summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--default.nix5
-rw-r--r--krebs/3modules/build.nix5
-rw-r--r--krebs/3modules/default.nix1
-rw-r--r--krebs/3modules/per-user.nix35
-rw-r--r--tv/1systems/cd.nix3
-rw-r--r--tv/1systems/mkdir.nix17
-rw-r--r--tv/1systems/nomic.nix17
-rw-r--r--tv/1systems/rmdir.nix17
-rw-r--r--tv/1systems/wu.nix32
-rw-r--r--tv/1systems/xu.nix30
-rw-r--r--tv/2configs/default.nix (renamed from tv/2configs/base.nix)26
-rw-r--r--tv/2configs/xserver/default.nix8
-rw-r--r--tv/2configs/z.nix40
13 files changed, 111 insertions, 125 deletions
diff --git a/default.nix b/default.nix
index 472d7597..ac748c28 100644
--- a/default.nix
+++ b/default.nix
@@ -32,7 +32,10 @@ let stockholm = {
upath = lib.nspath current-user-name;
base-module = { config, ... }: {
- imports = map (f: f "3modules") [ kpath upath ];
+ imports = builtins.filter builtins.pathExists (lib.concatLists [
+ (map (f: f "2configs") [ upath ])
+ (map (f: f "3modules") [ kpath upath ])
+ ]);
krebs.current.enable = true;
krebs.current.host = config.krebs.hosts.${current-host-name};
diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 1205e192..7f004cd8 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -29,10 +29,13 @@ let
};
options.krebs.build.source.dir = mkOption {
- type = types.attrsOf (types.submodule ({ config, ... }: {
+ type = let
+ default-host = config.krebs.current.host;
+ in types.attrsOf (types.submodule ({ config, ... }: {
options = {
host = mkOption {
type = types.host;
+ default = default-host;
};
path = mkOption {
type = types.str;
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 2b5fc478..438836f5 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -15,6 +15,7 @@ let
./git.nix
./iptables.nix
./nginx.nix
+ ./per-user.nix
./Reaktor.nix
./retiolum-bootstrap.nix
./realwallpaper.nix
diff --git a/krebs/3modules/per-user.nix b/krebs/3modules/per-user.nix
new file mode 100644
index 00000000..ee213ded
--- /dev/null
+++ b/krebs/3modules/per-user.nix
@@ -0,0 +1,35 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+ cfg = config.krebs.per-user;
+
+ out = {
+ options.krebs.per-user = api;
+ config = imp;
+ };
+
+ api = mkOption {
+ type = with types; attrsOf (submodule {
+ options = {
+ packages = mkOption {
+ type = listOf path;
+ default = [];
+ };
+ };
+ });
+ default = {};
+ };
+
+ imp = {
+ environment = {
+ etc = flip mapAttrs' cfg (name: { packages, ... }: {
+ name = "per-user/${name}";
+ value.source = pkgs.symlinkJoin "per-user.${name}" packages;
+ });
+ profiles = ["/etc/per-user/$LOGNAME"];
+ };
+ };
+
+in out
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 1122e6a1..126c6feb 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -14,11 +14,9 @@ with lib;
rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
};
dir.secrets = {
- host = config.krebs.hosts.wu;
path = "/home/tv/secrets/cd";
};
dir.stockholm = {
- host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
};
};
@@ -26,7 +24,6 @@ with lib;
imports = [
../2configs/hw/CAC-Developer-2.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
- ../2configs/base.nix
#../2configs/consul-server.nix
../2configs/exim-smarthost.nix
../2configs/git.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index e8e35419..6ae4f80e 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -17,29 +17,12 @@ in
{
krebs.build.host = config.krebs.hosts.mkdir;
- krebs.build.user = config.krebs.users.tv;
krebs.build.target = "root@${primary-addr4}";
- krebs.build.source = {
- git.nixpkgs = {
- url = https://github.com/NixOS/nixpkgs;
- rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
- };
- dir.secrets = {
- host = config.krebs.hosts.wu;
- path = "/home/tv/secrets/mkdir";
- };
- dir.stockholm = {
- host = config.krebs.hosts.wu;
- path = "/home/tv/stockholm";
- };
- };
-
imports = [
../2configs/hw/CAC-Developer-1.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
- ../2configs/base.nix
../2configs/consul-server.nix
../2configs/exim-smarthost.nix
../2configs/git.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index df45b817..0c6c935a 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -4,28 +4,11 @@ with lib;
{
krebs.build.host = config.krebs.hosts.nomic;
- krebs.build.user = config.krebs.users.tv;
krebs.build.target = "root@nomic.gg23";
- krebs.build.source = {
- git.nixpkgs = {
- url = https://github.com/NixOS/nixpkgs;
- rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
- };
- dir.secrets = {
- host = config.krebs.hosts.wu;
- path = "/home/tv/secrets/nomic";
- };
- dir.stockholm = {
- host = config.krebs.hosts.wu;
- path = "/home/tv/stockholm";
- };
- };
-
imports = [
../2configs/hw/AO753.nix
- ../2configs/base.nix
#../2configs/consul-server.nix
../2configs/git.nix
{
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index e24ef64f..1f1d975c 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -17,29 +17,12 @@ in
{
krebs.build.host = config.krebs.hosts.rmdir;
- krebs.build.user = config.krebs.users.tv;
krebs.build.target = "root@rmdir.internet";
- krebs.build.source = {
- git.nixpkgs = {
- url = https://github.com/NixOS/nixpkgs;
- rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
- };
- dir.secrets = {
- host = config.krebs.hosts.wu;
- path = "/home/tv/secrets/rmdir";
- };
- dir.stockholm = {
- host = config.krebs.hosts.wu;
- path = "/home/tv/stockholm";
- };
- };
-
imports = [
../2configs/hw/CAC-Developer-1.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
- ../2configs/base.nix
../2configs/consul-server.nix
../2configs/exim-smarthost.nix
../2configs/git.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index b12e7df9..26a603e9 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -4,34 +4,14 @@ with lib;
{
krebs.build.host = config.krebs.hosts.wu;
- krebs.build.user = config.krebs.users.tv;
-
- krebs.build.target = "root@wu";
-
- krebs.build.source = {
- git.nixpkgs = {
- url = https://github.com/NixOS/nixpkgs;
- rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
- target-path = "/var/src/nixpkgs";
- };
- dir.secrets = {
- host = config.krebs.hosts.wu;
- path = "/home/tv/secrets/wu";
- };
- dir.stockholm = {
- host = config.krebs.hosts.wu;
- path = "/home/tv/stockholm";
- target-path = "/var/src/stockholm";
- };
- };
imports = [
../2configs/hw/w110er.nix
- ../2configs/base.nix
#../2configs/consul-client.nix
../2configs/git.nix
../2configs/mail-client.nix
../2configs/xserver
+ ../2configs/z.nix
{
environment.systemPackages = with pkgs; [
@@ -287,16 +267,6 @@ with lib;
onion = {
uid = 6660010;
};
-
- zalora = {
- uid = 1000301;
- extraGroups = [
- "audio"
- # TODO remove vboxusers when hardening is active
- "vboxusers"
- "video"
- ];
- };
};
security.sudo.extraConfig =
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index e2cc2c06..65220fe3 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -4,32 +4,14 @@ with lib;
{
krebs.build.host = config.krebs.hosts.xu;
- krebs.build.user = config.krebs.users.tv;
-
- krebs.build.target = "root@xu";
-
- krebs.build.source = {
- git.nixpkgs = {
- url = https://github.com/NixOS/nixpkgs;
- rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
- };
- dir.secrets = {
- host = config.krebs.hosts.wu;
- path = "/home/tv/secrets/xu";
- };
- dir.stockholm = {
- host = config.krebs.hosts.wu;
- path = "/home/tv/stockholm";
- };
- };
imports = [
../2configs/hw/x220.nix
- ../2configs/base.nix
#../2configs/consul-client.nix
../2configs/git.nix
../2configs/mail-client.nix
../2configs/xserver
+ ../2configs/z.nix
{
environment.systemPackages = with pkgs; [
@@ -286,16 +268,6 @@ with lib;
onion = {
uid = 6660010;
};
-
- zalora = {
- uid = 1000301;
- extraGroups = [
- "audio"
- # TODO remove vboxusers when hardening is active
- "vboxusers"
- "video"
- ];
- };
};
security.sudo.extraConfig =
diff --git a/tv/2configs/base.nix b/tv/2configs/default.nix
index a74ce329..d31862b6 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/default.nix
@@ -1,11 +1,29 @@
{ config, lib, pkgs, ... }:
-with builtins;
with lib;
{
krebs.enable = true;
+ krebs.build = {
+ user = config.krebs.users.tv;
+ target = mkDefault "root@${config.krebs.build.host.name}";
+ source = {
+ git.nixpkgs = {
+ url = mkDefault https://github.com/NixOS/nixpkgs;
+ rev = mkDefault "c44a593aa43bba6a0708f6f36065a514a5110613";
+ target-path = mkDefault "/var/src/nixpkgs";
+ };
+ dir.secrets = {
+ path = mkDefault "/home/tv/secrets/${config.krebs.build.host.name}";
+ };
+ dir.stockholm = {
+ path = mkDefault "/home/tv/stockholm";
+ target-path = mkDefault "/var/src/stockholm";
+ };
+ };
+ };
+
networking.hostName = config.krebs.build.host.name;
imports = [
@@ -23,6 +41,9 @@ with lib;
(import <secrets/hashedPasswords.nix>);
}
{
+ users.groups.subusers.gid = 1093178926; # genid subusers
+ }
+ {
users.defaultUserShell = "/run/current-system/sw/bin/bash";
users.mutableUsers = false;
}
@@ -31,6 +52,7 @@ with lib;
root = {
openssh.authorizedKeys.keys = [
config.krebs.users.tv.pubkey
+ config.krebs.users.tv_xu.pubkey
];
};
tv = {
@@ -69,6 +91,8 @@ with lib;
nix.useChroot = true;
}
{
+ environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
+
environment.systemPackages = with pkgs; [
rxvt_unicode.terminfo
];
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 4d2fe9e4..df00203b 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -70,14 +70,6 @@ let
ExecStart = "${xserver}/bin/xserver";
};
};
-
- programs.bash.interactiveShellInit = ''
- case ''${XMONAD_SPAWN_WORKSPACE-} in
- za|zh|zj|zs)
- exec sudo -u zalora -i
- ;;
- esac
- '';
};
xmonad-environment = {
diff --git a/tv/2configs/z.nix b/tv/2configs/z.nix
new file mode 100644
index 00000000..e5494ecc
--- /dev/null
+++ b/tv/2configs/z.nix
@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+ krebs.per-user.z.packages = [
+ (pkgs.writeScriptBin "cr" ''
+ #! /bin/sh
+ set -efu
+ export LC_TIME=de_DE.utf8
+ exec ${pkgs.chromium}/bin/chromium \
+ --ssl-version-min=tls1 \
+ --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
+ --disk-cache-size=50000000 \
+ "%@"
+ '')
+ ];
+
+ programs.bash.interactiveShellInit = ''
+ case ''${XMONAD_SPAWN_WORKSPACE-} in
+ za|zh|zj|zs)
+ exec sudo -u z -i
+ ;;
+ esac
+ '';
+
+ security.sudo.extraConfig = "tv ALL=(z) NOPASSWD: ALL";
+
+ users.users.z = {
+ extraGroups = [
+ "audio"
+ "vboxusers"
+ "video"
+ ];
+ group = "subusers";
+ home = "/home/z";
+ uid = 3043726074; # genid z
+ useDefaultShell = true;
+ };
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-27 09:12:58 +0000