62 files changed, 474 insertions, 435 deletions

diff --git a/0make/tv/cd.makefile b/0make/tv/cd.makefile
deleted file mode 100644
index e021423f4..000000000
--- a/0make/tv/cd.makefile
+++ /dev/null
@@ -1,4 +0,0 @@
-deploy_host := root@cd-global
-nixpkgs_url := https://github.com/NixOS/nixpkgs
-nixpkgs_rev := 4c01e6d91993b6de128795f4fbdd25f6227fb870
-secrets_dir := /home/tv/secrets/cd
diff --git a/0make/tv/mkdir.makefile b/0make/tv/mkdir.makefile
deleted file mode 100644
index b10398a07..000000000
--- a/0make/tv/mkdir.makefile
+++ /dev/null
@@ -1,4 +0,0 @@
-deploy_host := root@mkdir
-nixpkgs_url := https://github.com/NixOS/nixpkgs
-nixpkgs_rev := 4c01e6d91993b6de128795f4fbdd25f6227fb870
-secrets_dir := /home/tv/secrets/mkdir
diff --git a/0make/tv/nomic.makefile b/0make/tv/nomic.makefile
deleted file mode 100644
index 9e0b8671b..000000000
--- a/0make/tv/nomic.makefile
+++ /dev/null
@@ -1,4 +0,0 @@
-deploy_host := root@nomic.gg23
-nixpkgs_url := https://github.com/NixOS/nixpkgs
-nixpkgs_rev := 9d5508d85c33b8fb22d79dde6176792eac2c2696
-secrets_dir := /home/tv/secrets/nomic
diff --git a/0make/tv/rmdir.makefile b/0make/tv/rmdir.makefile
deleted file mode 100644
index 6075bd3d4..000000000
--- a/0make/tv/rmdir.makefile
+++ /dev/null
@@ -1,4 +0,0 @@
-deploy_host := root@rmdir
-nixpkgs_url := https://github.com/NixOS/nixpkgs
-nixpkgs_rev := 4c01e6d91993b6de128795f4fbdd25f6227fb870
-secrets_dir := /home/tv/secrets/rmdir
diff --git a/0make/tv/wu.makefile b/0make/tv/wu.makefile
deleted file mode 100644
index ef7e51194..000000000
--- a/0make/tv/wu.makefile
+++ /dev/null
@@ -1,4 +0,0 @@
-deploy_host := root@wu
-nixpkgs_url := /home/tv/src/nixpkgs
-nixpkgs_rev := 7725eb1d3ed85fc34edde3c3a7907ab234933a68
-secrets_dir := /home/tv/secrets/wu
diff --git a/3modules/krebs/default.nix b/3modules/krebs/default.nix
index 3c2f7c9cb..9e25df0bf 100644
--- a/3modules/krebs/default.nix
+++ b/3modules/krebs/default.nix
@@ -20,8 +20,108 @@ let
     enable = mkEnableOption "krebs";
 
     build = mkOption {
-      type = types.submodule {
+      type = types.submodule ({ config, ... }: {
         options = {
+          target = mkOption {
+            type = with types; nullOr str;
+            default = null;
+          };
+          deps = mkOption {
+            type = with types; attrsOf (submodule {
+              options = {
+                url = mkOption {
+                  type = str;
+                };
+                rev = mkOption {
+                  type = nullOr str;
+                  default = null;
+                };
+              };
+            });
+            default = {};
+          };
+          script = mkOption {
+            type = types.str;
+            default = ''
+              #! /bin/sh
+              set -efux
+
+              target=${escapeShellArg cfg.build.target}
+
+              push(){(
+                src=$1/
+                dst=$target:$2
+                rsync \
+                  --exclude .git \
+                  --exclude .graveyard \
+                  --exclude old \
+                  --rsync-path="mkdir -p \"$dst\" && rsync" \
+                  --usermap=\*:0 \
+                  --groupmap=\*:0 \
+                  --delete-excluded \
+                  -vrLptgoD \
+                  "$src" "$dst"
+              )}
+
+              ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
+                optionalString (rev == null) ''
+                  push ${toString (map escapeShellArg [
+                    "${url}"
+                    "/root/src/${name}"
+                  ])}
+                '') config.deps)}
+
+              exec ssh -S none "$target" /bin/sh <<\EOF
+              set -efux
+              fetch(){(
+                url=$1
+                rev=$2
+                dst=$3
+                mkdir -p "$dst"
+                cd "$dst"
+                if ! test -e .git; then
+                  git init
+                fi
+                if ! cur_url=$(git config remote.origin.url 2>/dev/null); then
+                  git remote add origin "$url"
+                elif test "$cur_url" != "$url"; then
+                  git remote set-url origin "$url"
+                fi
+                if test "$(git rev-parse --verify HEAD 2>/dev/null)" != "$rev"; then
+                  git fetch origin
+                  git checkout "$rev" -- .
+                  git checkout -q "$rev"
+                  git submodule init
+                  git submodule update
+                fi
+                git clean -dxf
+              )}
+
+              ${concatStrings (mapAttrsToList (name: { url, rev, ... }:
+                optionalString (rev != null) ''
+                  fetch ${toString (map escapeShellArg [
+                    url
+                    rev
+                    "/root/src/${name}"
+                  ])}
+                '') config.deps)}
+
+              echo build system...
+              profile=/nix/var/nix/profiles/system
+              NIX_PATH=/root/src \
+              nix-env \
+                -Q \
+                -p "$profile" \
+                -f '<stockholm>' \
+                --set \
+                -A system \
+                --argstr user-name ${escapeShellArg cfg.build.user.name} \
+                --argstr system-name ${escapeShellArg cfg.build.host.name}
+
+              exec "$profile"/bin/switch-to-configuration switch
+              EOF
+            '';
+          };
           host = mkOption {
             type = types.host;
           };
@@ -29,11 +129,19 @@ let
             type = types.user;
           };
         };
-      };
+      });
       # Define defaul value, so unset values of the submodule get reported.
       default = {};
     };
 
+    dns = {
+      providers = mkOption {
+        # TODO with types; tree dns.label dns.provider, so we can merge.
+        # Currently providers can only be merged if aliases occur just once.
+        type = with types; attrsOf unspecified;
+      };
+    };
+
     hosts = mkOption {
       type = with types; attrsOf host;
     };
@@ -46,8 +154,7 @@ let
     # TODO search-domains :: listOf hostname
     search-domain = mkOption {
       type = types.hostname;
-      default = "";
-      example = "retiolum";
+      default = "retiolum";
     };
   };
 
@@ -56,38 +163,26 @@ let
     { krebs = makefu-imp; }
     { krebs = tv-imp; }
     {
-      # XXX This overlaps with krebs.retiolum
-      networking.extraHosts =
-        let
-          # TODO move domain name providers to a dedicated module
-          # providers : tree label providername
-          providers = {
-            internet = "hosts";
-            retiolum = "hosts";
-            de.viljetic = "regfish";
-            de.krebsco = "ovh";
-          };
-
-          # splitByProvider : [alias] -> listset providername alias
-          splitByProvider = foldl (acc: alias: listset-insert (providerOf alias) alias acc) {};
+      krebs.dns.providers = {
+        de.krebsco = "ovh";
+        internet = "hosts";
+        retiolum = "hosts";
+      };
 
-          # providerOf : alias -> providername
-          providerOf = alias:
-            tree-get (splitString "." alias) providers;
-        in
-        concatStringsSep "\n" (flatten (
-          # TODO deepMap ["hosts" "nets"] (hostname: host: netname: net:
-          mapAttrsToList (hostname: host:
-            mapAttrsToList (netname: net:
-              let
-                aliases = toString (unique (longs ++ shorts));
-                longs = (splitByProvider net.aliases).hosts;
-                shorts = map (removeSuffix ".${cfg.search-domain}") longs;
-              in
-              map (addr: "${addr} ${aliases}") net.addrs
-            ) host.nets
-          ) config.krebs.hosts
-        ));
+      # XXX This overlaps with krebs.retiolum
+      networking.extraHosts = concatStringsSep "\n" (flatten (
+        mapAttrsToList (hostname: host:
+          mapAttrsToList (netname: net:
+            let
+              aliases = toString (unique (longs ++ shorts));
+              providers = dns.split-by-provider net.aliases cfg.dns.providers;
+              longs = providers.hosts;
+              shorts = map (removeSuffix ".${cfg.search-domain}") longs;
+            in
+            map (addr: "${addr} ${aliases}") net.addrs
+          ) host.nets
+        ) cfg.hosts
+      ));
     }
   ];
 
@@ -140,6 +235,9 @@ let
   };
 
   tv-imp = {
+    dns.providers = {
+      de.viljetic = "regfish";
+    };
     hosts = addNames {
       cd = {
         cores = 2;
diff --git a/3modules/krebs/urlwatch.nix b/3modules/krebs/urlwatch.nix
index 58de72fc6..39d9fec54 100644
--- a/3modules/krebs/urlwatch.nix
+++ b/3modules/krebs/urlwatch.nix
@@ -35,20 +35,22 @@ let
     };
     mailto = mkOption {
       type = types.str;
+      default = config.krebs.build.user.mail;
       description = ''
         Content of the To: header of the generated mails. [AKA recipient :)]
       '';
     };
     onCalendar = mkOption {
       type = types.str;
+      default = "04:23";
       description = ''
         Run urlwatch at this interval.
         The format is described in systemd.time(7), CALENDAR EVENTS.
       '';
-      example = "04:23";
     };
     urls = mkOption {
       type = with types; listOf str;
+      default = [];
       description = "URL to watch.";
       example = [
         https://nixos.org/channels/nixos-unstable/git-revision
diff --git a/4lib/krebs/default.nix b/4lib/krebs/default.nix
index 0c42a5de3..b67585335 100644
--- a/4lib/krebs/default.nix
+++ b/4lib/krebs/default.nix
@@ -12,22 +12,7 @@ builtins // lib // rec {
 
   types = import ./types.nix { inherit lib; };
 
-
-  # listset k v = set k [v]
-
-  # listset-insert : k -> v -> listset k v -> listset k v
-  listset-insert = name: value: set:
-    set // { ${name} = set.${name} or [] ++ [value]; };
-
-  # tree k v = set k (either v (tree k v))
-
-  # tree-get : [k] -> tree k v -> v
-  tree-get = path: x:
-    let
-      y = x.${last path};
-    in
-    if typeOf y != "set"
-      then y
-      else tree-get (init path) y;
-
+  dns = import ./dns.nix { inherit lib; };
+  listset = import ./listset.nix { inherit lib; };
+  tree = import ./tree.nix { inherit lib; };
 }
diff --git a/4lib/krebs/dns.nix b/4lib/krebs/dns.nix
new file mode 100644
index 000000000..b2cf3c24c
--- /dev/null
+++ b/4lib/krebs/dns.nix
@@ -0,0 +1,31 @@
+{ lib, ... }:
+
+let
+  listset = import ./listset.nix { inherit lib; };
+in
+
+with builtins;
+with lib;
+
+rec {
+  # label = string
+
+  # TODO does it make sense to have alias = list label?
+
+  # split-by-provider :
+  #   [[label]] -> tree label provider -> listset provider alias
+  split-by-provider = as: providers:
+    foldl (m: a: listset.insert (provider-of a providers) a m) {} as;
+
+  # provider-of : alias -> tree label provider -> provider
+  # Note that we cannot use tree.get here, because path can be longer
+  # than the tree depth.
+  provider-of = a:
+    let
+      go = path: tree:
+        if typeOf tree == "string"
+          then tree
+          else go (tail path) tree.${head path};
+    in
+    go (reverseList (splitString "." a));
+}
diff --git a/4lib/krebs/listset.nix b/4lib/krebs/listset.nix
new file mode 100644
index 000000000..3aae22f20
--- /dev/null
+++ b/4lib/krebs/listset.nix
@@ -0,0 +1,11 @@
+{ lib, ... }:
+
+with lib;
+
+rec {
+  # listset k v = set k [v]
+
+  # insert : k -> v -> listset k v -> listset k v
+  insert = name: value: set:
+    set // { ${name} = set.${name} or [] ++ [value]; };
+}
diff --git a/4lib/krebs/tree.nix b/4lib/krebs/tree.nix
new file mode 100644
index 000000000..1cd83b3f6
--- /dev/null
+++ b/4lib/krebs/tree.nix
@@ -0,0 +1,13 @@
+{ lib, ... }:
+
+with lib;
+
+rec {
+  # tree k v = set k (either v (tree k v))
+
+  # get : [k] -> tree k v -> v
+  get = path: tree:
+    if length path > 0
+      then get (tail path) tree.${head path} # TODO check if elem exists
+      else tree;
+}
diff --git a/4lib/krebs/types.nix b/4lib/krebs/types.nix
index 3d3d75a65..92410dd58 100644
--- a/4lib/krebs/types.nix
+++ b/4lib/krebs/types.nix
@@ -55,7 +55,7 @@ types // rec {
         type = listOf hostname;
       };
       tinc = mkOption {
-        type = let net-config = config; in submodule ({ config, ... }: {
+        type = let net-config = config; in nullOr (submodule ({ config, ... }: {
           options = {
             config = mkOption {
               type = str;
@@ -70,7 +70,8 @@ types // rec {
               type = str;
             };
           };
-        });
+        }));
+        default = null;
       };
     };
   });
@@ -92,6 +93,10 @@ types // rec {
       pubkey = mkOption {
         type = str;
       };
+      pubkeys = mkOption {
+        type = attrsOf str;
+        default = {};
+      };
     };
   };
 
diff --git a/4lib/tv/default.nix b/4lib/tv/default.nix
deleted file mode 100644
index 16888c214..000000000
--- a/4lib/tv/default.nix
+++ /dev/null
@@ -1,52 +0,0 @@
-{ lib, pkgs, ... }:
-
-let
-  krebs = import ../../4lib/krebs { inherit lib; };
-in
-
-with krebs;
-
-krebs // rec {
-
-  git = import ./git.nix {
-    lib = lib // {
-      inherit addNames;
-    };
-    inherit pkgs;
-  };
-
-  # "7.4.335" -> "74"
-  majmin = with lib; x : concatStrings (take 2 (splitString "." x));
-
-  concat = xs :
-    if xs == []
-      then ""
-      else head xs + concat (tail xs)
-    ;
-
-  flip = f : x : y : f y x;
-
-  # isSuffixOf :: String -> String -> Bool
-  isSuffixOf =
-    s : xs :
-      let
-        sn = stringLength s;
-        xsn = stringLength xs;
-      in
-        xsn >= sn && substring (xsn - sn) sn xs == s ;
-
-  # setMap :: (String -> a -> b) -> Set String a -> [b]
-  #setMap = f: xs: map (k : f k (getAttr k xs)) (attrNames xs);
-
-  # setToList :: Set k a -> [a]
-  #setToList = setMap (_: v: v);
-
-  shell-escape =
-    let
-      isSafeChar = c: match "[-./0-9_a-zA-Z]" c != null;
-    in
-    stringAsChars (c:
-      if isSafeChar c then c
-      else if c == "\n" then "'\n'"
-      else "\\${c}");
-}
diff --git a/Makefile b/Makefile
index 6d075e6f2..ca828fd2b 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 # usage:
 #		make system=foo
 #		make systems='foo bar'
-#		make eval system=foo get=config.networking.extraHosts
+#		make eval system=foo get=config.networking.extraHosts [filter=json]
 #
 
 .ONESHELL:
@@ -17,91 +17,30 @@ $(systems):
 		--tagstring {} \
 		-q make systems= system={} ::: $(systems)
 else ifdef system
-include 0make/$(LOGNAME)/$(system).makefile
 .PHONY: deploy
 deploy:;@
-	system_name=$(system)
-	deploy_host=$(deploy_host)
-	nixpkgs_url=$(nixpkgs_url)
-	nixpkgs_rev=$(nixpkgs_rev)
-	secrets_dir=$(secrets_dir)
-
-	prepush(){(
-		dst=$$1
-		src=$$2
-		rsync \
-			--exclude .git \
-			--exclude .graveyard \
-			--exclude old \
-			--rsync-path="mkdir -p \"$$dst\" && rsync" \
-			--usermap=\*:0 \
-			--groupmap=\*:0 \
-			--delete-excluded \
-			-vrLptgoD \
-			"$$src/" "$$deploy_host:$$dst"
-	)}
-
-	prepush /root/src/stockholm "$$PWD"
-	prepush /root/src/secrets "$$secrets_dir"
-
-	ssh -S none "$$deploy_host" -T env \
-			nixpkgs_url="$$nixpkgs_url" \
-			nixpkgs_rev="$$nixpkgs_rev" \
-			system_name="$$system_name" \
-			user_name="$$LOGNAME" \
-		sh -euf \
-	<<-\EOF
-		prefetch(){(
-			dst=$$1
-			url=$$2
-			rev=$$3
-			mkdir -p "$$dst"
-			cd "$$dst"