diff options
| -rw-r--r-- | krebs/2configs/reaktor2.nix | 151 | ||||
| -rw-r--r-- | krebs/3modules/default.nix | 3 | ||||
| -rw-r--r-- | krebs/3modules/external/default.nix | 55 | ||||
| -rw-r--r-- | krebs/3modules/external/mic92.nix | 28 | ||||
| -rw-r--r-- | krebs/3modules/github-known-hosts.nix | 78 | ||||
| -rw-r--r-- | krebs/3modules/github/default.nix | 6 | ||||
| -rw-r--r-- | krebs/3modules/github/hosts-sync.nix (renamed from krebs/3modules/github-hosts-sync.nix) | 0 | ||||
| -rw-r--r-- | krebs/3modules/github/known-hosts.json | 58 | ||||
| -rw-r--r-- | krebs/3modules/github/known-hosts.nix | 12 | ||||
| -rw-r--r-- | krebs/nixpkgs-unstable.json | 8 | ||||
| -rw-r--r-- | krebs/nixpkgs.json | 8 | ||||
| -rw-r--r-- | tv/3modules/ejabberd/config.nix | 129 | ||||
| -rw-r--r-- | tv/3modules/ejabberd/default.nix | 240 |
13 files changed, 493 insertions, 283 deletions
diff --git a/krebs/2configs/reaktor2.nix b/krebs/2configs/reaktor2.nix index f5041a59d..afaac9dae 100644 --- a/krebs/2configs/reaktor2.nix +++ b/krebs/2configs/reaktor2.nix @@ -9,6 +9,48 @@ let hooks = pkgs.reaktor2-plugins.hooks; commands = pkgs.reaktor2-plugins.commands; + # bedger - the bier ledger + # + # logo: http://c.r/bedger2 + # + bedger-add = { + pattern = ''^([\H-]*?):?\s+([+-][1-9][0-9]*)\s+(\S+)$''; + activate = "match"; + arguments = [1 2 3]; + command = { + env = { + # TODO; get state as argument + state_file = "${stateDir}/ledger"; + }; + filename = pkgs.writeDash "bedger-add" '' + set -x + tonick=$1 + amt=$2 + unit=$3 + printf '%s\n %s %d %s\n %s %d %s\n' "$(date -Id)" "$tonick" "$amt" "$unit" "$_from" "$(expr 0 - "''${amt#+}")" "$unit" >> $state_file + ${pkgs.hledger}/bin/hledger -f $state_file bal -N -O csv \ + | ${pkgs.coreutils}/bin/tail +2 \ + | ${pkgs.miller}/bin/mlr --icsv --opprint cat \ + | ${pkgs.gnugrep}/bin/grep "$_from" + ''; + }; + }; + bedger-balance = { + pattern = "^bier (ballern|bal(an(ce)?)?)$"; + activate = "match"; + command = { + env = { + state_file = "${stateDir}/ledger"; + }; + filename = pkgs.writeDash "bedger-balance" '' + ${pkgs.hledger}/bin/hledger -f $state_file bal -N -O csv \ + | ${pkgs.coreutils}/bin/tail +2 \ + | ${pkgs.miller}/bin/mlr --icsv --opprint cat \ + | ${pkgs.gnused}/bin/sed 's/^\(.\)/\1/' + ''; + }; + }; + taskRcFile = builtins.toFile "taskrc" '' confirmation=no ''; @@ -38,6 +80,38 @@ let }; }; + locationsLib = pkgs.writeText "locations.sh" '' + ENDPOINT=http://c.r/poi.json + get_locations() { + curl -fsS "$ENDPOINT" + } + + set_locations() { + curl -fSs --data-binary @- "$ENDPOINT" + } + + set_location() { + [ $# -eq 3 ] || return 1 + get_locations \ + | jq \ + --arg name "$1" \ + --arg latitude "$2" \ + --arg longitude "$3" \ + '.[$name] = { $latitude, $longitude }' \ + | set_locations + } + + get_location() { + [ $# -eq 1 ] || return 1 + get_locations | jq --arg name "$1" '.[$name]' + } + + delete_location() { + [ $# -eq 1 ] || return 1 + get_locations | jq --arg name "$1" 'del(.[$name])' | set_locations + } + ''; + systemPlugin = { plugin = "system"; config = { @@ -61,17 +135,78 @@ let ]; hooks.PRIVMSG = [ { - pattern = "^bier (ballern|bal(an(ce)?)?)$"; + pattern = "^list-locations"; + activate = "match"; + command = { + filename = pkgs.writeDash "list-locations" '' + export PATH=${makeBinPath [ + pkgs.curl + pkgs.jq + ]} + set -efu + set -x + . ${locationsLib} + get_locations | jq -r 'to_entries[]|"\(.key) \(.value.latitude),\(.value.longitude)"' + ''; + }; + } + { + pattern = ''^add-location (\S+) ([0-9.]+),([0-9.]+)$''; + activate = "match"; + arguments = [1 2 3]; + command = { + filename = pkgs.writeDash "add-location" '' + export PATH=${makeBinPath [ + pkgs.curl + pkgs.jq + ]} + set -efu + set -x + . ${locationsLib} + set_location "$1" $2 $3 + ''; + }; + } + { + pattern = ''^delete-location (\S+)$''; + activate = "match"; + arguments = [1]; + command = { + filename = pkgs.writeDash "add-location" '' + export PATH=${makeBinPath [ + pkgs.curl + pkgs.jq + ]} + set -efu + set -x + . ${locationsLib} + delete_location "$1" + ''; + }; + } + { + pattern = "18@p"; activate = "match"; command = { env = { - state_file = "${stateDir}/ledger"; + CACHE_DIR = "${stateDir}/krebsfood"; }; - filename = pkgs.writeDash "bier-balance" '' - ${pkgs.hledger}/bin/hledger -f $state_file bal -N -O csv \ - | ${pkgs.coreutils}/bin/tail +2 \ - | ${pkgs.miller}/bin/mlr --icsv --opprint cat \ - | ${pkgs.gnused}/bin/sed 's/^\(.\)/\1/' + filename = + let + osm-restaurants-src = pkgs.fetchFromGitHub { + owner = "kmein"; + repo = "scripts"; + rev = "66b2068d548d3418c81dd093bba3f80248c68196"; + sha256 = "059sp2lz54iwklswaxv9w703sbm2vv7p0ccig10gsqshriq6v58z"; + }; + osm-restaurants = pkgs.callPackage "${osm-restaurants-src}/osm-restaurants" {}; + in pkgs.writeDash "krebsfood" '' + set -efu + ecke_lat=52.51252 + ecke_lon=13.41740 + ${osm-restaurants}/bin/osm-restaurants --radius 500 --latitude "$ecke_lat" --longitude "$ecke_lon" \ + | ${pkgs.jq}/bin/jq -r '"How about \(.tags.name) (https://www.openstreetmap.org/\(.type)/\(.id)), open \(.tags.opening_hours)?"' + ' ''; }; } @@ -97,6 +232,8 @@ let ''; }; } + bedger-add + bedger-balance hooks.sed (generators.command_hook { inherit (commands) dance random-emoji nixos-version; diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 7f0070483..5ba436580 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -25,8 +25,7 @@ let ./exim.nix ./fetchWallpaper.nix ./git.nix - ./github-hosts-sync.nix - ./github-known-hosts.nix + ./github ./go.nix ./hidden-ssh.nix ./hosts.nix diff --git a/krebs/3modules/external/default.nix b/krebs/3modules/external/default.nix index 2748c2523..5cb40cfbb 100644 --- a/krebs/3modules/external/default.nix +++ b/krebs/3modules/external/default.nix @@ -315,6 +315,33 @@ in { }; }; }; + petrosilia = { + owner = config.krebs.users.jan; + nets = { + retiolum = { + ip4.addr = "10.243.143.11"; + aliases = [ + "petrosilia.r" + ]; + tinc.pubkey = '' + -----BEGIN RSA PUBLIC KEY----- + MIICCgKCAgEAxDumQ/06Yd3AQPSlHH9/kNngbc/tq5yBuT0ymbQGMHLL9X3pCz/f + y9GZVpQtaKm7EZ0Kj8ieaPOyG7BItH0AvTdSJV7rn4WKuKfe5E5S4E8YqsZfSu4N + IdEKVIisyBNCklXaDn6A7nxeUauwHQHuj0wOAnYKfaU+2haL+JzcFtQ1RpxDBsy1 + FbcEXO5NOhsXK4mHjtRrK1GamnCo5gvJU3w1NrfLRXteOOBsR49HhTIWvi8L4tSf + fd/mFwWayB7D0feLhWBpMPQTa5TeeQPxhgJrlIwXJiONG8GWFWNCHEjbQaCuJJWn + e37n9xCpdH867P921Ei+gyKZi9t6d+U4blrCpQzIe95t8Uv0i2c+YNt9NQL5Z119 + jt/Xhm7ccT9FeOuYsbjcO6g0BJumILEjD309vfQfWNims++vMd53q3dzxp4Kau+f + vdMyrzWiIytM+/iQmneG8XLv0b7I6FUPEahpCncZ14NqBDaKclwoJ/HfB+WZi6JV + yBVJHm9vogfzD1sLmDctHps3uJAeZHzszws8LMKdd5JxxQzVBRcrD1LKHYmmUYTU + 5gyDxnFn8ZoZ3GFVH+5v2PJgZY++/6zdDxQ9flrdt2zRaoAq2Zayn7R8sQ/ZjMXK + eR8aXgHzEL/n/9BMKs+jLu3j8xaiJX8ctnRvwSnOFjU9wQvJ7QNQHk0CAwEAAQ== + -----END RSA PUBLIC KEY----- + ''; + tinc.pubkey_ed25519 = "Rs5jdJk/YF4aXohp3isau4LHinD4VWlvSa9CcgznR+A"; + }; + }; + }; tpsw = { cores = 2; owner = config.krebs.users.ciko; # main laptop @@ -590,28 +617,28 @@ in { }; }; }; - karakalpakstan = { + sicily = { owner = config.krebs.users.xkey; nets = { retiolum = { ip4.addr = "10.243.161.1"; - aliases = [ "karakalpakstan.r" ]; + aliases = [ "sicily.r" "mukke.r" ]; tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- - MIICCgKCAgEA45kRCvWIaVteKQiz31AOjkEwHwOns/6SGXYzL5IswoEOT/i/8Ihl - l+ydTMTE28zs1nQp8MUBEdsJF02U8aEjPCyyMtZflZ+uaUAeJ0zAWTcb4AwdSjp+ - RKApp+LmVNDyx3W6rIgK7WYLfKhge4nRAlnshpekzaS2j7ccKhZMBIqyntYDJb6K - lE4poAgemMlE0apFV54d3ohWCZurfJ/K6BpsX7h+uwqFPOHi+pD7D/e2dHhSLXtS - 0cuFseQwqDF+xd5MAmApHO8w/BEdKWeU19TZmzkC5TlIO1HcknMq4Y8QkzCc5PXb - 5WeEdi1CyIGePldFv91LoHepsMV3nrIF7n6ZmdTuxj5GH0A0Zg0z4hrWJuXk64JM - bTpe/rDXWOG0IK0HN4z14ySD8yafLTV4gvH9Mg6jUqyqGfLpIK+o/N7ZavOeVKq5 - 3Hf9c246v1vhHjnbat5GyY79PmimEvxR51mOItpRoyJYfdSa3KrvUki0MboCiYAU - GKBmEw2BR3eybnejHqvAFov30MkmkOTz3mV/UPKELqhGCQf6UJAKG0GoxGpK3m8k - epNSAKUpj8B7+JM3Ybgl+CoAm/+qu7Ojp5j4Onn0kgB2yXryHJaNOdgraCXI2yzt - /n/eHElmKWoMCXhkV/mee1Cl2Y74XKivM6ov3lLvIDRxdXl46PvBFVkCAwEAAQ== + MIICCgKCAgEAzjCrsMRptg22QJTXsNgrxE/CjpGiDD9NYExqiDQ7kyKJ7+nrjtJg + aI1bL7CmlfbleE47VmkZBbyglI7wELA0X//WW6laz/5XwBKQyYSgt1ZtcordYoam + xeNmV9a4dcpYO5y+YXxac8epX8TVSu1c0H7jEMcGrvTXDZwijEPQTMCvj2pookod + 1seiLKjKZTW7TWVUZ3Hi/NZh2EEZu/mN0zZbGSGQv0cDdD6/kxw/ZstE6c7cYF7/ + IFdGLuLGa60em8AKCFT0WXRF9UnuZ7txw96qcrZotIlSY9ssJf8veBFDfiyKWiO7 + KBZXa7c2/5T+GOIBr/XZGH6vpCMFIuHq8A7wWPcbV0NvA6yssn8R7LrrEC2qU+RC + 7DhUwC70tODQyZ4IT/8eEntGdJwi4Zy6Uer5EMFkHCTBG6N3xKev+LppH+HGwH9L + LJ1qGEhK7PFcXFyLMEnBu4f316BEf9Hii4xDegBICTHGQfsHI2xE1GfeToqkvnyp + T4BgR6f6wVPsj+nP7UkCacIOtgUyjcTVuf4Da8PsX0liEYOcxSl2t9uZ1ks82DQB + w+p3Y03KRQh8TpidHWyydkya25xCO8x0t6q1q2xlIVKClGb3EG8YFRM+nEKT5sZO + 8nhqW50G+zUK3Y4vI3qzKjG9T5xi8Jwy8Zqd2h0VkNWXpn3NqqZkZwkCAwEAAQ== -----END RSA PUBLIC KEY----- ''; - tinc.pubkey_ed25519 = "P9yurwK2l1npimgm3yk8WXigWLfEtJ6G1w/3kVCPG7F"; + tinc.pubkey_ed25519 = "G7t9IdhukaYPMc82H/EqEiH10t5C4DneQpcxJDiUjqN"; }; }; }; diff --git a/krebs/3modules/external/mic92.nix b/krebs/3modules/external/mic92.nix index 6a4d2b371..58757b0b3 100644 --- a/krebs/3modules/external/mic92.nix +++ b/krebs/3modules/external/mic92.nix @@ -930,22 +930,32 @@ in { }; }; - hal9000 = { + dev1 = { owner = config.krebs.users.mic92; nets = rec { + internet = { + ip4.addr = "65.108.192.175"; + ip6.addr = "2a01:4f9:1a:94a4::1"; + aliases = [ "dev1.i" ]; + }; retiolum = { - aliases = [ "hal9000.r" ]; + aliases = [ "dev1.r" ]; tinc.pubkey = '' -----BEGIN RSA PUBLIC KEY----- - MIIBCgKCAQEA5aunzoz6WIjeQgfibml6T+UNsXXcoglhCqRkun7WaSHE93SQcCil - CDoUoq2aeiGTZ189LgdSyeRL7qmBzgVExIT4NlhfBCkNbHB/sz6epBb9qx49hLh5 - K/tJfUBYKRd06ymSXPK+cCiO0/gM8fjzI+3GMlYvcbZ+ow11zTRgX/QB2lE1G8cW - Obh/nS0af7G6wmovHsKEpry5AxoAPLLi5JaP4hlc/i0iCbebMqb+szF0KBAbmDg3 - JQ4MYIyQOw9kk7hfqTNFEvJhpbV66id2+ZIHX6QAw7OHBpaY6ZWFd/w2BkJHeayb - 2jRnsJd0YgautgBGrBrjRWiVmn/f+lJ4XQIDAQAB + MIICCgKCAgEAwx2l5llCtEdoTRT9UJKHqa/GTqd5f9mUWX/n3HKQHdeEVao6cH9J + LteQ2rJY+Gh2zt3FZYzRBykvArjGmu1qKKnouldFJis0DygUI1jZVbeeNKbA2lZx + 7+jCUIz4kgpA0ggJt/9Nb0xHMGPpgXSMADPHLKODT2FPxA4026pI6xLAZWY1o1SY + oypaIxaOUbqi9M+eR5KRCngUGHBOQm3rGtgw5wYxHsfJqHvqCmFIicxHVifpbzOf + Hf0hDvk6E54PijcrDUfDBkXrEoa1hFezCMnzv0h+1Y4qfueFtCtPbJdYKUo87X04 + PWT/P+x78VY9e7fJswi4bYflXmE6jVg/0gXPNpWNV1iBmbrFMJMduGNiuyBcSAxp + S1ubP/+5D2hgOLCuflLfnPOozPtvV6F/XYKatQGPmgo4d7+z7g4frFKv6Uu9ZMT0 + p2CN/bnVNAEErPbTVLyk8zX6J3ruCBQxucr3dsqyw7pk74tTQlFwH9BY8tWfRrAP + v7rDLHzv/1KA9GRDkbVPJmCkwIlPd9PcqSeHL9pnV9IkFr0UTVJE5qBLDSRW9XAb + QY6wVgsMocMeAxwrx6q+pdX/NAPbBzrmr0IB+DwYfMhZdGWoWEw+NV1wOsQjBzjw + SA63+XAgJ30QR5Z87d5g2Y7560+6oQavMPdt+5kfPTGa48UR7WwYyzsCAwEAAQ== -----END RSA PUBLIC KEY----- ''; - tinc.pubkey_ed25519 = "krVYgJo5OFZkyUOgasH9dFve4OI3ewpt8IFhCPan7mB"; + tinc.pubkey_ed25519 = "nu1d0uwAE1Lg16SfXkCgGz2blir402mlucwJMfHivrJ"; }; }; }; diff --git a/krebs/3modules/github-known-hosts.nix b/krebs/3modules/github-known-hosts.nix deleted file mode 100644 index eec719f27..000000000 --- a/krebs/3modules/github-known-hosts.nix +++ /dev/null @@ -1,78 +0,0 @@ -{ - services.openssh.knownHosts.github = { - hostNames = [ - "github.com" - # List generated with (IPv6 addresses are currently ignored): - # curl -sS https://api.github.com/meta | jq -r .git[] | grep -v : | nix-shell -p cidr2glob --run cidr2glob | jq -R . - "192.30.252.*" - "192.30.253.*" - "192.30.254.*" - "192.30.255.*" - "185.199.108.*" - "185.199.109.*" - "185.199.110.*" - "185.199.111.*" - "140.82.112.*" - "140.82.113.*" - "140.82.114.*" - "140.82.115.*" - "140.82.116.*" - "140.82.117.*" - "140.82.118.*" - "140.82.119.*" - "140.82.120.*" - "140.82.121.*" - "140.82.122.*" - "140.82.123.*" - "140.82.124.*" - "140.82.125.*" - "140.82.126.*" - "140.82.127.*" - "143.55.64.*" - "143.55.65.*" - "143.55.66.*" - "143.55.67.*" - "143.55.68.*" - "143.55.69.*" - "143.55.70.*" - "143.55.71.*" - "143.55.72.*" - "143.55.73.*" - "143.55.74.*" - "143.55.75.*" - "143.55.76.*" - "143.55.77.*" - "143.55.78.*" - "143.55.79.*" - "13.114.40.48" - "52.192.72.89" - "52.69.186.44" - "15.164.81.167" - "52.78.231.108" - "13.234.176.102" - "13.234.210.38" - "13.236.229.21" - "13.237.44.5" - "52.64.108.95" - "20.201.28.151" - "20.205.243.166" - "102.133.202.242" - "20.248.137.48" - "18.181.13.223" - "54.238.117.237" - "54.168.17.15" - "3.34.26.58" - "13.125.114.27" - "3.7.2.84" - "3.6.106.81" - "52.63.152.235" - "3.105.147.174" - "3.106.158.203" - "20.201.28.152" - "20.205.243.160" - "102.133.202.246" - "20.248.137.50" - ]; - publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="; - }; -} diff --git a/krebs/3modules/github/default.nix b/krebs/3modules/github/default.nix new file mode 100644 index 000000000..2df4ba717 --- /dev/null +++ b/krebs/3modules/github/default.nix @@ -0,0 +1,6 @@ +{ + imports = [ + ./hosts-sync.nix + ./known-hosts.nix + ]; +} diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github/hosts-sync.nix index 71eed6c69..71eed6c69 100644 --- a/krebs/3modules/github-hosts-sync.nix +++ b/krebs/3modules/github/hosts-sync.nix diff --git a/krebs/3modules/github/known-hosts.json b/krebs/3modules/github/known-hosts.json new file mode 100644 index 000000000..694f9adba --- /dev/null +++ b/krebs/3modules/github/known-hosts.json @@ -0,0 +1,58 @@ +[ + "192.30.252.*", + "192.30.253.*", + "192.30.254.*", + "192.30.255.*", + "185.199.108.*", + "185.199.109.*", + "185.199.110.*", + "185.199.111.*", + "140.82.112.*", + "140.82.113.*", + "140.82.114.*", + "140.82.115.*", + "140.82.116.*", + "140.82.117.*", + "140.82.118.*", + "140.82.119.*", + "140.82.120.*", + "140.82.121.*", + "140.82.122.*", + "140.82.123.*", + "140.82.124.*", + "140.82.125.*", + "140.82.126.*", + "140.82.127.*", + "143.55.64.*", + "143.55.65.*", + "143.55.66.*", + "143.55.67.*", + "143.55.68.*", + "143.55.69.*", + "143.55.70.*", + "143.55.71.*", + "143.55.72.*", + "143.55.73.*", + "143.55.74.*", + "143.55.75.*", + "143.55.76.*", + "143.55.77.*", + "143.55.78.*", + "143.55.79.*", + "20.201.28.151", + "20.205.243.166", + "102.133.202.242", + "20.248.137.48", + "20.207.73.82", + "20.27.177.113", + "20.200.245.247", + "20.233.54.53", + "20.201.28.152", + "20.205.243.160", + "102.133.202.246", + "20.248.137.50", + "20.207.73.83", + "20.27.177.118", + "20.200.245.248", + "20.233.54.52" +] diff --git a/krebs/3modules/github/known-hosts.nix b/krebs/3modules/github/known-hosts.nix new file mode 100644 index 000000000..f2705caa4 --- /dev/null +++ b/krebs/3modules/github/known-hosts.nix @@ -0,0 +1,12 @@ +{ lib, ... }: { + services.openssh.knownHosts.github = { + hostNames = + ["github.com"] + ++ + # List generated with (IPv6 addresses are currently ignored): + # curl -sS https://api.github.com/meta | jq -r .git[] | grep -v : | nix-shell -p cidr2glob --run cidr2glob | jq -Rs 'split("\n")|map(select(.!=""))' > known-hosts.json + lib.importJSON ./known-hosts.json + ; + publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="; + }; +} diff --git a/krebs/nixpkgs-unstable.json b/krebs/nixpkgs-unstable.json index f34e9bcef..465a1a889 100644 --- a/krebs/nixpkgs-unstable.json +++ b/krebs/nixpkgs-unstable.json @@ -1,9 +1,9 @@ { "url": "https://github.com/NixOS/nixpkgs", - "rev": "79d3ca08920364759c63fd3eb562e99c0c17044a", - "date": "2022-09-25T12:45:53+01:00", - "path": "/nix/store/1rvdfqmxgvd0p2srlav3k7w1d50yvg0m-nixpkgs", - "sha256": "1zz72k161yl9dxs5nxgy5p6nh8zsz4fbpclm99r12jw39zrlzhhw", + "rev": "4428e23312933a196724da2df7ab78eb5e67a88e", + "date": "2022-10-14T02:36:00-05:00", + "path": "/nix/store/i516gwjhbmkgalw3zjfn8ahnvmb198hz-nixpkgs", + "sha256": "1rwr5p7pmi612mc5mwp7hk2l9hyiwrv8lf2cfzpjh5ya46wpw5jq", "fetchLFS": false, "fetchSubmodules": false, "deepClone": false, diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json index f5b66b0c5..46e03bc6b 100644 --- a/krebs/nixpkgs.json +++ b/krebs/nixpkgs.json @@ -1,9 +1,9 @@ { "url": "https://github.com/NixOS/nixpkgs", - "rev": "72783a2d0dbbf030bff1537873dd5b85b3fb332f", - "date": "2022-09-25T14:12:58+02:00", - "path": "/nix/store/5nbfx7dz3ghxvvc1248vpd1qgan1dhww-nixpkgs", - "sha256": "1xggh6cim9kxl7nr6fwmsxzqqlnazyddak30xcd4api3f9g3slnz", + "rev": "78a37aa630faa41944060a966607d4f1128ea94b", + "date": "2022-10-14T18:11:43+02:00", + "path": "/nix/store/zmi573bwzr6xg5v6d21gcf14qh9skxy6-nixpkgs", + "sha256": "1rq4m1g7apvcgjp21xjhm94acpw6wyiddd48vhcwgwvsiiircwff", "fetchLFS": false, "fetchSubmodules": false, "deepClone": false, diff --git a/tv/3modules/ejabberd/config.nix b/tv/3modules/ejabberd/config.nix deleted file mode 100644 index a022bc448..000000000 --- a/tv/3modules/ejabberd/config.nix +++ /dev/null @@ -1,129 +0,0 @@ -with import <stockholm/lib>; -{ config, ... }: let - - # See https://github.com/processone/ejabberd/blob/master/ejabberd.yml.example - - ciphers = concatStringsSep ":" [ - "ECDHE-ECDSA-AES256-GCM-SHA384" - "ECDHE-RSA-AES256-GCM-SHA384" - "ECDHE-ECDSA-CHACHA20-POLY1305" - "ECDHE-RSA-CHACHA20-POLY1305" - "ECDHE-ECDSA-AES128-GCM-SHA256" - "ECDHE-RSA-AES128-GCM-SHA256" - "ECDHE-ECDSA-AES256-SHA384" - "ECDHE-RSA-AES256-SHA384" - "ECDHE-ECDSA-AES128-SHA256" - "ECDHE-RSA-AES128-SHA256" - ]; - - protocol_options = [ - "no_sslv2" - "no_sslv3" - "no_tlsv1" - "no_tlsv1_10" - ]; - -in /* yaml */ '' - - access_rules: - announce: - - allow: admin - local: - - allow: local - configure: - - allow: admin - register: - - allow - s2s: - - allow - trusted_network: - - allow: loopback - - acl: - local: - user_regexp: "" - loopback: - ip: - - "127.0.0.0/8" - - "::1/128" - - "::FFFF:127.0.0.1/128" - - certfiles: - - /tmp/credentials/certfile - - hosts: ${toJSON config.hosts} - - language: "en" - - listen: - - - port: 5222 - ip: "::" - module: ejabberd_c2s - shaper: c2s_shaper - ciphers: ${toJSON ciphers} - dhfile: /var/lib/ejabberd/dhfile - protocol_options: ${toJSON protocol_options} - starttls: true - starttls_required: true - tls: false - tls_compression: false - max_stanza_size: 65536 - - - port: 5269 - ip: "::" - module: ejabberd_s2s_in - shaper: s2s_shaper - max_stanza_size: 131072 - - loglevel: 4 - - modules: - mod_adhoc: {} - mod_admin_extra: {} - mod_announce: - access: announce - mod_caps: {} - mod_carboncopy: {} - mod_client_state: {} - mod_configure: {} - mod_disco: {} - mod_echo: {} - mod_bosh: {} - mod_last: {} - mod_offline: - access_max_user_messages: max_user_offline_messages - mod_ping: {} - mod_privacy: {} - mod_private: {} - mod_register: - access_from: deny - access: register - ip_access: trusted_network - registration_watchers: ${toJSON config.registration_watchers} - mod_roster: {} - mod_shared_roster: {} - mod_stats: {} - mod_time: {} - mod_vcard: - search: false - mod_version: {} - mod_http_api: {} - - s2s_access: s2s - s2s_ciphers: ${toJSON ciphers} - s2s_dhfile: /var/lib/ejabberd/dhfile - s2s_protocol_options: ${toJSON protocol_options} - s2s_tls_compression: false - s2s_use_starttls: required - - shaper_rules: - max_user_offline_messages: - - 5000: admin - - 100 - max_user_sessions: 10 - c2s_shaper: - - none: admin - - normal - s2s_shaper: fast -'' diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix index 935df9a9c..edc5296b0 100644 --- a/tv/3modules/ejabberd/default.nix +++ b/tv/3modules/ejabberd/default.nix @@ -12,12 +12,43 @@ fi ''; + settingsFormat = pkgs.formats.json {}; + in { options.tv.ejabberd = { enable = mkEnableOption "tv.ejabberd"; - certfile = mkOption { - type = types.absolute-pathname; - default = toString <secrets> + "/ejabberd.pem"; + certfiles = mkOption { + type = types.listOf types.absolute-pathname; + default = [ + (toString <secrets> + "/ejabberd.pem") + ]; + }; + configFile = mkOption { + type = types.either types.package types.absolute-pathname; + default = settingsFormat.generate "ejabberd.yaml" cfg.settings; + }; + ciphers = mkOption { + type = types.listOf types.str; + default = [ + "ECDHE-ECDSA-AES256-GCM-SHA384" + "ECDHE-RSA-AES256-GCM-SHA384" + "ECDHE-ECDSA-CHACHA20-POLY1305" + "ECDHE-RSA-CHACHA20-POLY1305" + "ECDHE-ECDSA-AES128-GCM-SHA256" + "ECDHE-RSA-AES128-GCM-SHA256" + "ECDHE-ECDSA-AES256-SHA384" + "ECDHE-RSA-AES256-SHA384" + "ECDHE-ECDSA-AES128-SHA256" + "ECDHE-RSA-AES128-SHA256" + ]; + }; + credentials.certfiles = mkOption { + internal = true; + readOnly = true; + default = + imap + (i: const "/tmp/credentials/certfile${toJSON i}") + cfg.certfiles; }; hosts = mkOption { type = with types; listOf str; @@ -29,42 +60,66 @@ in { paths = [ (pkgs.writeDashBin "ejabberdctl" '' exec ${pkgs.ejabberd}/bin/ejabberdctl \ - --config ${toFile "ejabberd.yaml" (import ./config.nix { - inherit pkgs; - config = cfg; - })} \ - --logs ${shell.escape cfg.user.home} \ - --spool ${shell.escape cfg.user.home} \ + --config /etc/ejabberd/ejabberd.yaml \ + --ctl-config /etc/ejabberd/ejabberdctl.cfg \ + --logs ${cfg.stateDir} \ + --spool ${cfg.stateDir} \ "$@" '') pkgs.ejabberd ]; }; }; + protocol_options = mkOption { + type = types.listOf types.str; + default = [ + "no_sslv2" + "no_sslv3" + "no_tlsv1" + "no_tlsv1_10" + ]; + }; registration_watchers = mkOption { type = types.listOf types.str; default = [ config.krebs.users.tv.mail ]; }; - user = mkOption { - type = types.user; - default = { - name = "ejabberd"; - home = "/var/lib/ejabberd"; - }; + settings = mkOption { + type = settingsFormat.type; + default = {}; + }; + stateDir = mkOption { + type = + types.addCheck + types.absolute-pathname + (path: + hasPrefix "/var/lib/" path && + types.filename.check (removePrefix "/var/lib/" path) + ); + default = "/var/lib/ejabberd"; }; }; config = lib.mkIf cfg.enable { + + environment.etc."ejabberd/ejabberd.yaml".source = cfg.configFile; + environment.etc."ejabberd/ejabberdctl.cfg".source = + builtins.toFile "ejabberdctl.cfg" /* sh */ '' + ERL_OPTIONS='-setcookie ${cfg.stateDir}/.erlang.cookie' + ''; + environment.systemPackages = [ (pkgs.symlinkJoin { name = "ejabberd-sudo-wrapper"; paths = [ (pkgs.writeDashBin "ejabberdctl" '' - set -efu - cd ${shell.escape cfg.user.home} - exec /run/wrappers/bin/sudo \ - -u ${shell.escape cfg.user.name} \ + exec ${pkgs.systemd}/bin/systemd-run \ + --unit=ejabberdctl \ + --property=StateDirectory=ejabberd \ + --property=User=ejabberd \ + --collect \ + --pipe \ + --quiet \ ${cfg.pkgs.ejabberd}/bin/ejabberdctl "$@" '') cfg.pkgs.ejabberd @@ -77,31 +132,144 @@ in { systemd.services.ejabberd = { wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; + reloadTriggers = [ + config.environment.etc."ejabberd/ejabberd.yaml".source + config.environment.etc."ejabberd/ejabberdctl.cfg".source + ]; serviceConfig = { - ExecStart = pkgs.writeDash "ejabberd" '' - ${pkgs.coreutils}/bin/ln -s "$CREDENTIALS_DIRECTORY" /tmp/credentials - ${gen-dhparam} /var/lib/ejabberd/dhfile - exec ${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground - ''; - LoadCredential = [ - "certfile:${cfg.certfile}" + ExecStartPre = [ + "${pkgs.coreutils}/bin/ln -s \${CREDENTIALS_DIRECTORY} /tmp/credentials" + "${gen-dhparam} ${cfg.stateDir}/dhfile" + ]; + ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground"; + ExecStop = [ + "${cfg.pkgs.ejabberd}/bin/ejabberdctl stop" + "${cfg.pkgs.ejabberd}/bin/ejabberdctl stopped" ]; - PermissionsStartOnly = true; + ExecReload = "${cfg.pkgs.ejabberd}/bin/ejabberdctl reload_config"; + LoadCredential = + zipListsWith + (dst: src: "${baseNameOf dst}:${src}") + cfg.credentials.certfiles + cfg.certfiles; + LimitNOFILE = 65536; + PrivateDevices = true; PrivateTmp = true; SyslogIdentifier = "ejabberd"; StateDirectory = "ejabberd"; - User = cfg.user.name; - TimeoutStartSec = 60; + User = "ejabberd"; + DynamicUser = true; + TimeoutSec = 60; + RestartSec = 5; + Restart = "on-failure"; + Type = "notify"; + NotifyAccess = "all"; + WatchdogSec = 30; }; }; - users.users.${cfg.user.name} = { - inherit (cfg.user) home name uid; - createHome = true; - group = cfg.user.name; - isSystemUser = true; - }; + # preset config values + tv.ejabberd.settings = { + access_rules = { + announce = mkDefault [{ allow = "admin"; }]; + local = mkDefault [{ allow = "local"; }]; + configure = mkDefault [{ allow = "admin"; }]; + register = mkDefault ["allow"]; + s2s = mkDefault ["allow"]; + trusted_network = mkDefault [{ allow = "loopback"; }]; + }; + + acl = { + local.user_regexp = mkDefault ""; + loopback.ip = mkDefault [ + "127.0.0.0/8" + "::1/128" + "::FFFF:127.0.0.1/128" + ]; + }; + + certfiles = mkDefault cfg.credentials.certfiles; + + hosts = mkDefault cfg.hosts; + + language = mkDefault "en"; + + listen = mkDefault [ + { + port = 5222; + ip = "::"; + module = "ejabberd_c2s"; + shaper = "c2s_shaper"; + ciphers = concatStringsSep ":" cfg.ciphers; + protocol_options = cfg.protocol_options; + starttls = true; + starttls_required = true; + tls = false; + tls_compression = false; + max_stanza_size = 65536; + } + { + port = 5269; + ip = "::"; + module = "ejabberd_s2s_in"; + shaper = "s2s_shaper"; + dhfile = "${cfg.stateDir}/dhfile"; + max_stanza_size = 131072; + } + ]; + + loglevel = mkDefault "4"; + + modules = { + mod_adhoc = mkDefault {}; + mod_admin_extra = mkDefault {}; + mod_announce.access = mkDefault "announce"; + mod_caps = mkDefault {}; + mod_carboncopy = mkDefault {}; + mod_client_state = mkDefault {}; + mod_configure = mkDefault {}; + mod_disco = mkDefault {}; + mod_echo = mkDefault {}; + mod_bosh = mkDefault {}; + mod_last = mkDefault {}; + mod_offline.access_max_user_messages = mkDefault "max_user_offline_messages"; + mod_ping = mkDefault {}; + mod_privacy = mkDefault {}; + mod_private = mkDefault {}; + mod_register = { + access_from = mkDefault "deny"; + access = mkDefault "register"; + ip_access = mkDefault "trusted_network"; + registration_watchers = mkDefault cfg.registration_watchers; + }; + mod_roster = mkDefault {}; + mod_shared_roster = mkDefault {}; + mod_stats = mkDefault {}; + mod_time = mkDefault {}; + mod_vcard.search = mkDefault false; + mod_version = mkDefault {}; + mod_http_api = mkDefault {}; + }; + + s2s_access = mkDefault "s2s"; + s2s_ciphers = concatStringsSep ":" cfg.ciphers; + s2s_dhfile = mkDefault "${cfg.stateDir}/dhfile"; + s2s_protocol_options = mkDefault cfg.protocol_options; + s2s_tls_compression = mkDefault false; + s2s_use_starttls = mkDefault "required"; - users.groups.${cfg.user.name} = {}; + shaper_rules = { + max_user_offline_messages = mkDefault [ + { "5000" = "admin"; } + 100 + ]; + max_user_sessions = mkDefault 10; + c2s_shaper = mkDefault [ + |