46 files changed, 71 insertions, 168 deletions

diff --git a/3modules/krebs/default.nix b/3modules/krebs/default.nix
index b9b6bcf34..9e25df0bf 100644
--- a/3modules/krebs/default.nix
+++ b/3modules/krebs/default.nix
@@ -107,15 +107,18 @@ let
                 '') config.deps)}
 
               echo build system...
+              profile=/nix/var/nix/profiles/system
               NIX_PATH=/root/src \
-              nix-build \
+              nix-env \
                 -Q \
+                -p "$profile" \
+                -f '<stockholm>' \
+                --set \
                 -A system \
-                '<stockholm>' \
                 --argstr user-name ${escapeShellArg cfg.build.user.name} \
                 --argstr system-name ${escapeShellArg cfg.build.host.name}
 
-              exec result/bin/switch-to-configuration switch
+              exec "$profile"/bin/switch-to-configuration switch
               EOF
             '';
           };
@@ -151,8 +154,7 @@ let
     # TODO search-domains :: listOf hostname
     search-domain = mkOption {
       type = types.hostname;
-      default = "";
-      example = "retiolum";
+      default = "retiolum";
     };
   };
 
diff --git a/4lib/krebs/types.nix b/4lib/krebs/types.nix
index 970ef2f8e..92410dd58 100644
--- a/4lib/krebs/types.nix
+++ b/4lib/krebs/types.nix
@@ -93,6 +93,10 @@ types // rec {
       pubkey = mkOption {
         type = str;
       };
+      pubkeys = mkOption {
+        type = attrsOf str;
+        default = {};
+      };
     };
   };
 
diff --git a/Makefile b/Makefile
index 6d075e6f2..ca828fd2b 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 # usage:
 #		make system=foo
 #		make systems='foo bar'
-#		make eval system=foo get=config.networking.extraHosts
+#		make eval system=foo get=config.networking.extraHosts [filter=json]
 #
 
 .ONESHELL:
@@ -17,91 +17,30 @@ $(systems):
 		--tagstring {} \
 		-q make systems= system={} ::: $(systems)
 else ifdef system
-include 0make/$(LOGNAME)/$(system).makefile
 .PHONY: deploy
 deploy:;@
-	system_name=$(system)
-	deploy_host=$(deploy_host)
-	nixpkgs_url=$(nixpkgs_url)
-	nixpkgs_rev=$(nixpkgs_rev)
-	secrets_dir=$(secrets_dir)
-
-	prepush(){(
-		dst=$$1
-		src=$$2
-		rsync \
-			--exclude .git \
-			--exclude .graveyard \
-			--exclude old \
-			--rsync-path="mkdir -p \"$$dst\" && rsync" \
-			--usermap=\*:0 \
-			--groupmap=\*:0 \
-			--delete-excluded \
-			-vrLptgoD \
-			"$$src/" "$$deploy_host:$$dst"
-	)}
-
-	prepush /root/src/stockholm "$$PWD"
-	prepush /root/src/secrets "$$secrets_dir"
-
-	ssh -S none "$$deploy_host" -T env \
-			nixpkgs_url="$$nixpkgs_url" \
-			nixpkgs_rev="$$nixpkgs_rev" \
-			system_name="$$system_name" \
-			user_name="$$LOGNAME" \
-		sh -euf \
-	<<-\EOF
-		prefetch(){(
-			dst=$$1
-			url=$$2
-			rev=$$3
-			mkdir -p "$$dst"
-			cd "$$dst"
-			if ! test -e .git; then
-				git init
-			fi
-			if ! cur_url=$$(git config remote.origin.url 2>/dev/null); then
-				git remote add origin "$$url"
-			elif test "$$cur_url" != "$$url"; then
-				git remote set-url origin "$$url"
-			fi
-			if test "$$(git rev-parse --verify HEAD 2>/dev/null)" != "$$rev"; then
-				git fetch origin
-				git checkout "$$rev" -- .
-				git checkout -q "$$rev"
-				git submodule init
-				git submodule update
-			fi
-			git clean -dxf
-		)}
-
-		prefetch /root/src/nixpkgs "$$nixpkgs_url" "$$nixpkgs_rev"
-
-		echo build system...
-		NIX_PATH=/root/src \
-		nix-build \
-			-Q \
-			-A system \
-			'<stockholm>' \
-			--argstr user-name "$$user_name" \
-			--argstr system-name "$$system_name"
-
-		result/bin/switch-to-configuration switch
-	EOF
+	make eval system=$(system) get=config.krebs.build.script filter=json | sh
 
 .PHONY: eval
 eval:
 	@
+ifeq ($(filter),json)
+	extraArgs=--json
+	filter() { jq -r .; }
+else
+	filter() { cat; }
+endif
 	NIX_PATH=stockholm=$$PWD:$$NIX_PATH \
 	nix-instantiate \
-		--json \
+		$${extraArgs-} \
+		$${json+--json} \
+		$${json+--strict} \
 		--eval \
-		--strict \
 		-A "$$get" \
 		'<stockholm>' \
 		--argstr user-name "$$LOGNAME" \
 		--argstr system-name "$$system" \
-		| jq -r .
+		| filter
 else
 $(error unbound variable: system[s])
 endif
diff --git a/default.nix b/default.nix
index 49e889924..0ee1c3d05 100644
--- a/default.nix
+++ b/default.nix
@@ -4,10 +4,10 @@ let
 
   eval = import <nixpkgs/nixos/lib/eval-config.nix> {
     system = builtins.currentSystem;
-    modules = [
-      (./1systems + "/${user-name}/${system-name}.nix")
-      (./3modules/krebs)
-      (./3modules + "/${user-name}")
+    modules = map (p: ./. + "/${p}") [
+      "${user-name}/1systems/${system-name}.nix"
+      "${user-name}/3modules"
+      "3modules/krebs"
     ];
   };
 
diff --git a/tv/systems/cd.nix b/tv/1systems/cd.nix
index 037248c49..54292eb83 100644
--- a/tv/systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -3,7 +3,7 @@
 with lib;
 
 let
-  tvpkgs = import ../pkgs { inherit pkgs; };
+  tvpkgs = import ../5pkgs { inherit pkgs; };
 in
 
 {
@@ -26,14 +26,14 @@ in
   };
 
   imports = [
-    ../configs/CAC-Developer-2.nix
-    ../configs/CAC-CentOS-7-64bit.nix
-    ../configs/base.nix
-    ../configs/consul-server.nix
-    ../configs/exim-smarthost.nix
-    ../configs/git.nix
+    ../2configs/CAC-Developer-2.nix
+    ../2configs/CAC-CentOS-7-64bit.nix
+    ../2configs/base.nix
+    ../2configs/consul-server.nix
+    ../2configs/exim-smarthost.nix
+    ../2configs/git.nix
     {
-      imports = [ ../configs/charybdis.nix ];
+      imports = [ ../2configs/charybdis.nix ];
       tv.charybdis = {
         enable = true;
         sslCert = ../../Zcerts/charybdis_cd.crt.pem;
diff --git a/tv/systems/mkdir.nix b/tv/1systems/mkdir.nix
index f601ec838..cd3d3b5c4 100644
--- a/tv/systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -22,12 +22,12 @@ with lib;
   };
 
   imports = [
-    ../configs/CAC-Developer-1.nix
-    ../configs/CAC-CentOS-7-64bit.nix
-    ../configs/base.nix
-    ../configs/consul-server.nix
-    ../configs/exim-smarthost.nix
-    ../configs/git.nix
+    ../2configs/CAC-Developer-1.nix
+    ../2configs/CAC-CentOS-7-64bit.nix
+    ../2configs/base.nix
+    ../2configs/consul-server.nix
+    ../2configs/exim-smarthost.nix
+    ../2configs/git.nix
     {
       tv.iptables = {
         enable = true;
diff --git a/tv/systems/nomic.nix b/tv/1systems/nomic.nix
index c96fe3811..b9a10cb4f 100644
--- a/tv/systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -22,11 +22,11 @@ with lib;
   };
 
   imports = [
-    ../configs/AO753.nix
-    ../configs/base.nix
-    ../configs/consul-server.nix
-    ../configs/exim-retiolum.nix
-    ../configs/git.nix
+    ../2configs/AO753.nix
+    ../2configs/base.nix
+    ../2configs/consul-server.nix
+    ../2configs/exim-retiolum.nix
+    ../2configs/git.nix
     {
       tv.iptables = {
         enable = true;
diff --git a/tv/systems/rmdir.nix b/tv/1systems/rmdir.nix
index fa91516d9..c8ac43e4c 100644
--- a/tv/systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -22,12 +22,12 @@ with lib;
   };
 
   imports = [
-    ../configs/CAC-Developer-1.nix
-    ../configs/CAC-CentOS-7-64bit.nix
-    ../configs/base.nix
-    ../configs/consul-server.nix
-    ../configs/exim-smarthost.nix
-    ../configs/git.nix
+    ../2configs/CAC-Developer-1.nix
+    ../2configs/CAC-CentOS-7-64bit.nix
+    ../2configs/base.nix
+    ../2configs/consul-server.nix
+    ../2configs/exim-smarthost.nix
+    ../2configs/git.nix
     {
       tv.iptables = {
         enable = true;
diff --git a/tv/systems/wu.nix b/tv/1systems/wu.nix
index 7c52d9484..27691ec56 100644
--- a/tv/systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -3,7 +3,7 @@
 with lib;
 
 let
-  tvpkgs = import ../pkgs { inherit pkgs; };
+  tvpkgs = import ../5pkgs { inherit pkgs; };
 in
 
 {
@@ -26,15 +26,15 @@ in
   };
 
   imports = [
-    ../configs/w110er.nix
-    ../configs/base.nix
-    ../configs/consul-client.nix
-    ../configs/exim-retiolum.nix
-    ../configs/git.nix
-    ../configs/mail-client.nix
-    ../configs/xserver.nix
-    ../configs/synaptics.nix # TODO w110er if xserver is enabled
-    ../configs/urlwatch.nix
+    ../2configs/w110er.nix
+    ../2configs/base.nix
+    ../2configs/consul-client.nix
+    ../2configs/exim-retiolum.nix
+    ../2configs/git.nix
+    ../2configs/mail-client.nix
+    ../2configs/xserver.nix
+    ../2configs/synaptics.nix # TODO w110er if xserver is enabled
+    ../2configs/urlwatch.nix
     {
       environment.systemPackages = with pkgs; [
 
diff --git a/tv/configs/AO753.nix b/tv/2configs/AO753.nix
index c103ce2d7..96167ce01 100644
--- a/tv/configs/AO753.nix
+++ b/tv/2configs/AO753.nix
@@ -2,7 +2,7 @@
 
 {
   imports = [
-    ../configs/smartd.nix
+    ../2configs/smartd.nix
   ];
 
   boot.loader.grub = {
diff --git a/tv/configs/CAC-CentOS-7-64bit.nix b/tv/2configs/CAC-CentOS-7-64bit.nix
index 168d1d97b..168d1d97b 100644
--- a/tv/configs/CAC-CentOS-7-64bit.nix
+++ b/tv/2configs/CAC-CentOS-7-64bit.nix
diff --git a/tv/configs/CAC-Developer-1.nix b/tv/2configs/CAC-Developer-1.nix
index 37bc32afb..37bc32afb 100644
--- a/tv/configs/CAC-Developer-1.nix
+++ b/tv/2configs/CAC-Developer-1.nix
diff --git a/tv/configs/CAC-Developer-2.nix b/tv/2configs/CAC-Developer-2.nix
index fedb808df..fedb808df 100644
--- a/tv/configs/CAC-Developer-2.nix
+++ b/tv/2configs/CAC-Developer-2.nix
diff --git a/tv/configs/base.nix b/tv/2configs/base.nix
index 06f83ea9e..997d4c235 100644
--- a/tv/configs/base.nix
+++ b/tv/2configs/base.nix
@@ -10,7 +10,6 @@ in
 
 {
   krebs.enable = true;
-  krebs.search-domain = "retiolum";
 
   networking.hostName = config.krebs.build.host.name;
 
diff --git a/tv/configs/bash_completion.sh b/tv/2configs/bash_completion.sh
index 537484fb9..537484fb9 100644
--- a/tv/configs/bash_completion.sh
+++ b/tv/2configs/bash_completion.sh
diff --git a/tv/configs/charybdis.nix b/tv/2configs/charybdis.nix
index 977626d27..bf45bf294 100644
--- a/tv/configs/charybdis.nix
+++ b/tv/2configs/charybdis.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
-  tvpkgs = import ../pkgs { inherit pkgs; };
+  tvpkgs = import ../5pkgs { inherit pkgs; };
 in
 
 with builtins;
diff --git a/tv/configs/consul-client.nix b/tv/2configs/consul-client.nix
index 0a8bf4d75..0a8bf4d75 100644
--- a/tv/configs/consul-client.nix
+++ b/tv/2configs/consul-client.nix
diff --git a/tv/configs/consul-server.nix b/tv/2configs/consul-server.nix
index d10f9ea75..d10f9ea75 100644
--- a/tv/configs/consul-server.nix
+++ b/tv/2configs/consul-server.nix
diff --git a/tv/configs/cryptoroot.nix b/tv/2configs/cryptoroot.nix
index 04618ac4a..04618ac4a 100644
--- a/tv/configs/cryptoroot.nix
+++ b/tv/2configs/cryptoroot.nix
diff --git a/tv/configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
index 851a0c625..851a0c625 100644
--- a/tv/configs/exim-retiolum.nix
+++ b/tv/2configs/exim-retiolum.nix
diff --git a/tv/configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index c93189b8a..c93189b8a 100644
--- a/tv/configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
diff --git a/tv/configs/git.nix b/tv/2configs/git.nix
index 01d29012c..ecb98cef2 100644
--- a/tv/configs/git.nix
+++ b/tv/2configs/git.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with import ../lib { inherit lib pkgs; };
+with import ../4lib { inherit lib pkgs; };
 let
 
   out = {
diff --git a/tv/configs/mail-client.nix b/tv/2configs/mail-client.nix
index 035f296b9..a632cf7c4 100644
--- a/tv/configs/mail-client.nix
+++ b/tv/2configs/mail-client.nix
@@ -1,6 +1,6 @@
 { pkgs, ... }:
 
-with import ../pkgs { inherit pkgs; };
+with import ../5pkgs { inherit pkgs; };
 
 {
   environment.systemPackages = [
diff --git a/tv/configs/smartd.nix b/tv/2configs/smartd.nix
index 9c4d8b2d8..9c4d8b2d8 100644
--- a/tv/configs/smartd.nix
+++ b/tv/2configs/smartd.nix
diff --git a/tv/configs/synaptics.nix b/tv/2configs/synaptics.nix
index c47cb9deb..c47cb9deb 100644
--- a/tv/configs/synaptics.nix
+++ b/tv/2configs/synaptics.nix
diff --git a/tv/configs/urlwatch.nix b/tv/2configs/urlwatch.nix
index a69b1519c..a69b1519c 100644
--- a/tv/configs/urlwatch.nix
+++ b/tv/2configs/urlwatch.nix
diff --git a/tv/configs/urxvt.nix b/tv/2configs/urxvt.nix
index 89bb421aa..89bb421aa 100644
--- a/tv/configs/urxvt.nix
+++ b/tv/2configs/urxvt.nix
diff --git a/tv/configs/w110er.nix b/tv/2configs/w110er.nix
index 96ee8c75b..e580b2161 100644
--- a/tv/configs/w110er.nix
+++ b/tv/2configs/w110er.nix
@@ -2,7 +2,7 @@
 
 {
   imports = [
-    ../configs/smartd.nix
+    ../2configs/smartd.nix
   ];
 
   boot.extraModprobeConfig = ''
diff --git a/tv/configs/xserver.nix b/tv/2configs/xserver.nix
index ec94359ee..7fc07f927 100644
--- a/tv/configs/xserver.nix
+++ b/tv/2configs/xserver.nix
@@ -2,7 +2,7 @@
 
 {
   imports = [
-    ../configs/urxvt.nix # TODO via xserver
+    ../2configs/urxvt.nix # TODO via xserver
   ];
 
   services.xserver.enable = true;
diff --git a/tv/modules/consul.nix b/tv/3modules/consul.nix
index 83a430c2f..82a15c024 100644
--- a/tv/modules/consul.nix
+++ b/tv/3modules/consul.nix
@@ -5,7 +5,7 @@
 # TODO consul-bootstrap HOST  that actually does is
 # TODO tools to inspect state of a cluster in outage state
 
-with import ../lib { inherit lib pkgs; };
+with import ../4lib { inherit lib pkgs; };
 let
   cfg = config.tv.consul;
 
diff --git a/tv/modules/default.nix b/tv/3modules/default.nix
index bb10d8261..bb10d8261 100644
--- a/tv/modules/default.nix
+++ b/tv/3modules/default.nix
diff --git a/tv/modules/ejabberd.nix b/tv/3modules/ejabberd.nix
index 2910a9a69..2910a9a69 100644
--- a/tv/modules/ejabberd.nix
+++ b/tv/3modules/ejabberd.nix
diff --git a/tv/modules/iptables.nix b/tv/3modules/iptables.nix
index cbf49f577..cbf49f577 100644
--- a/tv/modules/iptables.nix
+++ b/tv/3modules/iptables.nix
diff --git a/tv/lib/default.nix b/tv/4lib/default.nix
index e0a295f17..e0a295f17 100644
--- a/tv/lib/default.nix
+++ b/tv/4lib/default.nix
diff --git a/tv/lib/git.nix b/tv/4lib/git.nix
index 2b25debdc..2b25debdc 100644
--- a/tv/lib/git.nix
+++ b/tv/4lib/git.nix
diff --git a/tv/lib/modules.nix b/tv/4lib/modules.nix
index 248e638ea..248e638ea 100644
--- a/tv/lib/modules.nix
+++ b/tv/4lib/modules.nix
diff --git a/tv/pkgs/charybdis/default.nix b/tv/5pkgs/charybdis/default.nix
index f3e6be40e..f3e6be40e 100644
--- a/tv/pkgs/charybdis/default.nix
+++ b/tv/5pkgs/charybdis/default.nix
diff --git a/tv/pkgs/charybdis/remove-setenv.patch b/tv/5pkgs/charybdis/remove-setenv.patch
index bbaf95e19..bbaf95e19 100644
--- a/tv/pkgs/charybdis/remove-setenv.patch
+++ b/tv/5pkgs/charybdis/remove-setenv.patch
diff --git a/tv/pkgs/default.nix b/tv/5pkgs/default.nix
index 50625f868..50625f868 100644
--- a/tv/pkgs/default.nix
+++ b/tv/5pkgs/default.nix
diff --git a/tv/pkgs/lentil/default.nix b/tv/5pkgs/lentil/default.nix
index 1385cbd4d..fc9b4fd31 100644
--- a/tv/pkgs/lentil/default.nix
+++ b/tv/5pkgs/lentil/default.nix
@@ -4,13 +4,11 @@
   overrides = self: super: {
     lentil = super.lentil.override {
       mkDerivation = (attrs: self.mkDerivation (attrs // {
-        version = "0.1.2.7";
-        sha256 = "1g3if2y41li6wyg7ffvpybqvbywiq8bf5b5fb6pz499hinzahb9d";
+        version = "0.1.3.0";
+        sha256 = "0xa59avh0bvfg69xh9p5b8dppfhx29mvfq8v41sk9j7qbcnzjivg";
         patches = [
-          ./1.patch
           ./syntaxes.patch
         ];
-        doCheck = false;
       }));
     };
   };
diff --git a/tv/pkgs/lentil/syntaxes.patch b/tv/5pkgs/lentil/syntaxes.patch
index a9390ae51..a9390ae51 100644
--- a/tv/pkgs/lentil/syntaxes.patch
+++ b/tv/5pkgs/lentil/syntaxes.patch
diff --git a/tv/pkgs/much.nix b/tv/5pkgs/much.nix
index 82586b422..82586b422 100644
--- a/tv/pkgs/much.nix
+++ b/tv/5pkgs/much.nix
diff --git a/tv/pkgs/viljetic-pages/default.nix b/tv/5pkgs/viljetic-pages/default.nix
index 1ae55cca7..1ae55cca7 100644
--- a/tv/pkgs/viljetic-pages/default.nix
+++ b/tv/5pkgs/viljetic-pages/default.nix
diff --git a/tv/pkgs/viljetic-pages/index.html b/tv/5pkgs/viljetic-pages/index.html
index c06b3f97b..c06b3f97b 100644
--- a/tv/pkgs/viljetic-pages/index.html
+++ b/tv/5pkgs/viljetic-pages/index.html
diff --git a/tv/pkgs/viljetic-pages/logo.xpm b/tv/5pkgs/viljetic-pages/logo.xpm
index bb263dad9..bb263dad9 100644
--- a/