diff options
47 files changed, 828 insertions, 267 deletions
diff --git a/krebs/3modules/krebs/default.nix b/krebs/3modules/krebs/default.nix index e6eb3d287..889ee2817 100644 --- a/krebs/3modules/krebs/default.nix +++ b/krebs/3modules/krebs/default.nix @@ -129,6 +129,8 @@ in { "graphite.shack" "acng.shack" "drivedroid.shack" + "mobile.lounge.mpd.shack" + "lounge.mpd.wolf.shack" ]; }; retiolum = { @@ -138,6 +140,7 @@ in { "wolf.r" "build.wolf.r" "cgit.wolf.r" + "lounge.mpd.wolf.r" ]; tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix index 9630d7a7f..454f9bc65 100644 --- a/krebs/3modules/makefu/default.nix +++ b/krebs/3modules/makefu/default.nix @@ -1,7 +1,9 @@ { config, ... }: with import <stockholm/lib>; - +## generate keys with: +# tinc generate-keys +# ssh-keygen -f ssh.id_ed25519 -t ed25519 -C host { hosts = mapAttrs (_: setAttr "owner" config.krebs.users.makefu) { cake = rec { @@ -29,6 +31,32 @@ with import <stockholm/lib>; ssh.privkey.path = <secrets/ssh_host_ed25519_key>; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGyJlI0YpIh/LiiPMseD2IBHg+uVGrkSy0MPNeD+Jv8Y cake"; }; + crapi = rec { # raspi1 + cores = 1; + ci = false; + nets = { + retiolum = { + ip4.addr = "10.243.136.237"; + ip6.addr = "42:b3b2:9552:eef0:ee67:f3b3:8d33:eee2"; + aliases = [ + "crapi.r" + ]; + tinc.pubkey = '' + Ed25519PublicKey = Zkh6vtSNBvKYUjCPsMyAFJmxzueglCDoawVPCezKy4F + -----BEGIN RSA PUBLIC KEY----- + MIIBCgKCAQEAloXLBfZQEVW9mJ7uwOoa+DfV4ek/SG+JQuexJMugei/iNy0NjY66 + OVIkzFmED32c3D7S1+Q+5Mc3eR02k1o7XERpZeZhCtJOBlS4xMzCKH62E4USvH5L + R4O8XX1o/tpeOuZvpnpY1oPmFFc/B5G2jWWQR4Slpbw7kODwYYm5o+B7n+MkVNrk + OEOHLaaO6I5QB3GJvDH2JbwzDKLVClQM20L/EvIwnB+Xg0q3veKFj0WTXEK+tuME + di++RV4thhZ9IOgRTJOeT94j7ulloh15gqYaIqRqgtzfWE2TnUxvl+upB+yQHNtl + bJFLHkE34cQGxEv9dMjRe8i14+Onhb3B6wIDAQAB + -----END RSA PUBLIC KEY----- + ''; + }; + }; + ssh.privkey.path = <secrets/ssh.id_ed25519>; + ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGaV5Ga5R8RTrA+nclxw6uy5Z+hPBLitQTfuXdsmbVW6 crapi"; + }; drop = rec { ci = true; cores = 1; @@ -298,6 +326,13 @@ with import <stockholm/lib>; -----END RSA PUBLIC KEY----- ''; }; + #wiregrill = { + # ip6.addr = "42:4200:0000:0000:0000:0000:0000:a4db"; + # aliases = [ + # "x.w" + # ]; + # wireguard.pubkey = "fe5smvKVy5GAn7EV4w4tav6mqIAKhGWQotm7dRuRt1g="; + #}; }; ssh.privkey.path = <secrets/ssh_host_ed25519_key>; ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHDM0E608d/6rGzXqGbNSuMb2RlCojCJSiiz6QcPOC2G root@x"; @@ -457,8 +492,6 @@ with import <stockholm/lib>; ip6.addr = "42:f9f0::10"; aliases = [ "omo.r" - "logs.makefu.r" - "stats.makefu.r" ]; tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- @@ -525,7 +558,9 @@ with import <stockholm/lib>; "krebsco.de" = '' cache.euer IN A ${nets.internet.ip4.addr} cache.gum IN A ${nets.internet.ip4.addr} + graph IN A ${nets.internet.ip4.addr} gold IN A ${nets.internet.ip4.addr} + iso.euer IN A ${nets.internet.ip4.addr} ''; }; cores = 8; @@ -537,13 +572,24 @@ with import <stockholm/lib>; "nextgum.i" ]; }; + #wiregrill = { + # via = internet; + # ip6.addr = "42:4200:0000:0000:0000:0000:0000:70d3"; + # aliases = [ + # "gum.w" + # ]; + # wireguard.pubkey = "yAKvxTvcEVdn+MeKsmptZkR3XSEue+wSyLxwcjBYxxo="; + #}; retiolum = { via = internet; ip4.addr = "10.243.0.213"; ip6.addr = "42:f9f0:0000:0000:0000:0000:0000:70d3"; aliases = [ "nextgum.r" + "graph.r" "cache.gum.r" + "logs.makefu.r" + "stats.makefu.r" ]; tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- @@ -579,7 +625,6 @@ with import <stockholm/lib>; boot.euer IN A ${nets.internet.ip4.addr} wiki.euer IN A ${nets.internet.ip4.addr} mon.euer IN A ${nets.internet.ip4.addr} - graph IN A ${nets.internet.ip4.addr} ghook IN A ${nets.internet.ip4.addr} dockerhub IN A ${nets.internet.ip4.addr} photostore IN A ${nets.internet.ip4.addr} @@ -604,7 +649,6 @@ with import <stockholm/lib>; "o.gum.r" "tracker.makefu.r" - "graph.r" "search.makefu.r" "wiki.makefu.r" "wiki.gum.r" diff --git a/makefu/1systems/crapi/README b/makefu/1systems/crapi/README new file mode 100644 index 000000000..9278c764a --- /dev/null +++ b/makefu/1systems/crapi/README @@ -0,0 +1,4 @@ +1. flash arm6 image from https://www.cs.helsinki.fi/u/tmtynkky/nixos-arm/installer/ to sdcard +2. passwd; systemctl start sshd; mkdir /var/src ; touch /var/src/.populate +3. "environment.systemPackages = [ pkgs.rsync pkgs.git ];" in /etc/nixos/configuration.nix +5. nixos-rebuild switch --fast --option binary-caches http://nixos-arm.dezgeg.me/channel --option binary-cache-public-keys nixos-arm.dezgeg.me-1:xBaUKS3n17BZPKeyxL4JfbTqECsT+ysbDJz29kLFRW0=% diff --git a/makefu/1systems/crapi/config.nix b/makefu/1systems/crapi/config.nix new file mode 100644 index 000000000..d96b872d5 --- /dev/null +++ b/makefu/1systems/crapi/config.nix @@ -0,0 +1,46 @@ +{ config, pkgs, lib, ... }: +{ + # :l <nixpkgs> + # builtins.readDir (pkgs.fetchFromGitHub { owner = "nixos"; repo = "nixpkgs-channels"; rev = "6c064e6b"; sha256 = "1rqzh475xn43phagrr30lb0fd292c1s8as53irihsnd5wcksnbyd"; }) + imports = [ + <stockholm/makefu> + <stockholm/makefu/2configs> + <stockholm/makefu/2configs/tinc/retiolum.nix> + <stockholm/makefu/2configs/save-diskspace.nix> + + ]; + krebs.build.host = config.krebs.hosts.crapi; + # NixOS wants to enable GRUB by default + boot.loader.grub.enable = false; + + # Enables the generation of /boot/extlinux/extlinux.conf + boot.loader.generic-extlinux-compatible.enable = true; + + boot.kernelPackages = pkgs.linuxPackages_rpi; + + nix.binaryCaches = [ "http://nixos-arm.dezgeg.me/channel" ]; + nix.binaryCachePublicKeys = [ "nixos-arm.dezgeg.me-1:xBaUKS3n17BZPKeyxL4JfbTqECsT+ysbDJz29kLFRW0=%" ]; + + fileSystems = { + "/boot" = { + device = "/dev/disk/by-label/NIXOS_BOOT"; + fsType = "vfat"; + }; + "/" = { + device = "/dev/disk/by-label/NIXOS_SD"; + fsType = "ext4"; + }; + }; + + system.activationScripts.create-swap = '' + if [ ! -e /swapfile ]; then + fallocate -l 2G /swapfile + mkswap /swapfile + fi + ''; + swapDevices = [ { device = "/swapfile"; size = 2048; } ]; + + nix.package = lib.mkForce pkgs.nixStable; + services.openssh.enable = true; + +} diff --git a/makefu/1systems/crapi/source.nix b/makefu/1systems/crapi/source.nix new file mode 100644 index 000000000..4a4359ee6 --- /dev/null +++ b/makefu/1systems/crapi/source.nix @@ -0,0 +1,3 @@ +{ + arm6 = true; +} diff --git a/makefu/1systems/omo/config.nix b/makefu/1systems/omo/config.nix index 47e815e77..8db333481 100644 --- a/makefu/1systems/omo/config.nix +++ b/makefu/1systems/omo/config.nix @@ -17,7 +17,10 @@ in { # <stockholm/makefu/2configs/smart-monitor.nix> <stockholm/makefu/2configs/mail-client.nix> <stockholm/makefu/2configs/mosh.nix> + <stockholm/makefu/2configs/tools/core.nix> + <stockholm/makefu/2configs/tools/desktop.nix> <stockholm/makefu/2configs/tools/mobility.nix> + { environment.systemPackages = [ pkgs.esniper ]; } # <stockholm/makefu/2configs/disable_v6.nix> #<stockholm/makefu/2configs/graphite-standalone.nix> #<stockholm/makefu/2configs/share-user-sftp.nix> diff --git a/makefu/1systems/omo/hw/tsp.nix b/makefu/1systems/omo/hw/tsp.nix index 4af0d73fc..99c558056 100644 --- a/makefu/1systems/omo/hw/tsp.nix +++ b/makefu/1systems/omo/hw/tsp.nix @@ -28,5 +28,13 @@ in { kernelModules = [ "kvm-intel" ]; }; - + networking.wireless.enable = true; + hardware.enableRedistributableFirmware = true; + hardware.cpu.intel.updateMicrocode = true; + services.logind.lidSwitch = "ignore"; + services.logind.lidSwitchDocked = "ignore"; + services.logind.extraConfig = '' + HandleSuspendKey = ignore + ''; + powerManagement.enable = false; } diff --git a/makefu/1systems/sdev/config.nix b/makefu/1systems/sdev/config.nix index c2cd23d1e..2f289d500 100644 --- a/makefu/1systems/sdev/config.nix +++ b/makefu/1systems/sdev/config.nix @@ -6,13 +6,13 @@ [ # Include the results of the hardware scan. <stockholm/makefu> - # <stockholm/makefu/2configs/hw/vbox-guest.nix> - { # until virtualbox-image is fixed - imports = [ - <stockholm/makefu/2configs/fs/single-partition-ext4.nix> - ]; - boot.loader.grub.device = "/dev/sda"; - } + <stockholm/makefu/2configs/hw/vbox-guest.nix> + #{ # until virtualbox-image is fixed + # imports = [ + # <stockholm/makefu/2configs/fs/single-partition-ext4.nix> + # ]; + # boot.loader.grub.device = lib.mkForce "/dev/sda"; + #} <stockholm/makefu/2configs/main-laptop.nix> # <secrets/extra-hosts.nix> diff --git a/makefu/1systems/shack-autoinstall/config.nix b/makefu/1systems/shack-autoinstall/config.nix new file mode 100644 index 000000000..d53c411c0 --- /dev/null +++ b/makefu/1systems/shack-autoinstall/config.nix @@ -0,0 +1,49 @@ +{ config, pkgs, lib, ... }: + +with import <stockholm/lib>; +let + disk = "/dev/sda"; +in { + imports = [ + <stockholm/makefu> + <nixpkgs/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix> + <nixpkgs/nixos/modules/installer/cd-dvd/channel.nix> + <stockholm/makefu/2configs/tools/core.nix> + ]; + # TODO: NIX_PATH and nix.nixPath are being set by default.nix right now + # cd ~/stockholm ; nix-build -A config.system.build.isoImage -I nixos-config=makefu/1systems/iso.nix -I secrets=/home/makefu/secrets/iso /var/src/nixpkgs/nixos + krebs.build.host = config.krebs.hosts.iso; + krebs.hidden-ssh.enable = true; + + environment.extraInit = '' + EDITOR=vim + ''; + # iso-specific + boot.kernelParams = [ "copytoram" ]; + + + environment.systemPackages = [ + pkgs.parted + ( pkgs.writeScriptBin "shack-install" '' + #! /bin/sh + echo "go ahead and try NIX_PATH=/root/.nix-defexpr/channels/ nixos-install" + '') + ]; + + systemd.services.wpa_supplicant.wantedBy = lib.mkForce [ "multi-user.target" ]; + + networking.wireless = { + enable = true; + networks.shack.psk = "welcome2shack"; + }; + + + services.openssh = { + enable = true; + hostKeys = [ + { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } + ]; + }; + # enable ssh in the iso boot process + systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ]; +} diff --git a/makefu/1systems/shack-autoinstall/grub-partition.sh b/makefu/1systems/shack-autoinstall/grub-partition.sh new file mode 100644 index 000000000..c23c89799 --- /dev/null +++ b/makefu/1systems/shack-autoinstall/grub-partition.sh @@ -0,0 +1,5 @@ +#!/bin/sh +set -euf +parted -s ${disk} mklabel msdos +parted -s ${disk} -- mkpart primary linux-swap 1M 4096M +parted -s ${disk} -- mkpart primary ext2 4096M 100% diff --git a/makefu/1systems/shack-autoinstall/shack-config.nix b/makefu/1systems/shack-autoinstall/shack-config.nix new file mode 100644 index 000000000..9fa54ae32 --- /dev/null +++ b/makefu/1systems/shack-autoinstall/shack-config.nix @@ -0,0 +1,231 @@ +{ config, pkgs, lib, ... }: + +{ + imports = [ + ./hardware-configuration.nix + # TODO: + ]; + + # shacks-specific + networking.wireless = { + enable = true; + networks.shack.psk = "181471eb97eb23f12c6871227bc4a7b13c8f6af56dcc0d0e8b71f4d7a510cb4e"; + }; + networking.hostName = "shackbook"; + + boot.tmpOnTmpfs = true; + + users.users.shack = { + createHome = true; + useDefaultShell = true; + home = "/home/shack"; + uid = 9001; + packages = with pkgs;[ + chromium + firefox + ]; + extraGroups = [ "audio" "wheel" ]; + hashedPassword = "$6$KIxlQTLEnKl7cwC$LrmbwZ64Mlm7zqUUZ0EObPJMES3C0mQ6Sw7ynTuXzUo7d9EWg/k5XCGkDHMFvL/Pz19Awcv0knHB1j3dHT6fh/" ; + }; + + environment.variables = let + ca-bundle = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"; + in { + EDITOR = lib.mkForce "vim"; + CURL_CA_BUNDLE = ca-bundle; + GIT_SSL_CAINFO = ca-bundle; + SSL_CERT_FILE = ca-bundle; + }; + + services.printing = { + enable = true; + # TODO: shack-printer + }; + + + environment.systemPackages = with pkgs;[ + parted + ddrescue + tmux + jq git gnumake htop rxvt_unicode.terminfo + (pkgs.vim_configurable.customize { + name = "vim"; + vimrcConfig.customRC = '' + set nocompatible + syntax on + set list + set listchars=tab:▸\ + "set list listchars=tab:>-,trail:.,extends:> + + filetype off + filetype plugin indent on + + colorscheme darkblue + set background=dark + + set number + set relativenumber + set mouse=a + set ignorecase + set incsearch + set wildignore=*.o,*.obj,*.bak,*.exe,*.os + set textwidth=79 + set shiftwidth=2 + set expandtab + set softtabstop=2 + set shiftround + set smarttab + set tabstop=2 + set et + set autoindent + set backspace=indent,eol,start + + + inoremap <F1> <ESC> + nnoremap <F1> <ESC> + vnoremap <F1> <ESC> + + nnoremap <F5> :UndotreeToggle<CR> + set undodir =~/.vim/undo + set undofile + "maximum number of changes that can be undone + set undolevels=1000000 + "maximum number lines to save for undo on a buffer reload + set undoreload=10000000 + + nnoremap <F2> :set invpaste paste?<CR> + set pastetoggle=<F2> + set showmode + + set showmatch + set matchtime=3 + set hlsearch + + autocmd ColorScheme * highlight ExtraWhitespace ctermbg=red guibg=red + + + " save on focus lost + au FocusLost * :wa + + autocmd BufRead *.json set filetype=json + au BufNewFile,BufRead *.mustache set syntax=mustache + + cnoremap SudoWrite w !sudo tee > /dev/null % + + " create Backup/tmp/undo dirs + set backupdir=~/.vim/backup + set directory=~/.vim/tmp + + function! InitBackupDir() + let l:parent = $HOME . '/.vim/' + let l:backup = l:parent . 'backup/' + let l:tmpdir = l:parent . 'tmp/' + let l:undodir= l:parent . 'undo/' + + + if !isdirectory(l:parent) + call mkdir(l:parent) + endif + if !isdirectory(l:backup) + call mkdir(l:backup) + endif + if !isdirectory(l:tmpdir) + call mkdir(l:tmpdir) + endif + if !isdirectory(l:undodir) + call mkdir(l:undodir) + endif + endfunction + call InitBackupDir() + + augroup Binary + " edit binaries in xxd-output, xxd is part of vim + au! + au BufReadPre *.bin let &bin=1 + au BufReadPost *.bin if &bin | %!xxd + au BufReadPost *.bin set ft=xxd | endif + au BufWritePre *.bin if &bin | %!xxd -r + au BufWritePre *.bin endif + au BufWritePost *.bin if &bin | %!xxd + au BufWritePost *.bin set nomod | endif + augroup END + ''; + vimrcConfig.vam.knownPlugins = pkgs.vimPlugins; + vimrcConfig.vam.pluginDictionaries = [ + { names = [ "undotree" ]; } + # vim-nix handles indentation better but does not perform sanity + { names = [ "vim-addon-nix" ]; ft_regex = "^nix\$"; } + ]; + }) + + ]; + programs.bash = { + enableCompletion = true; + interactiveShellInit = '' + HISTCONTROL='erasedups:ignorespace' + HISTSIZE=900001 + HISTFILESIZE=$HISTSIZE + shopt -s checkhash + shopt -s histappend histreedit histverify + shopt -s no_empty_cmd_completion + PS1='\[\e[1;32m\]\w\[\e[0m\] ' + ''; + }; + + services.journald.extraConfig = '' + SystemMaxUse=1G + RuntimeMaxUse=128M + ''; + nix = { + package = pkgs.nixUnstable; + optimise.automatic = true; + useSandbox = true; + gc.automatic = true; + }; + + system.autoUpgrade.enable = true; + + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.device = "/dev/sda"; + fileSystems."/".options = [ "noatime" "nodiratime" "discard" ]; + + + # gui and stuff + i18n = { + consoleFont = "Lat2-Terminus16"; + consoleKeyMap = "us"; + defaultLocale = "en_US.UTF-8"; + }; + + fonts = { + enableFontDir = true; + enableGhostscriptFonts = true; + fonts = [ pkgs.terminus_font ]; + }; + + time.timeZone = "Europe/Berlin"; + services.timesyncd.enable = true; + + + # GUI + hardware.pulseaudio.enable = true; + services.xserver = { + enable = true; + displayManager.auto.enable = true; + displayManager.auto.user = "shack"; + + desktopManager.xfce.enable = true; + + layout = "us"; + xkbVariant = "altgr-intl"; + xkbOptions = "ctrl:nocaps, eurosign:e"; + }; + + services.openssh = { + enable = true; + hostKeys = [ + { bits = 8192; type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; } + ]; + }; +} diff --git a/makefu/1systems/shack-autoinstall/uefi-partition.sh b/makefu/1systems/shack-autoinstall/uefi-partition.sh new file mode 100644 index 000000000..4566b7dce --- /dev/null +++ b/makefu/1systems/shack-autoinstall/uefi-partition.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -euf +p(){ + parted -s ${disk} -- $@ +} +p mklabel gpt +p mkpart primary fat32 1M 551M +p set 1 boot on +p mkpart primary linux-swap 51M 4647M +p mkpart primary ext2 4647M 100% +udevadm settle +mkfs.fat -nboot -F32 /dev/sda1 + +udevadm settle +mkswap ${disk}2 -L swap +swapon -L swap +mkfs.ext4 -L nixos ${disk}3 +mount LABEL=nixos /mnt +mkdir /mnt/boot +mount LABEL=boot /mnt/boot + +mkdir -p /mnt/etc/nixos +cp ${./shack-config.nix} /mnt/etc/nixos/configuration.nix +nixos-generate-config --root /mnt diff --git a/makefu/1systems/tsp/config.nix b/makefu/1systems/tsp/config.nix index 680fa2cbc..2921e2bcf 100644 --- a/makefu/1systems/tsp/config.nix +++ b/makefu/1systems/tsp/config.nix @@ -8,57 +8,32 @@ [ # Include the results of the hardware scan. <stockholm/makefu> <stockholm/makefu/2configs/main-laptop.nix> - <stockholm/makefu/2configs/tools/all.nix> - <stockholm/makefu/2configs/fs/sda-crypto-root.nix> + # <stockholm/makefu/2configs/tools/all.nix> + <stockholm/makefu/2configs/fs/single-partition-ext4.nix> # hardware specifics are in here # imports tp-x2x0.nix - # <stockholm/makefu/2configs/hw/tp-x200.nix> + <stockholm/makefu/2configs/hw/tp-x230.nix> + <stockholm/makefu/2configs/hw/bluetooth.nix> + <stockholm/makefu/2configs/hw/network-manager.nix> # <stockholm/makefu/2configs/rad1o.nix> <stockholm/makefu/2configs/zsh-user.nix> <stockholm/makefu/2configs/exim-retiolum.nix> <stockholm/makefu/2configs/tinc/retiolum.nix> + + <stockholm/makefu/2configs/sshd-totp.nix> + { + programs.adb.enable = true; + } ]; - # not working in vm krebs.build.host = config.krebs.hosts.tsp; - boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; allowDiscards=true; }]; - boot.loader.grub.copyKernels = true; + boot.loader.grub.device = "/dev/sda"; networking.firewall.allowedTCPPorts = [ |