Merge remote-tracking branch 'ni/master'

10 files changed, 231 insertions, 82 deletions

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index ac0a6af4d..4fc755c43 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -17,6 +17,7 @@ with import <stockholm/lib>;
     ./bash
     ./htop.nix
     ./nginx
+    ./pki
     ./ssh.nix
     ./sshd.nix
     ./vim.nix
@@ -91,15 +92,6 @@ with import <stockholm/lib>;
     }
 
     {
-      environment.variables =
-        flip genAttrs (_: "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt") [
-          "CURL_CA_BUNDLE"
-          "GIT_SSL_CAINFO"
-          "SSL_CERT_FILE"
-        ];
-    }
-
-    {
       services.cron.enable = false;
       services.nscd.enable = false;
       services.ntp.enable = false;
diff --git a/tv/2configs/man.nix b/tv/2configs/man.nix
index 6534e2c0e..0a72dce2a 100644
--- a/tv/2configs/man.nix
+++ b/tv/2configs/man.nix
@@ -8,5 +8,6 @@
   environment.systemPackages = with pkgs; [
     manpages
     posix_man_pages
+    xorg.xorgdocs
   ];
 }
diff --git a/tv/2configs/pki/certs/tv.crt b/tv/2configs/pki/certs/tv.crt
new file mode 100644
index 000000000..ccb2623fb
--- /dev/null
+++ b/tv/2configs/pki/certs/tv.crt
@@ -0,0 +1,31 @@
+tv Root CA
+-----BEGIN CERTIFICATE-----
+MIIFGzCCAwOgAwIBAgIUbLFkDA1OgKbej/FQiJZ4gpGPg/4wDQYJKoZIhvcNAQEL
+BQAwFTETMBEGA1UEAwwKdHYgUm9vdCBDQTAeFw0xOTA0MjEwNzI1MTdaFw0yOTA0
+MTgwNzI1MTdaMBUxEzARBgNVBAMMCnR2IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQDEVpZo1PLayK2AULwNtRY/2RIs/h+Uz1k/I7AY5o7H
+HTD6pxNH3DZS82Y89nAHDVEnotK26TW6N1O2fBHUxH2GXVD+MaA/D9ngbNTJa7DW
+2EThezOyesAbXk7dkoHh4Bouj5L7Ronka5+IREFmb3mHmcXLuR/sot9Pwr9A7Lwm
+55Avv+VwMFnqVMXiCYQsDL7Mxf7Vm79+kXShpfDhNmHhyZc/xPjVk7lttSEp0LCq
+hhJjte3xDGbk7OThTSxoqP+K4Ek7NGatCcm4AUZlDl1kLN2QKudYqj0VRQpfE+4Q
+jMAAtttc/10MV0e08pRK0FvJsDsi70YZrHnDP6hIBrRNjC8iB/8rz2pjnYzgriUt
+HHEDr26234VB5Zqhsi8pmXA16FVkoKlucADXXKEcR/3VreTvZLdSsP3OrDdSCwhi
+H2W/7tshDPp+I9Q9fGNixry7PODbud1h/wLsq3Geg/U6VkDdl7uDNMB/O7LvlFaC
+7jkHv/xFLqV1Xx9+yFMdJTKLf9jnIIjeINfV4VcJZDrtgGpnC6cYD5DNLA4j7Mny
+EnBV9IRhmKiZLvUZP62dPhqIfSSPNxXV2+rT5ZfaXCuVe79R5npgJzF7/qslvnZ6
+0mjZfQdJiXY+/oT9zPUxTroFx7Qtda15aIVwXR+1cMRY/Hg/uBQyp7yWsvwhPYwH
+awIDAQABo2MwYTAdBgNVHQ4EFgQUWYjGpR7J/UqggxQV87hBQ8ZT0qkwHwYDVR0j
+BBgwFoAUWYjGpR7J/UqggxQV87hBQ8ZT0qkwDwYDVR0TAQH/BAUwAwEB/zAOBgNV
+HQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggIBAA++eAA7KLEd4n05n8w95sJ7
+cxqQSkVxV3ASnEUQRwVGo3CqEKcNufbCTG7KKGQFUi2Xd3/SWgnEiSZZWo06azbV
+vlquG+9ilwnrnqfjlbUEjLMHDzukrEeIiRuFY7gZv6S2o4WkW/M9IPkP34+PRjip
+AJ8kFcy7wLPaeH7OagslAVUcf68lMm+8W4U1g0HZaY2zXFgdRrIO1dXKlJ22Wh4X
+fcblHjkASAGi+BK+xRJ9G7s3sie2wPyk+WKKv0Z+WheKf+L+TPBg2sJ+d25gW+gG
+XNJSQOzCqSfHrCtcW1xkGgifog28/ymN03ggn8oMBUebOp+ayLkbPQDaj6te3y1v
+YE0cfkzQ0T6sSzPzoOrwBEuSX8cLWTpzO2Zgqbf36UtHjgxi58vY46p7MjAInxAf
+j+k67rF7qWH38drg4nfGjNgiEdeJw9dtDFdmso+ZiWipUyGF4VYh+Q6JnXDMF0+A
+wXcYWa7ckXvVOLVpHJfrLDYTXznGnk2u4ToVNEk1j/klMRn96lxfFg04iv8fz8m6
+/Y8g0G1uIT5Mq9l68oZUoEkUHZabPNhYOiYtg4t5v/T3AIV8nm2A5jZYj0am26xT
+iqF/tqL3alWXs9OHP7FNdrVWtwO8vcspYcd4mOHdAC/dmhq+77BowR5Lldx9T+mR
+QT8jW9PXL0IH0wKMBXxf
+-----END CERTIFICATE-----
diff --git a/tv/2configs/pki/default.nix b/tv/2configs/pki/default.nix
new file mode 100644
index 000000000..51a5c716f
--- /dev/null
+++ b/tv/2configs/pki/default.nix
@@ -0,0 +1,68 @@
+with import <stockholm/lib>;
+{ config, pkgs, ... }: let
+
+  certFile = config.environment.etc."ssl/certs/ca-certificates.crt".source;
+
+in {
+
+  environment.etc."pki/nssdb".source =
+    pkgs.runCommand "system-wide-nssdb" {
+      inherit certFile;
+      buildInputs = [
+        pkgs.jq
+        pkgs.nssTools
+      ];
+      parseInfoScript = /* jq */ ''
+        ${toJSON certFile} as $certFile |
+
+        split("\t-----END CERTIFICATE-----\n")[] |
+        select(test("\t-----BEGIN CERTIFICATE-----\n")) |
+        . + "\t-----END CERTIFICATE-----\n" |
+
+        sub("^([0-9]+\t\n)*";"") |
+
+        (match("^([0-9]+)\t").captures[0].string | tonumber) as $lineNumber |
+
+        gsub("(?m)^[0-9]+\t";"") |
+
+        match("^([^\n]+)\n(.*)";"m").captures | map(.string) |
+
+        # Line numbers are added to the names to ensure uniqueness.
+        "\(.[0]) (\($certFile):\($lineNumber))" as $name |
+        .[1] as $cert |
+
+        { $name, $cert }
+      '';
+      passAsFile = [
+        "parseInfoScript"
+      ];
+    } /* sh */ ''
+      mkdir nssdb
+
+      nl -ba -w1 "$certFile" |
+      jq -ceRs -f "$parseInfoScriptPath" > certinfo.ndjson
+
+      exec < certinfo.ndjson
+      while read -r certinfo; do
+        name=$(printf %s "$certinfo" | jq -er .name)
+        cert=$(printf %s "$certinfo" | jq -er .cert)
+
+        printf %s "$cert" | certutil -A -d nssdb -n "$name" -t C,C,C
+      done
+
+      mv nssdb "$out"
+    '';
+
+  environment.variables = flip genAttrs (_: toString certFile) [
+    "CURL_CA_BUNDLE"
+    "GIT_SSL_CAINFO"
+    "SSL_CERT_FILE"
+  ];
+
+  security.pki.certificateFiles =
+    mapAttrsToList
+      (name: const (./certs + "/${name}"))
+      (filterAttrs (const (eq "regular"))
+                   (readDir ./certs));
+
+}
diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix
deleted file mode 100644
index d032efc7d..000000000
--- a/tv/2configs/xserver/Xresources.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-
-pkgs.writeText "Xresources" /* xdefaults */ ''
-  URxvt*cutchars: "\\`\"'&()*,;<=>?@[]^{|}‘’"
-  URxvt*eightBitInput: false
-  URxvt*font: -*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1
-  URxvt*boldFont: -*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1
-  URxvt*scrollBar: false
-  URxvt*background: #050505
-  URxvt*foreground: #d0d7d0
-  URxvt*cursorColor: #f042b0
-  URxvt*cursorColor2: #f0b000
-  URxvt*cursorBlink: off
-  URxvt*jumpScroll: true
-  URxvt*allowSendEvents: false
-  URxvt*charClass: 33:48,37:48,45-47:48,64:48,38:48,61:48,63:48
-  URxvt*cutNewline: False
-  URxvt*cutToBeginningOfLine: False
-
-  URxvt*color0: #232342
-  URxvt*color3: #c07000
-  URxvt*color4: #4040c0
-  URxvt*color7: #c0c0c0
-  URxvt*color8: #707070
-  URxvt*color9: #ff6060
-  URxvt*color10: #70ff70
-  URxvt*color11: #ffff70
-  URxvt*color12: #7070ff
-  URxvt*color13: #ff50ff
-  URxvt*color14: #70ffff
-  URxvt*color15: #ffffff
-
-  URxvt*iso14755: False
-
-  URxvt*urgentOnBell: True
-  URxvt*visualBell: True
-
-  ! ref https://github.com/muennich/urxvt-perls
-  URxvt*perl-ext: default,url-select
-  URxvt*keysym.M-u: perl:url-select:select_next
-  URxvt*url-select.launcher: /etc/per-user/${config.krebs.build.user.name}/bin/ff -new-tab
-  URxvt*url-select.underline: true
-  URxvt*colorUL: #4682B4
-  URxvt.perl-lib: ${pkgs.urxvt_perls}/lib/urxvt/perl
-  URxvt*saveLines: 10000
-
-  root-urxvt*background: #230000
-  root-urxvt*foreground: #e0c0c0
-  root-urxvt*BorderColor: #400000
-  root-urxvt*color0: #800000
-
-  fzmenu-urxvt*background: rgb:42/23/42
-  fzmenu-urxvt*externalBorder: 1
-  fzmenu-urxvt*geometry: 70x9
-  fzmenu-urxvt*internalBorder: 1
-''
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 051e12ef0..012caff73 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -9,12 +9,16 @@ let
   };
 in {
 
+  imports = [
+    ./sxiv.nix
+    ./urxvt.nix
+  ];
+
   environment.systemPackages = [
     pkgs.ff
     pkgs.font-size
     pkgs.gitAndTools.qgit
     pkgs.mpv
-    pkgs.sxiv
     pkgs.xdotool
     pkgs.xsel
     pkgs.zathura
@@ -73,7 +77,6 @@ in {
         ${pkgs.xorg.xhost}/bin/xhost -LOCAL:
       } &
       ${pkgs.xorg.xmodmap}/bin/xmodmap ${import ./Xmodmap.nix args} &
-      ${pkgs.xorg.xrdb}/bin/xrdb ${import ./Xresources.nix args} &
       ${pkgs.xorg.xsetroot}/bin/xsetroot -solid '#1c1c1c' &
       wait
     '';
@@ -147,19 +150,6 @@ in {
     };
   };
 
-  systemd.services.urxvtd = {
-    wantedBy = [ "graphical.target" ];
-    restartIfChanged = false;
-    serviceConfig = {
-      SyslogIdentifier = "urxvtd";
-      ExecStart = "${pkgs.rxvt_unicode}/bin/urxvtd";
-      Restart = "always";
-      RestartSec = "2s";
-      StartLimitBurst = 0;
-      User = cfg.user.name;
-    };
-  };
-
   tv.slock = {
     enable = true;
     user = cfg.user;
diff --git a/tv/2configs/xserver/sxiv.nix b/tv/2configs/xserver/sxiv.nix
new file mode 100644
index 000000000..10e450da4
--- /dev/null
+++ b/tv/2configs/xserver/sxiv.nix
@@ -0,0 +1,12 @@
+with import <stockholm/lib>;
+{ config, pkgs, ... }: let
+  cfg.user = config.krebs.build.user;
+in {
+  tv.Xresources = {
+    "Sxiv.foreground" = "#232323";
+    "Sxiv.background" = "#424242";
+  };
+  users.users.${cfg.user.name}.packages = [
+    pkgs.sxiv
+  ];
+}
diff --git a/tv/2configs/xserver/urxvt.nix b/tv/2configs/xserver/urxvt.nix
new file mode 100644
index 000000000..2d504e165
--- /dev/null
+++ b/tv/2configs/xserver/urxvt.nix
@@ -0,0 +1,73 @@
+with import <stockholm/lib>;
+{ config, pkgs, ... }: let
+  cfg.user = config.krebs.build.user;
+in {
+  systemd.services.urxvtd = {
+    wantedBy = [ "graphical.target" ];
+    restartIfChanged = false;
+    serviceConfig = {
+      SyslogIdentifier = "urxvtd";
+      ExecStart = "${pkgs.rxvt_unicode}/bin/urxvtd";
+      Restart = "always";
+      RestartSec = "2s";
+      StartLimitBurst = 0;
+      User = cfg.user.name;
+    };
+  };
+  tv.Xresources = {
+    "URxvt*cutchars" = ''"\\`\"'&()*,;<=>?@[]^{|}‘’"'';
+    "URxvt*eightBitInput" = "false";
+    "URxvt*font" = "-*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1";
+    "URxvt*boldFont" = "-*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1";
+    "URxvt*scrollBar" = "false";
+    "URxvt*background" = "#050505";
+    "URxvt*foreground" = "#d0d7d0";
+    "URxvt*cursorColor" = "#f042b0";
+    "URxvt*cursorColor2" = "#f0b000";
+    "URxvt*cursorBlink" = "off";
+    "URxvt*jumpScroll" = "true";
+    "URxvt*allowSendEvents" = "false";
+    "URxvt*charClass" = "33:48,37-38:48,45-47:48,61:48,63-64:48";
+    "URxvt*cutNewline" = "False";
+    "URxvt*cutToBeginningOfLine" = "False";
+
+    "URxvt*color0" = "#232342";
+    "URxvt*color3" = "#c07000";
+    "URxvt*color4" = "#4040c0";
+    "URxvt*color7" = "#c0c0c0";
+    "URxvt*color8" = "#707070";
+    "URxvt*color9" = "#ff6060";
+    "URxvt*color10" = "#70ff70";
+    "URxvt*color11" = "#ffff70";
+    "URxvt*color12" = "#7070ff";
+    "URxvt*color13" = "#ff50ff";
+    "URxvt*color14" = "#70ffff";
+    "URxvt*color15" = "#ffffff";
+
+    "URxvt*iso14755" = "False";
+
+    "URxvt*urgentOnBell" = "True";
+    "URxvt*visualBell" = "True";
+
+    # ref https://github.com/muennich/urxvt-perls
+    "URxvt*perl-ext" = "default,url-select";
+    "URxvt*keysym.M-u" = "perl:url-select:select_next";
+    "URxvt*url-select.launcher" =
+      "/etc/profiles/per-user/${cfg.user.name}/bin/ff -new-tab";
+    "URxvt*url-select.underline" = "true";
+    "URxvt*colorUL" = "#4682B4";
+    "URxvt.perl-lib" = "${pkgs.urxvt_perls}/lib/urxvt/perl";
+    "URxvt*saveLines" = "10000";
+    "URxvt*modifier" = "mod1";
+
+    "root-urxvt*background" = "#230000";
+    "root-urxvt*foreground" = "#e0c0c0";
+    "root-urxvt*BorderColor" = "#400000";
+    "root-urxvt*color0" = "#800000";
+
+    "fzmenu-urxvt*background" = "rgb:42/23/42";
+    "fzmenu-urxvt*externalBorder" = "1";
+    "fzmenu-urxvt*geometry" = "70x9";
+    "fzmenu-urxvt*internalBorder" = "1";
+  };
+}
diff --git a/tv/3modules/Xresources.nix b/tv/3modules/Xresources.nix
new file mode 100644
index 000000000..983b8bc2e
--- /dev/null
+++ b/tv/3modules/Xresources.nix
@@ -0,0 +1,39 @@
+with import <stockholm/lib>;
+{ config, pkgs, ... }: let
+  cfg = {
+    enable = config.tv.Xresources != {};
+    user = config.krebs.build.user;
+  };
+in {
+  options.tv.Xresources = mkOption {
+    default = {};
+    type = types.attrsOf types.str;
+  };
+  config = {
+    nixpkgs.overlays = singleton (self: super: {
+      tv = super.tv or {} // {
+        Xresources =
+          self.writeText "Xresources"
+            (concatStrings (mapAttrsToList (name: value: /* xdefaults */ ''
+              ${name}: ${value}
+            '') config.tv.Xresources));
+      };
+    });
+    systemd.services.${if cfg.enable then "Xresources" else null} = {
+      wantedBy = [ "graphical.target" ];
+      after = [ "xserver.service" ];
+      requires = [ "xserver.service" ];
+      environment = {
+        DISPLAY = ":${toString config.services.xserver.display}";
+      };
+      serviceConfig = {
+        ExecStart = "${pkgs.xorg.xrdb}/bin/xrdb ${pkgs.tv.Xresources}";
+        RemainAfterExit = true;
+        SyslogIdentifier = "Xresources";
+        Type = "oneshot";
+        User = cfg.user.name;
+        WorkingDirectory = cfg.user.home;
+      };
+    };
+  };
+}
diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
index 67fb3f650..edaf50f03 100644
--- a/tv/3modules/default.nix
+++ b/tv/3modules/default.nix
@@ -7,5 +7,6 @@
     ./iptables.nix
     ./slock.nix
     ./x0vncserver.nix
+    ./Xresources.nix
   ];
 }