summaryrefslogtreecommitdiffstats
path: root/krebs/3modules
diff options
context:
space:
mode:
Diffstat (limited to 'krebs/3modules')
-rw-r--r--krebs/3modules/exim-smarthost.nix9
-rw-r--r--krebs/3modules/external/mic92.nix55
-rw-r--r--krebs/3modules/konsens.nix2
-rw-r--r--krebs/3modules/krebs/default.nix2
-rw-r--r--krebs/3modules/repo-sync.nix9
-rw-r--r--krebs/3modules/secret.nix68
-rw-r--r--krebs/3modules/tinc.nix10
7 files changed, 121 insertions, 34 deletions
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index e988fb56..c5969caa 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -26,6 +26,7 @@ let
private_key = mkOption {
type = types.secret-file;
default = {
+ name = "exim.dkim_private_key/${config.domain}";
path = "/run/krebs.secret/${config.domain}.dkim_private_key";
owner.name = "exim";
source-path = toString <secrets> + "/${config.domain}.dkim.priv";
@@ -115,8 +116,12 @@ let
}));
systemd.services = mkIf (cfg.dkim != []) {
exim = {
- after = [ "secret.service" ];
- requires = [ "secret.service" ];
+ after = flip map cfg.dkim (dkim:
+ config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
+ );
+ partOf = flip map cfg.dkim (dkim:
+ config.krebs.secret.files."exim.dkim_private_key/${dkim.domain}".service
+ );
};
};
krebs.exim = {
diff --git a/krebs/3modules/external/mic92.nix b/krebs/3modules/external/mic92.nix
index 23ab4f68..b8aaf990 100644
--- a/krebs/3modules/external/mic92.nix
+++ b/krebs/3modules/external/mic92.nix
@@ -13,6 +13,11 @@ in {
amy = {
owner = config.krebs.users.Mic92;
nets = rec {
+ internet = {
+ ip4.addr = "129.215.165.57";
+ ip6.addr = "2001:630:3c1:164:b62e:99ff:fe3e:d369";
+ aliases = [ "amy.i" ];
+ };
retiolum = {
addrs = [
config.krebs.hosts.amy.nets.retiolum.ip4.addr
@@ -41,6 +46,11 @@ in {
clara = {
owner = config.krebs.users.Mic92;
nets = rec {
+ internet = {
+ ip4.addr = "129.215.165.58";
+ ip6.addr = "2001:630:3c1:164:b62e:99ff:fe3d:70f2";
+ aliases = [ "clara.i" ];
+ };
retiolum = {
addrs = [
config.krebs.hosts.clara.nets.retiolum.ip4.addr
@@ -92,6 +102,7 @@ in {
nets = rec {
internet = {
ip4.addr = "129.215.165.54";
+ ip6.addr = "2001:630:3c1:164:30a2:6e7b:c58b:cafd";
aliases = [ "donna.i" ];
};
retiolum = {
@@ -272,6 +283,7 @@ in {
nets = rec {
internet = {
ip4.addr = "129.215.165.53";
+ ip6.addr = "2001:630:3c1:164:6d4:c4ff:fe04:4aba";
aliases = [ "martha.i" ];
};
retiolum = {
@@ -355,6 +367,7 @@ in {
nets = rec {
internet = {
ip4.addr = "129.215.165.52";
+ ip6.addr = "2001:630:3c1:164:6d4:c4ff:fe04:4e4b";
aliases = [ "rose.i" ];
};
retiolum = {
@@ -411,5 +424,47 @@ in {
};
};
};
+ harsha = {
+ owner = config.krebs.users.Mic92;
+ nets = {
+ retiolum = {
+ ip4.addr = "10.243.29.184";
+ aliases = [
+ "harsha.r"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIIBCgKCAQEAqIc+ozq3hKHMe/X3v4j+6or8LMjEV7MtQ8/+n00xpG4NkI4G38Bv
+ 3nmAcV7OhN6of0fr0psbBmym+2VxCZbpl8E3g1GWSKpAvlmP/9v4wDVdrADaTvXC
+ pzCxejtCwEhKLisnMwCMJCuUPbIsSBU+IQDPKP7NP0yY5VapgW3Xl3qXpnehCW1r
+ NBZjZASnhSXcJRLJayEDN6uBviYrnnfbrHOx4fPcjQPTHX5RYr3EbgGZQO9xki44
+ 9dKT4EA95lupTqC3wzuQbaNpvIuVzmggiDY/NsBIVh0/2XjGnO54wtCEPudaLnWd
+ WNtc1wfVFB6gzgG1N7msOuFUReOIfyF/ywIDAQAB
+ -----END RSA PUBLIC KEY-----
+ '';
+ };
+ };
+ };
+ eva = {
+ owner = config.krebs.users.Mic92;
+ nets = {
+ retiolum = {
+ ip4.addr = "10.243.29.185";
+ aliases = [
+ "eva.r"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN RSA PUBLIC KEY-----
+ MIIBCgKCAQEAqIc+ozq3hKHMe/X3v4j+6or8LMjEV7MtQ8/+n00xpG4NkI4G38Bv
+ 3nmAcV7OhN6of0fr0psbBmym+2VxCZbpl8E3g1GWSKpAvlmP/9v4wDVdrADaTvXC
+ pzCxejtCwEhKLisnMwCMJCuUPbIsSBU+IQDPKP7NP0yY5VapgW3Xl3qXpnehCW1r
+ NBZjZASnhSXcJRLJayEDN6uBviYrnnfbrHOx4fPcjQPTHX5RYr3EbgGZQO9xki44
+ 9dKT4EA95lupTqC3wzuQbaNpvIuVzmggiDY/NsBIVh0/2XjGnO54wtCEPudaLnWd
+ WNtc1wfVFB6gzgG1N7msOuFUReOIfyF/ywIDAQAB
+ -----END RSA PUBLIC KEY-----
+ '';
+ };
+ };
+ };
};
}
diff --git a/krebs/3modules/konsens.nix b/krebs/3modules/konsens.nix
index 74895a97..81486810 100644
--- a/krebs/3modules/konsens.nix
+++ b/krebs/3modules/konsens.nix
@@ -56,7 +56,7 @@ let
systemd.services = mapAttrs' (name: repo:
nameValuePair "konsens-${name}" {
- after = [ "network.target" "secret.service" ];
+ after = [ "network.target" ];
path = [ pkgs.git ];
restartIfChanged = false;
serviceConfig = {
diff --git a/krebs/3modules/krebs/default.nix b/krebs/3modules/krebs/default.nix
index de09b425..5e3ddcb2 100644
--- a/krebs/3modules/krebs/default.nix
+++ b/krebs/3modules/krebs/default.nix
@@ -74,6 +74,8 @@ in {
"build.hotdog.r"
"cgit.hotdog.r"
"irc.r"
+ "wiki.r"
+ "wiki.hotdog.r"
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
diff --git a/krebs/3modules/repo-sync.nix b/krebs/3modules/repo-sync.nix
index 45d9d81c..91111f3e 100644
--- a/krebs/3modules/repo-sync.nix
+++ b/krebs/3modules/repo-sync.nix
@@ -124,6 +124,7 @@ let
privateKeyFile = mkOption {
type = types.secret-file;
default = {
+ name = "repo-sync-key";
path = "${cfg.stateDir}/ssh.priv";
owner = cfg.user;
source-path = toString <secrets> + "/repo-sync.ssh.key";
@@ -166,7 +167,13 @@ let
});
in nameValuePair "repo-sync-${name}" {
description = "repo-sync";
- after = [ "network.target" "secret.service" ];
+ after = [
+ config.krebs.secret.files.repo-sync-key.service
+ "network.target"
+ ];
+ partOf = [
+ config.krebs.secret.files.repo-sync-key.service
+ ];
environment = {
GIT_SSH_COMMAND = "${pkgs.openssh}/bin/ssh -i ${cfg.stateDir}/ssh.priv";
diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix
index 672c503b..bf2c62cc 100644
--- a/krebs/3modules/secret.nix
+++ b/krebs/3modules/secret.nix
@@ -1,4 +1,5 @@
-{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }: let
cfg = config.krebs.secret;
in {
options.krebs.secret = {
@@ -8,32 +9,43 @@ in {
};
};
config = lib.mkIf (cfg.files != {}) {
- systemd.services.secret = let
- # TODO fail if two files have the same path but differ otherwise
- files = unique (map (flip removeAttrs ["_module"])
- (attrValues cfg.files));
- in {
- serviceConfig = {
- Type = "oneshot";
- RemainAfterExit = "yes";
- SyslogIdentifier = "secret";
- ExecStart = pkgs.writeDash "install-secret-files" ''
- exit_code=0
- ${concatMapStringsSep "\n" (file: ''
- ${pkgs.coreutils}/bin/install \
- -D \
- --compare \
- --verbose \
- --mode=${shell.escape file.mode} \
- --owner=${shell.escape file.owner.name} \
- --group=${shell.escape file.group-name} \
- ${shell.escape file.source-path} \
- ${shell.escape file.path} \
- || exit_code=1
- '') files}
- exit $exit_code
- '';
- };
- };
+ systemd.paths =
+ mapAttrs'
+ (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ pathConfig.PathChanged = file.source-path;
+ })
+ cfg.files;
+ systemd.services =
+ mapAttrs'
+ (name: file: nameValuePair "secret-trigger-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ serviceConfig = {
+ Type = "oneshot";
+ ExecStart = "${pkgs.systemd}/bin/systemctl restart ${file.service}";
+ };
+ })
+ cfg.files
+ //
+ mapAttrs'
+ (name: file: nameValuePair "secret-${systemd.encodeName name}" {
+ wantedBy = ["multi-user.target"];
+ serviceConfig = {
+ Type = "oneshot";
+ RemainAfterExit = "yes";
+ ExecStart = toString [
+ "${pkgs.coreutils}/bin/install"
+ "-D"
+ "--compare"
+ "--verbose"
+ "--mode=${file.mode}"
+ "--owner=${file.owner.name}"
+ "--group=${file.group-name}"
+ file.source-path
+ file.path
+ ];
+ };
+ })
+ cfg.files;
};
}
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 8b6e959d..1fca7de5 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -158,6 +158,7 @@ let
privkey = mkOption {
type = types.secret-file;
default = {
+ name = "${tinc.config.netname}.rsa_key.priv";
path = "${tinc.config.user.home}/tinc.rsa_key.priv";
owner = tinc.config.user;
source-path = toString <secrets> + "/${tinc.config.netname}.rsa_key.priv";
@@ -219,9 +220,14 @@ let
iproute = cfg.iproutePackage;
in {
description = "Tinc daemon for ${netname}";
- after = [ "network.target" ];
+ after = [
+ config.krebs.secret.files."${netname}.rsa_key.priv".service
+ "network.target"
+ ];
+ partOf = [
+ config.krebs.secret.files."${netname}.rsa_key.priv".service
+ ];
wantedBy = [ "multi-user.target" ];
- requires = [ "secret.service" ];
path = [ tinc iproute ];
serviceConfig = rec {
Restart = "always";
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-30 01:16:51 +0000