summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--Zhosts/eulerwalk11
-rw-r--r--Zhosts/tmpd11
-rw-r--r--krebs/3modules/default.nix98
-rw-r--r--krebs/3modules/exim-smarthost.nix219
-rw-r--r--krebs/4lib/types.nix11
-rw-r--r--krebs/5pkgs/default.nix1
-rw-r--r--krebs/5pkgs/posix-array.nix31
-rw-r--r--lass/1systems/mors.nix3
-rw-r--r--lass/1systems/uriel.nix18
-rw-r--r--lass/2configs/downloading.nix67
-rw-r--r--lass/2configs/fastpoke-pages.nix10
-rw-r--r--lass/2configs/wordpress.nix59
-rw-r--r--lass/3modules/folderPerms.nix104
-rw-r--r--makefu/1systems/tsp.nix8
-rw-r--r--makefu/2configs/rad1o.nix19
-rw-r--r--tv/1systems/cd.nix54
-rw-r--r--tv/1systems/nomic.nix2
-rw-r--r--tv/1systems/wu.nix2
-rw-r--r--tv/2configs/exim-smarthost.nix475
19 files changed, 694 insertions, 509 deletions
diff --git a/Zhosts/eulerwalk b/Zhosts/eulerwalk
new file mode 100644
index 000000000..b6dbf43e0
--- /dev/null
+++ b/Zhosts/eulerwalk
@@ -0,0 +1,11 @@
+Subnet = 10.243.176.249
+Subnet = 42:7429:4e08:14cf:fb5d:9c17:76e5:ddcb
+
+-----BEGIN RSA PUBLIC KEY-----
+MIIBCgKCAQEAv0GyX62KaykRkN9f6ZgtAOPk1rr+ZFG6Il24crrkIJgx0He+VVjr
+XgXE7EaVwNjNm/7nIhGGWbCzravDIrRzQXzY+IQIzXwSPKv0WZkqFHZj122SIt9L
+QKtkGnECA136uH3AqbXoxhsz2FnuDunZ6gKAi6XIlq5Qr2Nyv0qKKaM0zTZZ4pI5
+PqsNfV6r2gc3jo/tOuxVgG86dMAEHLMdwjdBE6/49daGXyhsGG7Gh93c8UlyFKyt
+r6LC+4Oc1MCMtCbxsmE/iZWJtpUHAcQDzTcAynP916xg1PBLhczfWFCPR0LXOQGe
+MYSv34G0gZqPmkNJryi1MEFZ61zo/SiO9wIDAQAB
+-----END RSA PUBLIC KEY-----
diff --git a/Zhosts/tmpd b/Zhosts/tmpd
new file mode 100644
index 000000000..52db6b258
--- /dev/null
+++ b/Zhosts/tmpd
@@ -0,0 +1,11 @@
+Subnet = 10.243.235.99
+Subnet = 42:cd60:2f4b:3382:b9ba:74d7:5a13:ceb7
+
+-----BEGIN RSA PUBLIC KEY-----
+MIIBCgKCAQEAwSNjd1jYjsx+8JDRUV9QXhyMOrAIOMtKUGo/+Ufr+jHIY7h2BlQS
+6Jy7xjZv6zmHhEenhWs+P4qUCASXJPtZ7URgelA4NgkfVMsbgUQDM6VDZr0JwYXq
+csmp/9vxWRRbaNifG9x5+N50tMh9E5rMmDCV9ySWr3DAvDQckKAjfMtys2EWajW2
+sM02mXtMPAy5QgKNRvSbIVDnRjJyZpCkc5xNhv2rl7k+6RZltcec4IarIlnu5nv5
+f1cTAlPaWwGuyyXZeyFbzD0IAGJeWzCkt8+F8kOobRXJQbgDqYWLdH5BXagxBX4g
+VpDZTwdWU6oGph8m4kCg4vJCW1/XYOU1aQIDAQAB
+-----END RSA PUBLIC KEY-----
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 467cc4459..a0d4f0157 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -7,6 +7,7 @@ let
out = {
imports = [
./exim-retiolum.nix
+ ./exim-smarthost.nix
./github-hosts-sync.nix
./git.nix
./nginx.nix
@@ -184,7 +185,42 @@ let
) host.nets
) cfg.hosts
));
- }
+
+ # krebs.hosts.bob = rec {
+ # addrs4 = "10.0.0.1";
+ # extraZones = {
+ # # extraZones
+ # "krebsco.de" = ''
+ # krebsco.de. IN MX 10 mx1
+ # mx1 IN A ${addrs4}
+ # '';
+ # "dickbutt.de" = ''
+ # dickbutt.de. IN NS ns
+ # ns IN A ${addrs4}
+ # ''
+ # }
+ # }
+ # krebs.hosts.khan = rec {
+ # addrs4 = "10.0.0.2";
+ # extraZones = {
+ # "krebsco.de" = ''
+ # khan.krebsco.de IN A ${addrs4}
+ # };
+ # }
+ #
+ # =>
+ # "zone/krebsco.de".text = ''
+ # krebsco.de. IN MX 10 mx1
+ # mx1 IN A 10.0.0.1
+ # khan.krebsco.de IN A 10.0.0.2
+ # '';
+
+
+ environment.etc = mapAttrs'
+ (name: value:
+ nameValuePair (("zones/" + name)) ({ text=value;}))
+ cfg.hosts.pigstarter.extraZones;
+ }
];
lass-imp = {
@@ -274,9 +310,11 @@ let
users = addNames {
lass = {
pubkey = readFile ../../Zpubkeys/lass.ssh.pub;
+ mail = "lass@mors.retiolum";
};
uriel = {
pubkey = readFile ../../Zpubkeys/uriel.ssh.pub;
+ mail = "uriel@mors.retiolum";
};
};
};
@@ -335,9 +373,47 @@ let
};
};
};
- pigstarter = {
+ pornocauster = {
+ cores = 2;
+ dc = "makefu"; #x220
+ nets = {
+ retiolum = {
+ addrs4 = ["10.243.0.91"];
+ addrs6 = ["42:0b2c:d90e:e717:03dc:9ac1:7c30:a4db"];
+ aliases = [
+ "pornocauster.retiolum"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIICCgKCAgEAwW+RjRcp3uarkfXZ+FcCYY2GFcfI595GDpLRuiS/YQAB3JZEirHi
+ HFhDJN80fZ9qHqtq9Af462xSx+cIb282TxAqCM1Z9buipOcYTYo0m8xIqkT10dB3
+ mR87B+Ed1H6G3J6isdwEb9ZMegyGIIeyR53FJQYMZXjxdJbAmGMDKqjZSk1D5mo+
+ n5Vx3lGzTuDy84VyphfO2ypG48RHCxHUAx4Yt3o84LKoiy/y5E66jaowCOjZ6SqG
+ R0cymuhoBhMIk2xAXk0Qn7MZ1AOm9N7Wru7FXyoLc7B3+Gb0/8jXOJciysTG7+Gr
+ Txza6fJvq2FaH8iBnfezSELmicIYhc8Ynlq4xElcHhQEmRTQavVe/LDhJ0i6xJSi
+ aOu0njnK+9xK+MyDkB7n8dO1Iwnn7aG4n3CjVBB4BDO08lrovD3zdpDX0xhWgPRo
+ ReOJ3heRO/HsVpzxKlqraKWoHuOXXcREfU9cj3F6CRd0ECOhqtFMEr6TnuSc8GaE
+ KCKxY1oN45NbEFOCv2XKd2wEZFH37LFO6xxzSRr1DbVuKRYIPjtOiFKpwN1TIT8v
+ XGzTT4TJpBGnq0jfhFwhVjfCjLuGj29MCkvg0nqObQ07qYrjdQI4W1GnGOuyXkvQ
+ teyxjUXYbp0doTGxKvQaTWp+JapeEaJPN2MDOhrRFjPrzgo3aW9+97UCAwEAAQ==
+ -----END RSA PUBLIC KEY-----
+ '';
+ };
+ };
+ };
+ pigstarter = rec {
cores = 1;
- dc = "makefu"; #x200
+ dc = "frontrange"; #vps
+
+ extraZones = {
+ "de.krebsco" = ''
+ pigstarter.krebsco.de IN A ${elemAt nets.internet.addrs4 0}
+ krebsco.de. IN NS io
+ io IN A ${elemAt nets.internet.addrs4 0}
+ krebsco.de. IN MX 10 mx42
+ mx42 IN A ${elemAt nets.internet.addrs4 0}
+ '';
+ };
nets = {
internet = {
addrs4 = ["192.40.56.122"];
@@ -345,13 +421,6 @@ let
aliases = [
"pigstarter.internet"
];
- zones = [
- { "pigstarter.krebsco.de" = "A";}
- { "io.krebsco.de" = "NS";}
- { "io.krebsco.de" = "A";}
- { "mx42.krebsco.de" = "MX";}
- { "mx42.krebsco.de" = "A";}
- ];
};
retiolum = {
addrs4 = ["10.243.0.153"];
@@ -375,7 +444,7 @@ let
};
users = addNames {
makefu = {
- mail = "root@euer.krebsco.de";
+ mail = "root@tsp.retiolum";
pubkey = readFile ../../Zpubkeys/makefu_arch.ssh.pub;
};
};
@@ -389,6 +458,13 @@ let
cd = {
cores = 2;
dc = "tv"; #dc = "cac";
+ extraZones = {
+ "de.krebsco" = ''
+ mx23 IN A ${elemAt nets.internet.addrs4 0}
+ cd IN A ${elemAt nets.internet.addrs4 0}
+ krebsco.de. IN MX 5 mx23
+ '';
+ };
nets = rec {
internet = {
addrs4 = ["162.219.7.216"];
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
new file mode 100644
index 000000000..a564430ea
--- /dev/null
+++ b/krebs/3modules/exim-smarthost.nix
@@ -0,0 +1,219 @@
+{ config, pkgs, lib, ... }:
+
+with builtins;
+with lib;
+let
+ cfg = config.krebs.exim-smarthost;
+
+ out = {
+ options.krebs.exim-smarthost = api;
+ config = mkIf cfg.enable imp;
+ };
+
+ api = {
+ enable = mkEnableOption "krebs.exim-smarthost";
+
+ internet-aliases = mkOption {
+ type = types.listOf (types.submodule ({
+ options = {
+ from = mkOption {
+ type = types.str; # TODO e-mail address
+ };
+ to = mkOption {
+ type = types.str; # TODO e-mail address / TODO listOf
+ };
+ };
+ }));
+ };
+
+ relay_from_hosts = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+
+ primary_hostname = mkOption {
+ type = types.str;
+ default = "${config.networking.hostName}.retiolum";
+ };
+
+ sender_domains = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+
+ system-aliases = mkOption {
+ type = types.listOf (types.submodule ({
+ options = {
+ from = mkOption {
+ type = types.str; # TODO e-mail address
+ };
+ to = mkOption {
+ type = types.str; # TODO e-mail address / TODO listOf
+ };
+ };
+ }));
+ };
+ };
+
+ imp = {
+ services.exim = {
+ enable = true;
+ config = ''
+ primary_hostname = ${cfg.primary_hostname}
+
+ # HOST_REDIR contains the real destinations for "local_domains".
+ #HOST_REDIR = /etc/exim4/host_redirect
+
+
+ # Domains not listed in local_domains need to be deliverable remotely.
+ # XXX We abuse local_domains to mean "domains, we're the gateway for".
+ domainlist local_domains = @ : localhost
+ domainlist relay_to_domains =
+ hostlist relay_from_hosts = <;${concatStringsSep ";" (
+ [
+ "127.0.0.1"
+ "::1"
+ ]
+ ++
+ cfg.relay_from_hosts
+ )}
+
+ acl_smtp_rcpt = acl_check_rcpt
+ acl_smtp_data = acl_check_data
+
+ never_users = root
+
+ host_lookup = *
+
+ rfc1413_hosts = *
+ rfc1413_query_timeout = 5s
+
+ log_selector = -queue_run +address_rewrite +all_parents +queue_time
+ log_file_path = syslog
+ syslog_timestamp = false
+ syslog_duplication = false
+
+ begin acl
+
+ acl_check_rcpt:
+ accept hosts = :
+ control = dkim_disable_verify
+
+ deny message = Restricted characters in address
+ domains = +local_domains
+ local_parts = ^[.] : ^.*[@%!/|]
+
+ deny message = Restricted characters in address
+ domains = !+local_domains
+ local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
+
+ accept local_parts = postmaster
+ domains = +local_domains
+
+ accept hosts = +relay_from_hosts
+ control = submission
+ control = dkim_disable_verify
+
+ accept authenticated = *
+ control = submission
+ control = dkim_disable_verify
+
+ accept message = relay not permitted 2
+ recipients = lsearch;${lsearch.internet-aliases}
+
+ require message = relay not permitted
+ domains = +local_domains : +relay_to_domains
+
+ require
+ message = unknown user
+ verify = recipient/callout
+
+ accept
+
+
+ acl_check_data:
+ warn
+ sender_domains = ${concatStringsSep ":" cfg.sender_domains}
+ set acl_m_special_dom = $sender_address_domain
+
+ accept
+
+
+ begin routers
+
+ # feature RETIOLUM_MAIL
+ retiolum:
+ debug_print = "R: retiolum for $local_part@$domain"
+ driver = manualroute
+ domains = ! ${cfg.primary_hostname} : *.retiolum
+ transport = retiolum_smtp
+ route_list = ^.* $0 byname
+ no_more
+
+ internet_aliases:
+ debug_print = "R: internet_aliases for $local_part@$domain"
+ driver = redirect
+ data = ''${lookup{$local_part@$domain}lsearch{${lsearch.internet-aliases}}}
+
+ dnslookup:
+ debug_print = "R: dnslookup for $local_part@$domain"
+ driver = dnslookup
+ domains = ! +local_domains
+ transport = remote_smtp
+ ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
+ no_more
+
+ system_aliases:
+ debug_print = "R: system_aliases for $local_part@$domain"
+ driver = redirect
+ data = ''${lookup{$local_part}lsearch{${lsearch.system-aliases}}}
+
+ local_user:
+ debug_print = "R: local_user for $local_part@$domain"
+ driver = accept
+ check_local_user
+ transport = home_maildir
+ cannot_route_message = Unknown user
+
+ begin transports
+
+ retiolum_smtp:
+ driver = smtp
+ retry_include_ip_address = false
+
+ remote_smtp:
+ driver = smtp
+ helo_data = ''${if eq{$acl_m_special_dom}{} \
+ {$primary_hostname} \
+ {$acl_m_special_dom} }
+
+ home_maildir:
+ driver = appendfile
+ maildir_format
+ maildir_use_size_file
+ directory = $home/Mail
+ directory_mode = 0700
+ delivery_date_add
+ envelope_to_add
+ return_path_add
+
+ begin retry
+ *.retiolum * F,42d,1m
+ * * F,2h,15m; G,16h,1h,1.5; F,4d,6h
+
+ begin rewrite
+ begin authenticators
+ '';
+ };
+ };
+
+
+ lsearch = mapAttrs (name: set: toFile name (to-lsearch set)) {
+ inherit (cfg) internet-aliases;
+ inherit (cfg) system-aliases;
+ };
+
+ to-lsearch = concatMapStringsSep "\n" ({ from, to, ... }: "${from}: ${to}");
+
+in
+out
diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 975c36b08..f767d20fe 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -21,6 +21,12 @@ types // rec {
apply = x: assert hasAttr "retiolum" x; x;
};
+ extraZones = mkOption {
+ default = {};
+ # TODO: string is either MX, NS, A or AAAA
+ type = with types; attrsOf string;
+ };
+
secure = mkOption {
type = bool;
default = false;
@@ -74,11 +80,6 @@ types // rec {
}));
default = null;
};
- zones = mkOption {
- default = [];
- # TODO: string is either MX, NS, A or AAAA
- type = with types; listOf (attrsOf str);
- };
};
});
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index 5de84f66c..89872f1eb 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -12,4 +12,5 @@ pkgs //
github-hosts-sync = callPackage ./github-hosts-sync.nix {};
github-known_hosts = callPackage ./github-known_hosts.nix {};
hashPassword = callPackage ./hashPassword.nix {};
+ posix-array = callPackage ./posix-array.nix {};
}
diff --git a/krebs/5pkgs/posix-array.nix b/krebs/5pkgs/posix-array.nix
new file mode 100644
index 000000000..456a3cc11
--- /dev/null
+++ b/krebs/5pkgs/posix-array.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchgit, ... }:
+
+with stdenv; stdenv.mkDerivation rec {
+ name = "posix-array";
+ version = "1.0.0";
+
+ src = fetchgit {
+ url = https://github.com/makefu/array.git;
+ rev = "refs/tags/${version}";
+ sha256 = "0yzwlhdg1rgc4p64ny7gj30l7z6vikhskhppsa2qj7s9gm2gz938";
+ };
+
+ phases = [
+ "unpackPhase"
+ "installPhase"
+ ];
+
+ installPhase = ''
+ mkdir -p "$out/bin"
+ cp -a ./array $out/bin
+ rm *
+ '';
+
+ meta = {
+ description = "Posix-compliant array implementation";
+ url = https://github.com/makefu/array;
+ license = licenses.wtfpl;
+ platforms = platforms.unix;
+ maintainers = with maintainers; [ makefu ];
+ };
+}
diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index e7edcccea..e7f8d5276 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -20,6 +20,7 @@
../2configs/new-repos.nix
#../../2configs/tv/synaptics.nix
../2configs/retiolum.nix
+ ../2configs/wordpress.nix
];
krebs.build = {
@@ -29,7 +30,7 @@
deps = {
nixpkgs = {
url = https://github.com/Lassulus/nixpkgs;
- rev = "1879a011925c561f0a7fd4043da0768bbff41d0b";
+ rev = "961fd7b7a0f88dde7dac2f7a4c05ee4e1a25381d";
};
secrets = {
url = "/home/lass/secrets/${config.krebs.build.host.name}";
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index 74d995560..041b891b6 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -3,15 +3,15 @@
with builtins;
{
imports = [
- ../../2configs/lass/desktop-base.nix
- ../../2configs/lass/browsers.nix
- ../../2configs/lass/games.nix
- ../../2configs/lass/pass.nix
- ../../2configs/lass/urxvt.nix
- ../../2configs/lass/bird.nix
- ../../2configs/lass/new-repos.nix
- ../../2configs/lass/chromium-patched.nix
- ../../2configs/lass/retiolum.nix
+ ../2configs/desktop-base.nix
+ ../2configs/browsers.nix
+ ../2configs/games.nix
+ ../2configs/pass.nix
+ ../2configs/urxvt.nix
+ ../2configs/bird.nix
+ ../2configs/new-repos.nix
+ ../2configs/chromium-patched.nix
+ ../2configs/retiolum.nix
{
users.extraUsers = {
root = {
diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix
new file mode 100644
index 000000000..e6d31a6c4
--- /dev/null
+++ b/lass/2configs/downloading.nix
@@ -0,0 +1,67 @@
+{ config, pkgs, ... }:
+
+{
+ imports = [
+ ../3modules/iptables.nix
+ ../3modules/folderPerms.nix
+ ];
+
+ users.extraUsers = {
+ download = {
+ name = "download";
+ home = "/var/download";
+ createHome = true;
+ extraGroups = [
+ "download"
+ ];
+ };
+
+ transmission = {
+ extraGroups = [
+ "download"
+ ];
+ };
+ };
+
+ users.extraGroups = {
+ download = {
+ members = [
+ "download"
+ "transmission"
+ ];
+ };
+ };
+
+ services.transmission = {
+ enable = true;
+ settings = {
+ download-dir = "/var/download/finished";
+ incomplete-dir = "/var/download/incoming";
+ incomplete-dir-enabled = true;
+
+ rpc-authentication-required = true;
+ rpc-whitelist-enabled = false;
+ rpc-username = "download";
+ #add rpc-password in secrets
+ rpc-password = "test123";
+ };
+ };
+
+ lass.iptables = {
+ enable = true;
+ tables.filter.INPUT.rules = [
+ { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; }
+ ];
+ };
+
+ lass.folderPerms = {
+ enable = true;
+ permissions = [
+ {
+ path = "/var/download";
+ permission = "775";
+ owner = "transmission:download";
+ }
+ ];
+ };
+}
diff --git a/lass/2configs/fastpoke-pages.nix b/lass/2configs/fastpoke-pages.nix
index 9c80fa77a..1c8106a88 100644
--- a/lass/2configs/fastpoke-pages.nix
+++ b/lass/2configs/fastpoke-pages.nix
@@ -20,8 +20,8 @@ let
# 10.243.206.102 ${domain}
#'';
users.extraUsers = {
- "${domain}" = {
- name = "${domain}";
+ ${domain} = {
+ name = domain;
home = "/var/lib/http/${domain}";
createHome = true;
};
@@ -90,9 +90,9 @@ in {
};
};
- services.postgresql = {
- enable = true;
- };
+ #services.postgresql = {
+ # enable = true;
+ #};
#config.services.vsftpd = {
# enable = true;
diff --git a/lass/2configs/wordpress.nix b/lass/2configs/wordpress.nix
new file mode 100644
index 000000000..9458deb38
--- /dev/null
+++ b/lass/2configs/wordpress.nix
@@ -0,0 +1,59 @@
+{ config, pkgs, ... }:
+
+{
+ containers.wordpress = {
+ privateNetwork = true;
+ hostAddress = "192.168.101.1";
+ localAddress = "192.168.101.2";
+
+ config = {
+ imports = [
+ ../3modules/iptables.nix
+ ];
+
+ lass.iptables = {
+ enable = true;
+ tables = {
+ filter.INPUT.policy = "DROP";
+ filter.FORWARD.policy = "DROP";
+ filter.INPUT.rules = [
+ { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; precedence = 10001; }
+ { predicate = "-p icmp"; target = "ACCEPT"; precedence = 10000; }
+ { predicate = "-i lo"; target = "ACCEPT"; precedence = 9999; }
+ { predicate = "-p tcp --dport 22"; target = "ACCEPT"; precedence = 9998; }
+ { predicate = "-p tcp --dport 80"; target = "ACCEPT"; precedence = 9998; }
+ ];
+ };
+ };
+
+ environment.systemPackages = with pkgs; [
+ iptables
+ ];
+
+ services.postgresql = {
+ enable = true;
+ package = pkgs.postgresql;
+ };
+
+ services.httpd = {
+ enable = true;
+ adminAddr = "root@apanowicz.de";
+ extraModules = [
+ { name = "php5"; path = "${pkgs.php}/modules/libphp5.so"; }
+ ];
+ virtualHosts = [
+ {
+ hostName = "wordpress";
+ serverAliases = [ "wordpress" "www.wordpress" ];
+
+ extraSubservices = [
+ {
+ serviceName = "wordpress";
+ }
+ ];
+ }
+ ];
+ };
+ };
+ };
+}
diff --git a/lass/3modules/folderPerms.nix b/lass/3modules/folderPerms.nix
new file mode 100644
index 000000000..bb0320327
--- /dev/null
+++ b/lass/3modules/folderPerms.nix
@@ -0,0 +1,104 @@
+{ config, lib, pkgs, ... }:
+
+#TODO: implement recursive mode maybe?
+# enable different mods for files and folders
+
+let
+ inherit (pkgs)
+ writeScript
+ ;
+
+ inherit (lib)
+ concatMapStringsSep
+ concatStringsSep
+ mkEnableOption
+ mkIf
+ mkOption
+ types
+ ;
+
+ cfg = config.lass.folderPerms;
+
+ out = {
+ options.lass.folderPerms = api;
+ config = mkIf cfg.enable imp;
+ };
+
+ api = {
+ enable = mkEnableOption "folder permissions";
+ permissions = mkOption {
+ type = with types; listOf (submodule ({
+ options = {
+ path = mkOption {
+ type = str;
+ };
+ permission = mkOption {
+ type = nullOr str;
+ example = "755";
+ description = ''
+ basically anything that chmod takes as permission
+ '';
+ default = null;
+ };
+ owner = mkOption {
+ type = nullOr str;
+ example = "root:root";
+ description = ''
+ basically anything that chown takes as owner
+ '';
+ default = null;
+ };
+ };
+ }));
+ };
+ };
+
+ imp = {
+ systemd.services.lass-folderPerms = {
+ description = "lass-folderPerms";
+ wantedBy = [ "multi-user.target" ];
+
+ path = with pkgs; [
+ coreutils
+ ];
+
+ restartIfChanged = true;
+
+ serviceConfig = {
+ type = "simple";
+ RemainAfterExit = true;
+ Restart = "always";
+ ExecStart = "@${startScript}";
+ };
+ };
+ };
+
+ startScript = writeScript "lass-folderPerms" ''
+ ${concatMapStringsSep "\n" writeCommand cfg.permissions}
+ '';
+
+ writeCommand = fperm:
+ concatStringsSep "\n" [
+ (buildPermission fperm)
+ (buildOwner fperm)
+ ];
+
+ buildPermission = perm:
+ #TODO: create folder maybe
+ #TODO: check if permission is valid
+ if (perm.permission == null) then
+ ""
+ else
+ "chmod ${perm.permission} ${perm.path}"
+ ;
+
+ buildOwner = perm:
+ #TODO: create folder maybe
+ #TODO: check if owner/group valid
+ if (perm.owner == null) then
+ ""
+ else
+ "chown ${perm.owner} ${perm.path}"
+ ;
+
+in out
diff --git a/makefu/1systems/tsp.nix b/makefu/1systems/tsp.nix
index f19dbfea6..388ded068 100644
--- a/makefu/1systems/tsp.nix
+++ b/makefu/1systems/tsp.nix
@@ -12,12 +12,20 @@
../2configs/sda-crypto-root.nix
# hardware specifics are in here
../2configs/tp-x200.nix
+
+ ../2configs/disable_v6.nix
+ ../2configs/rad1o.nix
];
# not working in vm
krebs.build.host = config.krebs.hosts.tsp;
krebs.build.user = config.krebs.users.makefu;
krebs.build.target = "root@tsp";
+ krebs.exim-retiolum.enable = true;
+ networking.firewall.allowedTCPPorts = [
+ 25
+ ];
+
krebs.build.deps = {
nixpkgs = {
#url = https://github.com/NixOS/nixpkgs;
diff --git a/makefu/2configs/rad1o.nix b/makefu/2configs/rad1o.nix
new file mode 100644
index 000000000..03bb9bc7e
--- /dev/null
+++ b/makefu/2configs/rad1o.nix
@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+
+{
+
+ environment.systemPackages = with pkgs; [
+ gnuradio-full
+ gnuradio-osmosdr
+ gqrx
+ ];
+
+ users.extraUsers.${config.krebs.build.user.name}.extraGroups = [ "dialout" ];
+
+ services.udev.extraRules = ''
+ ATTR{idVendor}=="1d50", ATTR{idProduct}=="604b", SYMLINK+="hackrf-jawbreaker-%k", MODE="0666", GROUP="dialout"
+ ATTR{idVendor}=="1d50", ATTR{idProduct}=="6089", SYMLINK+="hackrf-one-%k", MODE="0666", GROUP="dialout"
+ ATTR{idVendor}=="1d50", ATTR{idProduct}=="cc15", SYMLINK+="rad1o-%k", MODE="0666", GROUP="dialout"
+ ATTR{idVendor}=="1fc9", ATTR{idProduct}=="000c", SYMLINK+="nxp-dfu-%k", MODE="0666", GROUP="dialout"
+ '';
+}
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 54292eb83..659b95065 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -30,7 +30,6 @@ in
../2configs/CAC-CentOS-7-64bit.nix
../2configs/base.nix
../2configs/consul-server.nix
- ../2configs/exim-smarthost.nix
../2configs/git.nix
{
imports = [ ../2configs/charybdis.nix ];
@@ -46,6 +45,59 @@ in
};
}
{
+ krebs.exim-smarthost = {
+ enable = true;
+ primary_hostname = "${config.networking.hostName}.retiolum";
+ sender_domains = [
+ "shackspace.de"
+ "viljetic.de"
+ ];
+ relay_from_hosts = [
+ "10.243.13.37"
+ ];
+ internet-aliases = with config.krebs.users; [
+ { from = "tomislav@viljetic.de"; to = tv.mail; }
+
+ # (mindestens) lisp-stammtisch und elli haben die:
+ { from = "tv@viljetic.de"; to = tv.mail; }
+
+ { from = "tv@destroy.dyn.shackspace.de"; to = tv.mail; }
+
+ { from = "mirko@viljetic.de"; to = mv.mail; }
+
+ # TODO killme (wo wird die benutzt?)
+ { from = "tv@cd.retiolum"; to = tv.mail; }
+
+ # TODO lists@smtp.retiolum [consul]
+ { from = "postmaster@krebsco.de"; to = tv.mail; }
+
+ { from = "spam@krebsco.de";
+ to = pkgs.lib.concatStringsSep "," [
+ tv.mail
+ "lass@mors.retiolum"
+ makefu.mail
+ ];
+ }
+ ];
+ system-aliases = [
+ { from = "mailer-daemon"; to = "postmaster"; }
+ { from = "postmaster"; to = "root"; }
+ { from = "nobody"; to = "root"; }
+ { from = "hostmaster"; to = "root"; }
+ { from = "usenet"; to = "root"; }
+ { from = "news"; to = "root"; }
+ { from = "webmaster"; to = "root"; }
+ { from = "www"; to = "root"; }
+ { from = "ftp"; to = "root"; }
+ { from = "abuse"; to = "root"; }
+ { from = "noc"; to = "root"; }
+ { from = "security"; to = "root"; }
+ { from = "root"; to = "tv"; }
+ { from = "mirko"; to = "mv"; }
+ ];
+ };
+ }
+ {
krebs.github-hosts-sync.enable = true;
tv.iptables.input-internet-accept-new-tcp =
singleton config.krebs.github-hosts-sync.port;
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 896c1ad29..6418cdc5e 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -38,7 +38,7 @@ with lib;
};
}
{
- krebs.exim-retiolum = true;
+ krebs.exim-retiolum.enable = true;
}
{
krebs.nginx = {
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index a5cbde3ec..20dbca12f 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -165,7 +165,7 @@ in
};
}
{
- krebs.exim-retiolum = true;
+ krebs.exim-retiolum.enable = true;
}
{
krebs.nginx = {
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
deleted file mode 100644
index c93189b8a..000000000
--- a/tv/2configs/exim-smarthost.nix
+++ /dev/null
@@ -1,475 +0,0 @@
-{ config, pkgs, ... }:
-
-let
- inherit (builtins) toFile;
- inherit (pkgs.lib.attrsets) mapAttrs;
- inherit (pkgs.lib.strings) concatMapStringsSep;
-in
-