diff options
author | lassulus <lass@aidsballs.de> | 2015-11-09 02:37:13 +0100 |
---|---|---|
committer | lassulus <lass@aidsballs.de> | 2015-11-09 02:37:13 +0100 |
commit | 3d7790601ef2b32bf6b72f829137fd18d9874fd3 (patch) | |
tree | 02b5af9d30d27c5ddac360ae1fa13e0e20d5c20c /tv | |
parent | 9ff1f770f6f3703fad34ef4ce2d24116d84a5665 (diff) | |
parent | 610a3ce59c2ba0e58205305a85e9cb86e680d481 (diff) |
Merge remote-tracking branch 'cd/master'
Diffstat (limited to 'tv')
-rw-r--r-- | tv/1systems/cd.nix | 17 | ||||
-rw-r--r-- | tv/1systems/mkdir.nix | 17 | ||||
-rw-r--r-- | tv/1systems/nomic.nix | 17 | ||||
-rw-r--r-- | tv/1systems/rmdir.nix | 17 | ||||
-rw-r--r-- | tv/1systems/wu.nix | 154 | ||||
-rw-r--r-- | tv/1systems/xu.nix | 159 | ||||
-rw-r--r-- | tv/2configs/default.nix (renamed from tv/2configs/base.nix) | 84 | ||||
-rw-r--r-- | tv/2configs/vim.nix | 9 | ||||
-rw-r--r-- | tv/2configs/xserver/default.nix | 15 | ||||
-rw-r--r-- | tv/5pkgs/default.nix | 10 |
10 files changed, 68 insertions, 431 deletions
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index 1122e6a1..10c87b2c 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -14,11 +14,9 @@ with lib; rev = "c44a593aa43bba6a0708f6f36065a514a5110613"; }; dir.secrets = { - host = config.krebs.hosts.wu; path = "/home/tv/secrets/cd"; }; dir.stockholm = { - host = config.krebs.hosts.wu; path = "/home/tv/stockholm"; }; }; @@ -26,7 +24,6 @@ with lib; imports = [ ../2configs/hw/CAC-Developer-2.nix ../2configs/fs/CAC-CentOS-7-64bit.nix - ../2configs/base.nix #../2configs/consul-server.nix ../2configs/exim-smarthost.nix ../2configs/git.nix @@ -118,7 +115,6 @@ with lib; iftop iotop iptables - mutt # for mv nethogs ntp # ntpate rxvt_unicode.terminfo @@ -129,17 +125,4 @@ with lib; SystemMaxUse=1G RuntimeMaxUse=128M ''; - - users.extraUsers = { - mv = { - uid = 1338; - group = "users"; - home = "/home/mv"; - createHome = true; - useDefaultShell = true; - openssh.authorizedKeys.keys = [ - config.krebs.users.mv.pubkey - ]; - }; - }; } diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix index e8e35419..6ae4f80e 100644 --- a/tv/1systems/mkdir.nix +++ b/tv/1systems/mkdir.nix @@ -17,29 +17,12 @@ in { krebs.build.host = config.krebs.hosts.mkdir; - krebs.build.user = config.krebs.users.tv; krebs.build.target = "root@${primary-addr4}"; - krebs.build.source = { - git.nixpkgs = { - url = https://github.com/NixOS/nixpkgs; - rev = "c44a593aa43bba6a0708f6f36065a514a5110613"; - }; - dir.secrets = { - host = config.krebs.hosts.wu; - path = "/home/tv/secrets/mkdir"; - }; - dir.stockholm = { - host = config.krebs.hosts.wu; - path = "/home/tv/stockholm"; - }; - }; - imports = [ ../2configs/hw/CAC-Developer-1.nix ../2configs/fs/CAC-CentOS-7-64bit.nix - ../2configs/base.nix ../2configs/consul-server.nix ../2configs/exim-smarthost.nix ../2configs/git.nix diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix index df45b817..0c6c935a 100644 --- a/tv/1systems/nomic.nix +++ b/tv/1systems/nomic.nix @@ -4,28 +4,11 @@ with lib; { krebs.build.host = config.krebs.hosts.nomic; - krebs.build.user = config.krebs.users.tv; krebs.build.target = "root@nomic.gg23"; - krebs.build.source = { - git.nixpkgs = { - url = https://github.com/NixOS/nixpkgs; - rev = "c44a593aa43bba6a0708f6f36065a514a5110613"; - }; - dir.secrets = { - host = config.krebs.hosts.wu; - path = "/home/tv/secrets/nomic"; - }; - dir.stockholm = { - host = config.krebs.hosts.wu; - path = "/home/tv/stockholm"; - }; - }; - imports = [ ../2configs/hw/AO753.nix - ../2configs/base.nix #../2configs/consul-server.nix ../2configs/git.nix { diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix index e24ef64f..1f1d975c 100644 --- a/tv/1systems/rmdir.nix +++ b/tv/1systems/rmdir.nix @@ -17,29 +17,12 @@ in { krebs.build.host = config.krebs.hosts.rmdir; - krebs.build.user = config.krebs.users.tv; krebs.build.target = "root@rmdir.internet"; - krebs.build.source = { - git.nixpkgs = { - url = https://github.com/NixOS/nixpkgs; - rev = "c44a593aa43bba6a0708f6f36065a514a5110613"; - }; - dir.secrets = { - host = config.krebs.hosts.wu; - path = "/home/tv/secrets/rmdir"; - }; - dir.stockholm = { - host = config.krebs.hosts.wu; - path = "/home/tv/stockholm"; - }; - }; - imports = [ ../2configs/hw/CAC-Developer-1.nix ../2configs/fs/CAC-CentOS-7-64bit.nix - ../2configs/base.nix ../2configs/consul-server.nix ../2configs/exim-smarthost.nix ../2configs/git.nix diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 85fba1d8..3fa5481e 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -4,28 +4,9 @@ with lib; { krebs.build.host = config.krebs.hosts.wu; - krebs.build.user = config.krebs.users.tv; - - krebs.build.target = "root@wu"; - - krebs.build.source = { - git.nixpkgs = { - url = https://github.com/NixOS/nixpkgs; - rev = "c44a593aa43bba6a0708f6f36065a514a5110613"; - }; - dir.secrets = { - host = config.krebs.hosts.wu; - path = "/home/tv/secrets/wu"; - }; - dir.stockholm = { - host = config.krebs.hosts.wu; - path = "/home/tv/stockholm"; - }; - }; imports = [ ../2configs/hw/w110er.nix - ../2configs/base.nix #../2configs/consul-client.nix ../2configs/git.nix ../2configs/mail-client.nix @@ -62,31 +43,24 @@ with lib; bind # dig cac dic - ff file get - gitAndTools.qgit gnupg21 haskellPackages.hledger htop jq manpages mkpasswd - mpv netcat nix-repl nmap nq p7zip - pavucontrol posix_man_pages - pssh push qrencode - sxiv texLive tmux - zathura #ack #apache-httpd @@ -145,6 +119,8 @@ with lib; #xkill #xl2tpd #xsel + + unison ]; } { @@ -180,132 +156,6 @@ with lib; ]; }; } - { - users.extraGroups = { - tv.gid = 1337; - slaves.gid = 3799582008; # genid slaves - }; - - users.extraUsers = - mapAttrs (name: user@{ extraGroups ? [], ... }: user // { - inherit name; - home = "/home/${name}"; - createHome = true; - useDefaultShell = true; - group = "tv"; - extraGroups = ["slaves"] ++ extraGroups; - }) { - ff = { - uid = 13378001; - extraGroups = [ - "audio" - "video" - ]; - }; - - cr = { - uid = 13378002; - extraGroups = [ - "audio" - "video" - ]; - }; - - fa = { - uid = 2300001; - }; - - rl = { - uid = 2300002; - }; - - tief = { - uid = 2300702; - }; - - btc-bitcoind = { - uid = 2301001; - }; - - btc-electrum = { - uid = 2301002; - }; - - ltc-litecoind = { - uid = 2301101; - }; - - eth = { - uid = 2302001; - }; - - emse-hsdb = { - uid = 4200101; - }; - - wine = { - uid = 13370400; - extraGroups = [ - "audio" - "video" - ]; - }; - - df = { - uid = 13370401; - extraGroups = [ - "audio" - "video" - ]; - }; - - xr = { - uid = 13370061; - extraGroups = [ - "audio" - "video" - ]; - }; - - "23" = { - uid = 13370023; - }; - - electrum = { - uid = 13370102; - }; - - skype = { - uid = 6660001; - extraGroups = [ - "audio" - ]; - }; - - onion = { - uid = 6660010; - }; - - zalora = { - uid = 1000301; - extraGroups = [ - "audio" - # TODO remove vboxusers when hardening is active - "vboxusers" - "video" - ]; - }; - }; - - security.sudo.extraConfig = - let - isSlave = u: elem "slaves" u.extraGroups; - masterOf = u: u.group; - slaves = filterAttrs (_: isSlave) config.users.extraUsers; - toSudoers = u: "${masterOf u} ALL=(${u.name}) NOPASSWD: ALL"; - in - concatMapStringsSep "\n" toSudoers (attrValues slaves); - } ]; boot.initrd.luks = { diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix index e2cc2c06..1a9dddb5 100644 --- a/tv/1systems/xu.nix +++ b/tv/1systems/xu.nix @@ -4,28 +4,12 @@ with lib; { krebs.build.host = config.krebs.hosts.xu; - krebs.build.user = config.krebs.users.tv; - krebs.build.target = "root@xu"; - - krebs.build.source = { - git.nixpkgs = { - url = https://github.com/NixOS/nixpkgs; - rev = "c44a593aa43bba6a0708f6f36065a514a5110613"; - }; - dir.secrets = { - host = config.krebs.hosts.wu; - path = "/home/tv/secrets/xu"; - }; - dir.stockholm = { - host = config.krebs.hosts.wu; - path = "/home/tv/stockholm"; - }; - }; + krebs.build.source.git.nixpkgs.rev = + "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a"; imports = [ ../2configs/hw/x220.nix - ../2configs/base.nix #../2configs/consul-client.nix ../2configs/git.nix ../2configs/mail-client.nix @@ -62,29 +46,23 @@ with lib; bind # dig #cac dic - ff file - gitAndTools.qgit #xserver gnupg21 haskellPackages.hledger htop jq manpages mkpasswd - mpv #xserver netcat nix-repl nmap nq p7zip - pavucontrol #xserver + pass posix_man_pages - #pssh qrencode - sxiv #xserver texLive tmux - zathura #xserver #ack #apache-httpd @@ -142,6 +120,8 @@ with lib; #xkill #xl2tpd #xsel + + unison ]; } { @@ -178,135 +158,6 @@ with lib; ]; }; } - { - users.extraGroups = { - tv.gid = 1337; - slaves.gid = 3799582008; # genid slaves - }; - - users.extraUsers = - mapAttrs (name: user@{ extraGroups ? [], ... }: user // { - inherit name; - home = "/home/${name}"; - createHome = true; - useDefaultShell = true; - group = "tv"; - extraGroups = ["slaves"] ++ extraGroups; - }) { - ff = { - uid = 13378001; - extraGroups = [ - "audio" - "video" - ]; - }; - - cr = { - uid = 13378002; - extraGroups = [ - "audio" - "video" - "bumblebee" - ]; - }; - - fa = { - uid = 2300001; - }; - - rl = { - uid = 2300002; - }; - - tief = { - uid = 2300702; - }; - - btc-bitcoind = { - uid = 2301001; - }; - - btc-electrum = { - uid = 2301002; - }; - - ltc-litecoind = { - uid = 2301101; - }; - - eth = { - uid = 2302001; - }; - - emse-hsdb = { - uid = 4200101; - }; - - wine = { - uid = 13370400; - extraGroups = [ - "audio" - "video" - "bumblebee" - ]; - }; - - df = { - uid = 13370401; - extraGroups = [ - "audio" - "video" - "bumblebee" - ]; - }; - - xr = { - uid = 13370061; - extraGroups = [ - "audio" - "video" - ]; - }; - - "23" = { - uid = 13370023; - }; - - electrum = { - uid = 13370102; - }; - - skype = { - uid = 6660001; - extraGroups = [ - "audio" - ]; - }; - - onion = { - uid = 6660010; - }; - - zalora = { - uid = 1000301; - extraGroups = [ - "audio" - # TODO remove vboxusers when hardening is active - "vboxusers" - "video" - ]; - }; - }; - - security.sudo.extraConfig = - let - isSlave = u: elem "slaves" u.extraGroups; - masterOf = u: u.group; - slaves = filterAttrs (_: isSlave) config.users.extraUsers; - toSudoers = u: "${masterOf u} ALL=(${u.name}) NOPASSWD: ALL"; - in - concatMapStringsSep "\n" toSudoers (attrValues slaves); - } ]; boot.initrd.luks = { diff --git a/tv/2configs/base.nix b/tv/2configs/default.nix index 41159690..6ed1c65f 100644 --- a/tv/2configs/base.nix +++ b/tv/2configs/default.nix @@ -1,14 +1,33 @@ { config, lib, pkgs, ... }: -with builtins; with lib; { krebs.enable = true; + krebs.build = { + user = config.krebs.users.tv; + target = mkDefault "root@${config.krebs.build.host.name}"; + source = { + git.nixpkgs = { + url = mkDefault https://github.com/NixOS/nixpkgs; + rev = mkDefault "c44a593aa43bba6a0708f6f36065a514a5110613"; + target-path = mkDefault "/var/src/nixpkgs"; + }; + dir.secrets = { + path = mkDefault "/home/tv/secrets/${config.krebs.build.host.name}"; + }; + dir.stockholm = { + path = mkDefault "/home/tv/stockholm"; + target-path = mkDefault "/var/src/stockholm"; + }; + }; + }; + networking.hostName = config.krebs.build.host.name; imports = [ + <secrets> ./vim.nix { # stockholm dependencies @@ -17,36 +36,14 @@ with lib; ]; } { - # TODO never put hashedPassword into the store - users.extraUsers = - mapAttrs (_: h: { hashedPassword = h; }) - (import <secrets/hashedPasswords.nix>); - } - { - users.defaultUserShell = "/run/current-system/sw/bin/bash"; - users.mutableUsers = false; - } - { - users.extraUsers = { - root = { - openssh.authorizedKeys.keys = [ - config.krebs.users.tv.pubkey - ]; - }; - tv = { - uid = 1337; - group = "users"; - home = "/home/tv"; - createHome = true; - useDefaultShell = true; - extraGroups = [ - "audio" - "video" - "wheel" - ]; - openssh.authorizedKeys.keys = [ - config.krebs.users.tv.pubkey - ]; + users = { + defaultUserShell = "/run/current-system/sw/bin/bash"; + mutableUsers = false; + users = { + tv = { + isNormalUser = true; + uid = 1337; + }; }; }; } @@ -69,22 +66,8 @@ with lib; nix.useChroot = true; } { - # oldvim - environment.systemPackages = with pkgs; [ - vim - ]; - - environment.etc."vim/vimrc".text = '' - set nocp - ''; - - environment.etc."vim/vim${majmin pkgs.vim.version}".source = - "${pkgs.vim}/share/vim/vim${majmin pkgs.vim.version}"; + environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ]; - environment.variables.EDITOR = mkForce "vim"; - environment.variables.VIM = "/etc/vim"; - } - { environment.systemPackages = with pkgs; [ rxvt_unicode.terminfo ]; @@ -107,6 +90,15 @@ with lib; view = "vim -R"; }; + environment.variables = { + NIX_PATH = + with config.krebs.build.source; with dir; with git; + mkForce (concatStringsSep ":" [ + "nixpkgs=${nixpkgs.target-path}" + "secrets=${stockholm.target-path}/null" + ]); + }; + programs.bash = { interactiveShellInit = '' HISTCONTROL='erasedups:ignorespace' diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index 8c6c9fb4..04b1480c 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -50,6 +50,8 @@ let set wildmenu set wildmode=longest,full + set et ts=2 sts=2 sw=2 + filetype plugin indent on set t_Co=256 @@ -64,9 +66,10 @@ let au BufRead,BufNewFile *.nix so ${pkgs.writeText "nix.vim" '' setf nix + set isk=@,48-57,_,192-255,-,' " Ref <nix/src/libexpr/lexer.l> - syn match INT /[0-9]\+/ + syn match INT /\<[0-9]\+\>/ syn match PATH /[a-zA-Z0-9\.\_\-\+]*\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/ syn match HPATH /\~\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/ syn match SPATH /<[a-zA-Z0-9\.\_\-\+]\+\(\/[a-zA-Z0-9\.\_\-\+]\+\)*>/ @@ -77,8 +80,8 @@ let hi link SPATH Constant hi link URI Constant - syn match String /"\([^"]\|\\\"\)*"/ - syn match Comment /\s#.*/ + syn match String /"\([^\\"]\|\\.\)*"/ + syn match Comment /\(^\|\s\)#.*/ ''} au BufRead,BufNewFile /dev/shm/* set nobackup nowritebackup noswapfile diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix index 4d2fe9e4..afc2d699 100644 --- a/tv/2configs/xserver/default.nix +++ b/tv/2configs/xserver/default.nix @@ -34,7 +34,14 @@ let }; environment.systemPackages = [ + pkgs.ff + pkgs.gitAndTools.qgit + pkgs.mpv + pkgs.pavucontrol pkgs.slock + pkgs.sxiv + pkgs.xsel + pkgs.zathura ]; security.setuidPrograms = [ @@ -70,14 +77,6 @@ let ExecStart = "${xserver}/bin/xserver"; }; }; - - programs.bash.interactiveShellInit = '' - case ''${XMONAD_SPAWN_WORKSPACE-} in - za|zh|zj|zs) - exec sudo -u zalora -i - ;; - esac - ''; }; xmonad-environment = { diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix index 1ca5e70a..2108d972 100644 --- a/tv/5pkgs/default.nix +++ b/tv/5pkgs/default.nix @@ -1,6 +1,16 @@ { pkgs, ... }: { + cr = pkgs.writeScriptBin "cr" '' + #! /bin/sh + set -efu + export LC_TIME=de_DE.utf8 + exec ${pkgs.chromium}/bin/chromium \ + --ssl-version-min=tls1 \ + --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \ + --disk-cache-size=50000000 \ + "%@" + ''; ff = pkgs.callPackage ./ff {}; viljetic-pages = pkgs.callPackage ./viljetic-pages {}; xmonad-tv = |