5 files changed, 90 insertions, 195 deletions
diff --git a/krebs/3modules/ci.nix b/krebs/3modules/ci.nix
deleted file mode 100644
index e97aa16eb..000000000
--- a/krebs/3modules/ci.nix
+++ /dev/null
@@ -1,192 +0,0 @@
-{ config, pkgs, ... }:
-with import <stockholm/lib>;
-let
-  cfg = config.krebs.ci;
-
-  hostname = config.networking.hostName;
-in
-{
-  options.krebs.ci = {
-    enable = mkEnableOption "krebs continous integration";
-    stockholmSrc = mkOption {
-      type = types.str;
-      default = "http://cgit.${hostname}.r/stockholm";
-    };
-    treeStableTimer = mkOption {
-      type = types.int;
-      default = 10;
-      description = "how long to wait until we test changes (in minutes)";
-    };
-    hosts = mkOption {
-      type = types.listOf types.host;
-      default = [];
-      description = ''
-        List of hosts that should be build
-      '';
-    };
-    tests = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      description = ''
-        List of tests that should be build
-      '';
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services.nginx = {
-      enable = true;
-      virtualHosts.build = {
-        serverAliases = [ "build.${hostname}.r" ];
-        locations."/".extraConfig = ''
-          proxy_set_header Upgrade $http_upgrade;
-          proxy_set_header Connection "upgrade";
-          proxy_pass http://127.0.0.1:${toString config.krebs.buildbot.master.web.port};
-        '';
-      };
-    };
-
-    krebs.buildbot.master = {
-      slaves = {
-        testslave = "lasspass";
-      };
-      change_source.stockholm = ''
-        stockholm_repo = '${cfg.stockholmSrc}'
-        cs.append(
-            changes.GitPoller(
-                stockholm_repo,
-                workdir='stockholm-poller', branches=True,
-                project='stockholm',
-                pollinterval=10
-            )
-        )
-      '';
-      scheduler = {
-        build-scheduler = ''
-          sched.append(
-                schedulers.SingleBranchScheduler(
-                    change_filter=util.ChangeFilter(branch_re=".*"),
-                    treeStableTimer=${toString cfg.treeStableTimer}*60,
-                    name="build-all-branches",
-                    builderNames=[
-                        ${optionalString (cfg.hosts != []) ''"hosts",''}
-                        ${optionalString (cfg.tests != []) ''"tests",''}
-                    ]
-                )
-          )
-        '';
-        force-scheduler = ''
-          sched.append(
-              schedulers.ForceScheduler(
-                    name="force",
-                    builderNames=[
-                        ${optionalString (cfg.hosts != []) ''"hosts",''}
-                        ${optionalString (cfg.tests != []) ''"tests",''}
-                    ]
-              )
-          )
-        '';
-      };
-      builder_pre = ''
-        # prepare grab_repo step for stockholm
-        grab_repo = steps.Git(
-            repourl=stockholm_repo,
-            mode='full'
-        )
-
-        # prepare addShell function
-        def addShell(factory,**kwargs):
-          factory.addStep(steps.ShellCommand(**kwargs))
-      '';
-      builder = {
-        hosts = mkIf (cfg.hosts != []) ''
-          f = util.BuildFactory()
-          f.addStep(grab_repo)
-
-          def build_host(user, host):
-              addShell(f,
-                  name="{}".format(host),
-                  env={
-                    "NIX_PATH": "secrets=/var/src/stockholm/null:/var/src",
-                    "NIX_REMOTE": "daemon",
-                    "dummy_secrets": "true",
-                  },
-                  command=[
-                    "nix-shell", "-I", "stockholm=.", "--run", " ".join(["test",
-                      "--user={}".format(user),
-                      "--system={}".format(host),
-                      "--force-populate",
-                      "--target=$LOGNAME@${config.krebs.build.host.name}$HOME/{}".format(user),
-                    ])
-                  ],
-                  timeout=90001
-              )
-
-          ${concatMapStringsSep "\n" (host:
-             "build_host(\"${host.owner.name}\", \"${host.name}\")"
-          ) cfg.hosts}
-
-          bu.append(
-              util.BuilderConfig(
-                  name="hosts",
-                  slavenames=slavenames,
-                  factory=f
-              )
-          )
-        '';
-        tests = mkIf (cfg.tests != []) ''
-          f = util.BuildFactory()
-          f.addStep(grab_repo)
-
-          def run_test(test):
-              addShell(f,
-                  name="{}".format(test),
-                  env={
-                    "NIX_PATH": "secrets=/var/src/stockholm/null:/var/src",
-                    "NIX_REMOTE": "daemon",
-                    "dummy_secrets": "true",
-                  },
-                  command=[
-                    "nix-build", "-I", "stockholm=.", "krebs/0tests",
-                    "-A", "{}".format(test)
-                  ],
-                  timeout=90001
-              )
-
-          ${concatMapStringsSep "\n" (test:
-             "run_test(\"${test}\")"
-          ) cfg.tests}
-
-          bu.append(
-              util.BuilderConfig(
-                  name="tests",
-                  slavenames=slavenames,
-                  factory=f
-              )
-          )
-        '';
-      };
-      enable = true;
-      web.enable = true;
-      irc = {
-        enable = true;
-        nick = "build|${hostname}";
-        server = "irc.r";
-        channels = [ "xxx" "noise" ];
-        allowForce = true;
-      };
-      extraConfig = ''
-        c['buildbotURL'] = "http://build.${hostname}.r/"
-      '';
-    };
-
-    krebs.buildbot.slave = {
-      enable = true;
-      masterhost = "localhost";
-      username = "testslave";
-      password = "lasspass";
-      packages = with pkgs; [ gnumake jq nix populate ];
-    };
-
-  };
-}
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 6fe01e466..afc96e9ee 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -13,7 +13,6 @@ let
       ./buildbot/master.nix
       ./buildbot/slave.nix
       ./build.nix
-      ./ci.nix
       ./current.nix
       ./exim.nix
       ./exim-retiolum.nix
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index aa0b43f9a..fd74983fa 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -671,9 +671,45 @@ with import <stockholm/lib>;
       ssh.privkey.path = <secrets/ssh.id_ed25519>;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd/6eCR8yxC14zBJLIQgVa4Zbutv5yr2S8k08ztmBpp";
     };
+    blue = {
+      cores = 1;
+      nets = {
+        retiolum = {
+          ip4.addr = "10.243.0.77";
+          ip6.addr = "42:0:0:0:0:0:0:77";
+          aliases = [
+            "blue.r"
+          ];
+          tinc.pubkey = ''
+            -----BEGIN PUBLIC KEY-----
+            MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA28b+WMiQaWbwUPcJlacd
+            QwyX4PvVm9WItPmmNy+RE2y0Mf04LxZ7RLm5+e0wPuhXXQyhZ06CNd6tjeaKfXUc
+            sNeC1Vjuh1hsyYJLR5Xf/YRNJQKoaHjbkXGt+rSK7PPuCcsUPOSZSEAgHYVvcFzM
+            wWE4kTDcBZeISB4+yLmPIZXhnDImRRMEurFNRiocoMmEIu/zyYVq8rnlTl972Agu
+            PMGo1HqVxCouEWstRvtX5tJmV8yruRbH4tADAruLXErLLwUAx/AYDNRjY1TYYetJ
+            RoaxejmZVVIvR+hWaDLkHZO89+to6wS5IVChs1anFxMNN6Chq2v8Bb2Nyy1oG/H/
+            HzXxj1Rn7CN9es5Wl0UX4h9Zg+hfspoI75lQ509GLusYOyFwgmFF02eMpxgHBiWm
+            khSJzPkFdYJKUKaZI0nQEGGsFJOe/Se5jj70x3Q5XEuUoQqyahAqwQIYh6uwhbuP
+            49RBPHpE+ry6smhUPLTitrRsqeBU4RZRNsUAYyCbwyAH1i+K3Q5PSovgPtlHVr2N
+            w+VZCzsrtOY2fxXw0e+mncrx/Qga62s4m6a/dyukA5RytA9f6bBsvSTqr7/EQTs6
+            ZEBoPudk7ULNEbfjmJtBkeG7wKIlpgzVg/JaCAwMuSgVjrpIHrZmjOVvmOwB8W6J
+            Ch/o7chVljAwW4JmyRnhZbMCAwEAAQ==
+            -----END PUBLIC KEY-----
+          '';
+        };
+      };
+      ssh.privkey.path = <secrets/ssh.id_ed25519>;
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSBxtPf8yJfzzI7/iYpoRSc/TT+zYmE/HM9XWS3MZlv";
+    };
   };
-  users = {
-    lass = {
+  users = rec {
+    lass = lass-blue;
+    lass-blue = {
+      mail = "lass@blue.r";
+      pubkey = builtins.readFile ./ssh/blue.rsa;
+      pgp.pubkeys.default = builtins.readFile ./pgp/blue.pgp;
+    };
+    lass-mors = {
       mail = "lass@mors.r";
       pubkey = builtins.readFile ./ssh/mors.rsa;
       pgp.pubkeys.default = builtins.readFile ./pgp/mors.pgp;
diff --git a/krebs/3modules/lass/pgp/blue.pgp b/krebs/3modules/lass/pgp/blue.pgp
new file mode 100644
index 000000000..e7a1ac0e1
--- /dev/null
+++ b/krebs/3modules/lass/pgp/blue.pgp
@@ -0,0 +1,51 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFr9fAEBEACz2E2E7uBulVBBtPmk9IR2yB+uAWSe8Hi7vNiGc1Dbs40jzWuy
+AqouqyC5xnVw66+cQaYOsgXiwencmu/cFEV2x2uRLDVh1E/fvc8yxAOizEIY0jm/
+WZ/4IWvTZLVPF3BOhM4p/HGNbdZhRc4RoljLTB34VuY1KSMhs3Vx7n3HgZzdbD7D
+itUFU4oY5CnkQp4yl1Htat08cZmbD51VTZB1hDw2Uea+VuMQ/ImRtTqW+Ss4xyPA
+DwUE/vRM3CKwBvcjbNL3uUqc5dtZuvruuFeK3ScmdNLytcgXqJzLlwuzHmSt/Tnc
+DQZWKGiHnMvrAOkMEvsmiKhboWSAq4sRUPhISqZ7MSvPfhaH5Gcmhi+hL8FZhGY0
+qF7MNLHoimw6MBV6FIIA0vCDn2p5Vwc7L+LqLjWqAvxdfVoeUJjUWbWWNNWg4Tw7
+9e7rAR86e4AvhCZRubRn1aOfKGF5vg/El98OeIwBFQHpr7uznKfjmAEpoGveV+vG
+amptMCBAr4Hw76U708XWOQkZ2GDY9cfdxUllhAmmPrNQ/OcT2b4x0xKvMi4nA5G8
+PBOFErkS61zNxsHgpFe2isG+VDqYLfeQhOdB101Qn6IHw3KxyW85CwImUpdRLMUi
+0wtcA7M5GB94HRZ8qW6LtFBjwqm2NGudB0alfIWIq7KuRMXus3sJKQ2gDQARAQAB
+tBlsYXNzQGJsdWUuciA8bGFzc0BibHVlLnI+iQJOBBMBCAA4FiEEuOpc8JA44Pd5
+NXyK8UJeZkL6H7wFAlr9fAECGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ
+8UJeZkL6H7ygPQ/+JydbB0IX64ojm34YaeWKVdM5D7JFBdNuKgbAMf0Uhcja6YcU
+0YRvuOPpw4lNZqV/1yxDXGHJrVfGolq6uz28oWr+9VUD8QXH9ODm1EMLsU8Jb1Nh
+SE+rWSAhEmdw8l9Bi12wq4v/z/JC93/VJLnBGOL8LDEsJ9OatUw71KIt/a50ERoz
+uCZbMeLPym8WqSK1kjQehL5pj97BzxmBNpFYwqaniTAuqTN6bhs2ws+k89vjaWIP
+T+bEqsJV/vR9KZcNlmKlTQwbsjQ1BZ9EuV4EBL6IAMrqxDeY3mFnT+EpkabfIVSh
+38KmG+4PZDXaj6rCsrsH2pUKaZ/Z6Mr3lmFb/1aaK3xKiQyxcMrbcixIIVI8ihTM
+HUC3DFFlA7+02b67QomWFLRiZid4gCry7xhZyryQJkN2l20fzRjWf0myzcPO0qxc
+y39gUyEqy1oeaffCc1QgDJH2Hvf+P9StyMZIulNuCKJ9tfQR5nkkDAy/2p405Lmf
+mdKOMha6bZ+mA5HbmjMqwyFPHEtU6t/mUhlh7mYqNYAJikuqV00N6nTKVrBb2IfK
+atoHeUcmvMWBGL7+x3zxwf2pnum6a5iDES2ir87ltOGKGDeMt2Y/Ap30P+uZGnn1
+AiRu2bGkCiQ/WH1StJhAhJeleUfdbOa7/voc14nl3rewqyhqYd8dlI+TWAu5Ag0E
+Wv18AQEQAOFMwY2ky5TyRrDqJosq0y/9+8D6RiXlyOnyTQ+bqu4mDEaVu3xNcKLH
+CQsTM7gDR9pivapoDo84CK8w519DHCA2EpNGTDO4twcQ3jKqPth809LnibwdKJCe
+qsfxsIfN8LbpKDOygZ2av11gcT0ye9uOMkiiRSE2MMGDU/50sskecavUAExDgwFs
+v72ReU3fXRfTqYT6p/i/qMB7GbS8PlKFz61JKHDceS5GJUZJ5OWOoq7ZMCz6zrLW
+2mQIJ7kblGCJKUnx/lZ5y9nqSCk7jer2qENxWNPOCwD48A78u1Bz8xSN5D1gFO3f
+YSKh60kK5UljwkvRD7NvAcg2ifwL1e+/7v8WV9OsHDUBEiJO05tsjJ76QwHnEq6j
+4peArcTAHWZ4uGncAgYN/Uii+0vs3oVDsZ9d2uLJxuR3h6T4XVejeuZ3j3o/XX/E
+aZwcdH3VpKqEjdG4c4TMz96bN7ZN2DbgTf40rwPFKgWnvhCA9dWlmfy9pW2z2hyg
+rJaRGXd/4znj5YlMliDrL4/Yp9j1J1CsoZM68er6/zMU1SA9U/y+MVqMoPCPlczx
+mbwWQm1JH6fZv2SzHbZOrZYWKVWX+jPZQV6SjKwSiVrLlZJ0Z8u00HBRRRzXLwXa
+OLL/dGP1v+msMv1oCJT1AsMcBEE3bY1efnDP1XK8vBLzoMKGS1RtABEBAAGJAjYE
+GAEIACAWIQS46lzwkDjg93k1fIrxQl5mQvofvAUCWv18AQIbDAAKCRDxQl5mQvof
+vOC1D/wO+tGKz/y5dc/ifJGTndxoHnU8tarboDll0kcdpTGU7It+ReNustqJZj5v
+HK4V/ZXUw5+y6ZasNa/mFYY8oACOI40SlMdyt708XfPqYKXOpnM0oGRGfALi+oKg
+iIzYtXsqYk5ZYSFWpgxajHef9HMmHNJ8riSVRugUPubPMKPR65DOXl+BdVIlQw7o
+2g3s4Lii0IRKov3BvB51oJMhRK2Ne55VDBid32oIoqXLXS2E2gJQegioAiDUA5J4
+1f96RCeYfxOgaPj/o4eiXK0H3owA3W78/tIjq5218PCIYFsOKPhrSqJ7ZF/5yGwW
+ppVzsaz1sE9oULR0VOFUwjpYmyH32WwKkLF6mKumb8Q7Pd/FJq0I3/kxD/OrlNVZ
+8UCX0CzxMyfEeSUfScunKLMfopEGxXTR4l8jew7CwxX08H0nkqyegDZSN8MjYxQL
+V/zoL+aPjYh1WYf1L8wyBZjQbA6khHwYRZPaHrGfGaCGC8MHiSjPb/nt54+vZXtt
+17LcX4VvHwWIBf88JpZO9eyTFPdYIZANSyo6ltbRoomuAywuA5IibCwh/BXi/aVa
+Jro4UvbiwMqbVgSAt15VAwEK1Re/NNLBTcVVMHsWr5WNmo0s2C7+j+iIMPEOwhRs
+ZFj74cztyOF/dGeCv9ycW29g+ejXaPpFOYQz0A9bBdkEdTGWhQ==
+=D854
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/krebs/3modules/lass/ssh/blue.rsa b/krebs/3modules/lass/ssh/blue.rsa
new file mode 100644
index 000000000..c0bf9b817
--- /dev/null
+++ b/krebs/3modules/lass/ssh/blue.rsa
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEZgHYLHcHSumTUr0jTu1XmmwRMqjLHYvo4AYuEg1QdishDbwU5KCqarSf7sxLTjeBgOugHP/oJZclin+e9GTQ5hlBEtc26IVQqirNVD1BCZrt/y5ok0p8p+2Rhzh89kfRI6Etp+8cPbot4h3Vg6tY57icKn3visaMdH0cI2pAQbPWwSY+cmyXU5cfcFC8ahcZpEgth4ycC5yM/qdHxZek2wN+58ApgjEjuvTD6y4iXqdWmqHVoGaeNV7OFiiKVaYoJND1igHLNw2VEQR5aPsmc8gadBtGIQb43YqObNBDWwMjvozmQVFPycMmMTDwA1n+IWxvwz34KEzyw5jQShUTCRDji4vK58WfC16fPLbW+ohCe+9Yyg7TRdjDFA5jTA3rFM7tZS8EhpLgyHupNi1GbUVmeyhqTdWp+H66u5zTzC5Q/PYOk1M0D/X/C6dXyIcB4lLr9mDTGvS1aOZVZJuDF4pLyI2oZzaySALjcofCJyNpBBUtUXHsiT4VNuJExl4XEXjvQKnPKojEzpTsK1rm/ZSa3vBCv0gBbjQ8uU1q86ODIDy35q2GQvsLMkAbduBLeA9m1EdZXLYComSfVLalArw3Q+4vd/FHhoOicVkrwIzcPiYg9uQZm2NrjiBkYlWCdXTFc49ghIDrPXLnwwWqPuZcs430u6Somk8XzuRZBC7ZDdjbiS5D8vQkDThQrmmFPRs+bp1N9VkC+LaBtFnbFaYARF6i2yFUD9YNSEEu2r14u+KGlg5P7ndIkE+BhAOIp4XcHejVFWfvKvYpMRZ4LDVkPIJdmZ4gIIfGbdBNMv1zRsX6O0NOhiEP1pNYb+HdY5R2YYIvtxn1sC/TrjoN3ELAQA9YBszHEaYjvmqHh08/CWCEpgHIagCccYdSzbtM9GsoAcePL4E7kqSZxIfbNjrYQEBEQbu16pj7bMxVhH8QaouOdjiioqr2tBr5HwA05HP1poGProOzsmJxdph7pb4hJ1P+OEeuwTRIVLudYYl6iBajGW2IdsUo+xGANpuPBpQyB4RajJ4XcXP8K3xVY6x7DfH3DwKfCFAc6KzyADa2xw7/uwBRi2HOyKazkPe5ESYLWY29krqH2tO+IYkgm5tAEkf79j4R9aCeZe/HyjPDlSPZ2NwAZpWKJFkBTveiwoe2noZSAeVKrcblFN5ic0or+ci+CSbmctce8mbqB7QHEJJh5flLDzBMIuh4eroH/Dp5MBbDqxu/T8yCCRHFz70KXpaIFSGlSIebTRt1Om9+CWTgTp95cM0HrAhZDnN/W9FRdAFsA/IjEJ2Eh3tHpdvFZ3XgIq52MrHJdopQo7KUoOVhJiFCo5L0PcKNRVpMbcCKVk1i9k8jqyM9AVgwGrnijiaafUaFmBIlC/U2FZZ+KRtIyDcIRrnGGKE7DEyhBQ9YavxpOFDDSXuC5aPjMNcSGydGArtDd5+5Yp0YraY0oe6UTuzypsxdI8W6IbePryvEeOXG5b/6YayC2sq+7wRconaa9DU= lass@blue