",
+    'capname' : "sed-plugin",
     # only support s///gi
     'pattern' : '^(?P<args>.*)$$',
     'argv'    : ["${pkgs.python3}/bin/python3","${script}"],
diff --git a/makefu/2configs/base-gui.nix b/makefu/2configs/base-gui.nix
index 16a5386ca..1d6750284 100644
--- a/makefu/2configs/base-gui.nix
+++ b/makefu/2configs/base-gui.nix
@@ -73,4 +73,33 @@ in
      enable = true;
    #  systemWide = true;
   };
+  services.xserver.displayManager.sessionCommands = let
+    xdefaultsfile = pkgs.writeText "Xdefaults"  ''
+      cat |derp <<EOF
+      XTerm*background: black
+      XTerm*foreground: white
+      XTerm*FaceName  : Terminus:pixelsize=14
+
+      URxvt*termName:         rxvt
+      URxvt.scrollBar : False
+      URxvt*scrollBar_right:  false
+      URxvt*borderLess:       false
+      URxvt.foreground: white
+      URxvt.background: black
+      URxvt.urgentOnBell: true
+      URxvt.visualBell: false
+      URxvt.font : xft:Terminus
+
+      ! blue
+      URxvt*color4:                         #268bd2
+
+
+      URxvt.perl-ext:      default,url-select
+      URxvt.keysym.M-u:    perl:url-select:select_next
+      #URxvt.url-select.launcher:   firefox -new-tab
+      URxvt.url-select.launcher:   chromium
+      URxvt.url-select.underline: true
+      URxvt.searchable-scrollback: CM-s
+    '';
+    in "cat ${xdefaultsfile} | xrdb -merge";
 }
diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix
index 519635281..c0d7685e3 100644
--- a/makefu/2configs/default.nix
+++ b/makefu/2configs/default.nix
@@ -104,6 +104,8 @@ with lib;
       HISTSIZE=900001
       HISTFILESIZE=$HISTSIZE
 
+      PYTHONSTARTUP="~/.pythonrc";
+
       shopt -s checkhash
       shopt -s histappend histreedit histverify
       shopt -s no_empty_cmd_completion
@@ -123,6 +125,9 @@ with lib;
 
   environment.shellAliases = {
     lsl = "ls -lAtr";
+    psg = "ps -ef | grep";
+    nmap = "nmap -oN $HOME/loot/scan-`date +\%s`.nmap -oX $HOME/loot/scan-`date +%s`.xml";
+    grep = "grep --color=auto";
   };
 
   nixpkgs.config.packageOverrides = pkgs: {
diff --git a/makefu/2configs/git/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix
index 68fd976d6..35bb169cf 100644
--- a/makefu/2configs/git/cgit-retiolum.nix
+++ b/makefu/2configs/git/cgit-retiolum.nix
@@ -80,26 +80,6 @@ let
       };
 
 in {
-  imports = [{
-    krebs.users = {
-      makefu-omo = {
-        name = "makefu-omo" ;
-        pubkey= with builtins; readFile ../../../krebs/Zpubkeys/makefu_omo.ssh.pub;
-      };
-      makefu-vbob = {
-        name = "makefu-vbob" ;
-        pubkey= with builtins; readFile ../../../krebs/Zpubkeys/makefu_vbob.ssh.pub;
-      };
-      makefu-tsp = {
-        name = "makefu-tsp" ;
-        pubkey= with builtins; readFile ../../../krebs/Zpubkeys/makefu_tsp.ssh.pub;
-      };
-      exco = {
-        name = "exco";
-        pubkey= with builtins; readFile ../../../krebs/Zpubkeys/exco.ssh.pub;
-      };
-    };
-  }];
   krebs.git = {
     enable = true;
     root-title = "public repositories";
diff --git a/makefu/2configs/main-laptop.nix b/makefu/2configs/main-laptop.nix
index 00a3e73ca..b725f661d 100644
--- a/makefu/2configs/main-laptop.nix
+++ b/makefu/2configs/main-laptop.nix
@@ -9,6 +9,7 @@ with lib;
   imports = [
     ./base-gui.nix
     ./fetchWallpaper.nix
+    ./zsh-user.nix
   ];
   environment.systemPackages = with pkgs;[
     vlc
diff --git a/makefu/2configs/nginx/euer.test.nix b/makefu/2configs/nginx/euer.test.nix
new file mode 100644
index 000000000..ffdc0bc60
--- /dev/null
+++ b/makefu/2configs/nginx/euer.test.nix
@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  hostname = config.krebs.build.host.name;
+  user = config.services.nginx.user;
+  group = config.services.nginx.group;
+  external-ip = head config.krebs.build.host.nets.internet.addrs4;
+  internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
+in {
+  krebs.nginx = {
+    enable = mkDefault true;
+    servers = {
+      euer-share = {
+        listen = [ ];
+        server-names = [ "share.euer.krebsco.de" ];
+        locations = singleton (nameValuePair "/" ''
+          proxy_set_header   Host $host;
+          proxy_set_header   X-Real-IP          $remote_addr;
+          proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_pass http://localhost:8000/;
+        '');
+      };
+    };
+  };
+}
diff --git a/makefu/2configs/wwan.nix b/makefu/2configs/wwan.nix
index dd1c63090..29a610ac6 100644
--- a/makefu/2configs/wwan.nix
+++ b/makefu/2configs/wwan.nix
@@ -9,6 +9,10 @@ in {
     wvdial
   ];
 
+  environment.shellAliases = {
+    umts = "sudo wvdial netzclub";
+  };
+
   # configure for NETZCLUB
   environment.wvdial.dialerDefaults = ''
     Phone = *99***1#
diff --git a/makefu/2configs/zsh-user.nix b/makefu/2configs/zsh-user.nix
index 3089b706a..1b1762418 100644
--- a/makefu/2configs/zsh-user.nix
+++ b/makefu/2configs/zsh-user.nix
@@ -5,6 +5,46 @@ let
   mainUser = config.krebs.build.user.name;
 in
 {
-  programs.zsh.enable = true;
   users.extraUsers.${mainUser}.shell = "/run/current-system/sw/bin/zsh";
+  programs.zsh= {
+    enable = true;
+    interactiveShellInit = ''
+      HISTSIZE=900001
+      HISTFILESIZE=$HISTSIZE
+      SAVEHIST=$HISTSIZE
+
+      setopt HIST_IGNORE_ALL_DUPS
+      setopt HIST_IGNORE_SPACE
+      setopt HIST_FIND_NO_DUPS
+      bindkey -e
+      # shift-tab
+      bindkey '^[[Z' reverse-menu-complete
+
+      autoload -U compinit && compinit
+      zstyle ':completion:*' menu select
+
+      # load gpg-agent
+      envfile="$HOME/.gnupg/gpg-agent.env"
+      if [ -e "$envfile" ] && kill -0 $(grep GPG_AGENT_INFO "$envfile" | cut -d: -f 2) 2>/dev/null; then
+        eval "$(cat "$envfile")"
+      else
+        eval "$(${pkgs.gnupg}/bin/gpg-agent --daemon --enable-ssh-support --write-env-file "$envfile")"
+      fi
+      export GPG_AGENT_INFO
+      export SSH_AUTH_SOCK
+      '';
+
+    promptInit = ''
+      RPROMPT=""
+      autoload colors && colors
+      case $UID in
+         0) PROMPT="%{$fg[red]%}%~%{$reset_color%} " ;;
+      9001) PROMPT="%{$fg[green]%}%~%{$reset_color%} " ;;
+         *) PROMPT="%{$fg[yellow]%}%n %{$fg[green]%}%~%{$reset_color%} " ;;
+      esac
+      if test -n "$SSH_CLIENT"; then
+        PROMPT="%{$fg[magenta]%}%m $PROMPT"
+      fi
+      '';
+  };
 }
diff --git a/makefu/3modules/buildbot/master.nix b/makefu/3modules/buildbot/master.nix
new file mode 100644
index 000000000..5d340f899
--- /dev/null
+++ b/makefu/3modules/buildbot/master.nix
@@ -0,0 +1,226 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+let
+  buildbot = pkgs.buildbot;
+  buildbot-master-config = pkgs.writeText "buildbot-master.cfg" ''
+    # -*- python -*-
+    from buildbot.plugins import *
+
+    c = BuildmasterConfig = {}
+
+    c['slaves'] = []
+    # TODO: template potential buildslaves
+    # TODO: set password?
+    slavenames= [ 'testslave' ]
+    for i in slavenames:
+      c['slaves'].append(buildslave.BuildSlave(i, "krebspass"))
+
+    c['protocols'] = {'pb': {'port': 9989}}
+
+    ####### Build Inputs
+    stockholm_repo = 'http://cgit.gum/stockholm'
+    c['change_source'] = []
+    c['change_source'].append(changes.GitPoller(
+            stockholm_repo,
+            workdir='stockholm-poller', branch='master',
+            project='stockholm',
+            pollinterval=300))
+
+    ####### Build Scheduler
+    # TODO: configure scheduler
+    important_files = util.ChangeFilter(
+                  project_re="^((krebs|share)/.*|Makefile|default.nix)",
+                  branch='master')
+    c['schedulers'] = []
+    c['schedulers'].append(schedulers.SingleBranchScheduler(
+                                name="all-important-files",
+                                change_filter=important_files,
+                                # 3 minutes stable tree
+                                treeStableTimer=3*60,
+                                builderNames=["runtests"]))
+    c['schedulers'].append(schedulers.ForceScheduler(
+                                name="force",
+                                builderNames=["runtests"]))
+    ###### The actual build
+    factory = util.BuildFactory()
+    factory.addStep(steps.Git(repourl=stockholm_repo, mode='incremental'))
+
+    deps = [ "gnumake", "jq" ]
+    factory.addStep(steps.ShellCommand(command=["nix-shell", "-p" ] + deps ))
+    factory.addStep(steps.ShellCommand(env={"LOGNAME": "shared"},
+                                       command=["make", "get=krebs.deploy",
+                                                        "system=test-centos7"]))
+
+    # TODO: different Builders?
+    c['builders'] = []
+    c['builders'].append(
+        util.BuilderConfig(name="runtests",
+          # TODO: only some slaves being used in builder?
+          slavenames=slavenames,
+          factory=factory))
+
+    ####### Status of Builds
+    c['status'] = []
+
+    from buildbot.status import html
+    from buildbot.status.web import authz, auth
+    # TODO: configure if http is wanted
+    authz_cfg=authz.Authz(
+        # TODO: configure user/pw
+        auth=auth.BasicAuth([("krebs","bob")]),
+        gracefulShutdown = False,
+        forceBuild = 'auth',
+        forceAllBuilds = 'auth',
+        pingBuilder = False,
+        stopBuild = False,
+        stopAllBuilds = False,
+        cancelPendingBuild = False,
+    )
+    # TODO: configure nginx
+    c['status'].append(html.WebStatus(http_port=8010, authz=authz_cfg))
+
+    from buildbot.status import words
+    ${optionalString (cfg.irc.enable) ''
+      irc = words.IRC("${cfg.irc.server}", "krebsbuild",
+                      # TODO: multiple channels
+                      channels=["${cfg.irc.channel}"],
+                      notify_events={
+                        'success': 1,
+                        'failure': 1,
+                        'exception': 1,
+                        'successToFailure': 1,
+                        'failureToSuccess': 1,
+                      }${optionalString cfg.irc.allowForce ",allowForce=True"})
+      c['status'].append(irc)
+      ''}
+
+    ####### PROJECT IDENTITY
+    c['title'] = "Stockholm"
+    c['titleURL'] = "http://krebsco.de"
+
+    c['buildbotURL'] = "http://buildbot.krebsco.de/"
+
+    ####### DB URL
+    c['db'] = {
+        'db_url' : "sqlite:///state.sqlite",
+    }
+    ${cfg.extraConfig}
+    '';
+
+  cfg = config.makefu.buildbot.master;
+
+  api = {
+    enable = mkEnableOption "Buildbot Master";
+
+    workDir = mkOption {
+      default = "/var/lib/buildbot/master";
+      type = types.str;
+      description = ''
+        Path to build bot master directory.
+        Will be created on startup.
+      '';
+    };
+    irc = mkOption {
+      default = {};
+      type = types.submodule ({ config, ... }: {
+        options = {
+          enable = mkEnableOption "Buildbot Master IRC Status";
+          channel = mkOption {
+            default = "nix-buildbot-meetup";
+            type = types.str;
+            description = ''
+              irc channel the bot should connect to
+            '';
+          };
+          allowForce = mkOption {
+            default = false;
+            type = types.bool;
+            description = ''
+              Determines if builds can be forced via IRC
+            '';
+          };
+          nick = mkOption {
+            default = "nix-buildbot";
+            type = types.str;
+            description = ''
+              nickname for IRC
+            '';
+          };
+          server = mkOption {
+            default = "irc.freenode.net";
+            type = types.str;
+            description = ''
+              Buildbot Status IRC Server to connect to
+            '';
+          };
+        };
+      });
+    };
+    extraConfig = mkOption {
+      default = "";
+      type = types.lines;
+      description = ''
+        extra config appended to the generated master.cfg
+      '';
+    };
+  };
+
+  imp = {
+
+    users.extraUsers.buildbotMaster = {
+      uid = 672626386; #genid buildbotMaster
+      description = "Buildbot Master";
+      home = cfg.workDir;
+      createHome = false;
+    };
+
+    users.extraGroups.buildbotMaster = {
+      gid = 672626386;
+    };
+
+    systemd.services.buildbotMaster = {
+      description = "Buildbot Master";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = let
+        workdir="${lib.shell.escape cfg.workDir}";
+      in {
+        PermissionsStartOnly = true;
+        Type = "forking";
+        PIDFile = "${workdir}/twistd.pid";
+        # TODO: maybe also prepare buildbot.tac?
+        ExecStartPre = pkgs.writeScript "buildbot-master-init" ''
+          #!/bin/sh
+          set -efux
+          if [ ! -e ${workdir} ];then
+            mkdir -p ${workdir}
+            ${buildbot}/bin/buildbot create-master -r -l 10 -f ${workdir}
+          fi
+          # always override the master.cfg
+          cp ${buildbot-master-config} ${workdir}/master.cfg
+          # sanity
+          ${buildbot}/bin/buildbot checkconfig ${workdir}
+
+          # TODO: maybe upgrade? not sure about this
+          #       normally we should write buildbot.tac by our own
+          # ${buildbot}/bin/buildbot upgrade-master ${workdir}
+
+          chmod 700 -R ${workdir}
+          chown buildbotMaster:buildbotMaster -R ${workdir}
+        '';
+        ExecStart = "${buildbot}/bin/buildbot start ${workdir}";
+        ExecStop = "${buildbot}/bin/buildbot stop ${workdir}";
+        ExecReload = "${buildbot}/bin/buildbot reconfig ${workdir}";
+        PrivateTmp = "true";
+        User = "buildbotMaster";
+        Restart = "always";
+        RestartSec = "10";
+      };
+    };
+  };
+in
+{
+  options.makefu.buildbot.master = api;
+  config = mkIf cfg.enable imp;
+}
diff --git a/makefu/3modules/buildbot/slave.nix b/makefu/3modules/buildbot/slave.nix
new file mode 100644
index 000000000..188a9283c
--- /dev/null
+++ b/makefu/3modules/buildbot/slave.nix
@@ -0,0 +1,159 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+let
+  buildbot-slave-init = pkgs.writeText "buildbot-slave.tac" ''
+    import os
+
+    from buildslave.bot import BuildSlave
+    from twisted.application import service
+
+    basedir = '${cfg.workDir}'
+    rotateLength = 10000000
+    maxRotatedFiles = 10
+
+    application = service.Application('buildslave')
+
+    from twisted.python.logfile import LogFile
+    from twisted.python.log import ILogObserver, FileLogObserver
+    logfile = LogFile.fromFullPath(os.path.join(basedir, "twistd.log"), rotateLength=rotateLength,
+                                  maxRotatedFiles=maxRotatedFiles)
+    application.setComponent(ILogObserver, FileLogObserver(logfile).emit)
+
+    buildmaster_host = '${cfg.masterhost}'
+    # TODO: masterport?
+    port = 9989
+    slavename = '${cfg.username}'
+    passwd = '${cfg.password}'
+    keepalive = 600
+    usepty = 0
+    umask = None
+    maxdelay = 300
+    allow_shutdown = None
+
+    ${cfg.extraConfig}
+
+    s = BuildSlave(buildmaster_host, port, slavename, passwd, basedir,
+                  keepalive, usepty, umask=umask, maxdelay=maxdelay,
+                  allow_shutdown=allow_shutdown)
+    s.setServiceParent(application)
+    '';
+
+  cfg = config.makefu.buildbot.slave;
+
+  api = {
+    enable = mkEnableOption "Buildbot Slave";
+
+    workDir = mkOption {
+      default = "/var/lib/buildbot/slave";
+      type = types.str;
+      description = ''
+        Path to build bot slave directory.
+        Will be created on startup.
+      '';
+    };
+
+    masterhost = mkOption {
+      default = "localhost";
+      type = types.str;
+      description = ''
+        Hostname/IP of the buildbot master
+      '';
+    };
+
+    username = mkOption {
+      type = types.str;
+      description = ''
+        slavename used to authenticate with master
+      '';
+    };
+
+    password = mkOption {
+      type = types.str;
+      description = ''
+        slave password used to authenticate with master
+      '';
+    };
+
+    contact = mkOption {
+      default = "nix slave <buildslave@${config.networking.hostName}>";
+      type = types.str;
+      description = ''
+        contact to be announced by buildslave
+      '';
+    };
+
+    description = mkOption {
+      default = "Nix Generated BuildSlave";
+      type = types.str;
+      description = ''
+        description for hostto be announced by buildslave
+      '';
+    };
+
+    extraConfig = mkOption {
+      default = "";
+      type = types.lines;
+      example = ''
+        port = 443
+        keepalive = 600
+      '';
+      description = ''
+        extra config evaluated before calling BuildSlave init in .tac file
+      '';
+    };
+  };
+
+  imp = {
+
+    users.extraUsers.buildbotSlave = {
+      uid = 1408105834; #genid buildbotMaster
+      description = "Buildbot Slave";
+      home = cfg.workDir;
+      createHome = false;
+    };
+
+    users.extraGroups.buildbotSlave = {
+      gid = 1408105834;
+    };
+
+    systemd.services."buildbotSlave-${cfg.username}-${cfg.masterhost}" = {
+      description = "Buildbot Slave for ${cfg.username}@${cfg.masterhost}";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = let
+        workdir = "${lib.shell.escape cfg.workDir}";
+        contact = "${lib.shell.escape cfg.contact}";
+        description = "${lib.shell.escape cfg.description}";
+        buildbot = pkgs.buildbot-slave;
+        # TODO:make this
+      in {
+        PermissionsStartOnly = true;
+        Type = "forking";
+        PIDFile = "${workdir}/twistd.pid";
+        # TODO: maybe also prepare buildbot.tac?
+        ExecStartPre = pkgs.writeScript "buildbot-master-init" ''
+          #!/bin/sh
+          set -efux
+          mkdir -p ${workdir}/info
+          cp ${buildbot-slave-init} ${workdir}/buildbot.tac
+          echo ${contact} > ${workdir}/info/admin
+          echo ${description} > ${workdir}/info/host
+
+          chown buildbotSlave:buildbotSlave -R ${workdir}
+          chmod 700 -R ${workdir}
+        '';
+        ExecStart = "${buildbot}/bin/buildslave start ${workdir}";
+        ExecStop = "${buildbot}/bin/buildslave stop ${workdir}";
+        PrivateTmp = "true";
+        User = "buildbotSlave";
+        Restart = "always";
+        RestartSec = "10";
+      };
+    };
+  };
+in
+{
+  options.makefu.buildbot.slave = api;
+  config = mkIf cfg.enable imp;
+}
diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix
index a8a1f69d0..4b2b36e64 100644
--- a/makefu/3modules/default.nix
+++ b/makefu/3modules/default.nix
@@ -2,6 +2,7 @@ _:
 
 {
   imports = [
+    ./buildbot/master.nix
   ];
 }