summaryrefslogtreecommitdiffstats
path: root/krebs/3modules
diff options
context:
space:
mode:
Diffstat (limited to 'krebs/3modules')
-rw-r--r--krebs/3modules/Reaktor.nix155
-rw-r--r--krebs/3modules/announce-activation.nix5
-rw-r--r--krebs/3modules/default.nix1
-rw-r--r--krebs/3modules/external/default.nix66
-rw-r--r--krebs/3modules/hidden-ssh.nix33
-rw-r--r--krebs/3modules/lass/default.nix57
-rw-r--r--krebs/3modules/makefu/default.nix1
-rw-r--r--krebs/3modules/realwallpaper.nix1
8 files changed, 94 insertions, 225 deletions
diff --git a/krebs/3modules/Reaktor.nix b/krebs/3modules/Reaktor.nix
deleted file mode 100644
index 2a035d7b..00000000
--- a/krebs/3modules/Reaktor.nix
+++ /dev/null
@@ -1,155 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-let
-
- cfg = config.krebs.Reaktor;
- homedir = "/var/lib/Reaktor";
-
- out = {
- options.krebs.Reaktor = api;
- config = mkIf (cfg != {}) imp;
- };
-
- api = mkOption {
- default = {};
- type = with types; attrsOf (submodule ({ options = {
-
- nickname = mkOption {
- default = config.krebs.build.host.name + "|r";
- type = types.str;
- description = ''
- The nick name of the irc bot.
- Defaults to {hostname}|r
- '';
- };
-
- overrideConfig = mkOption {
- default = null;
- type = types.nullOr types.str;
- description = ''
- configuration to be used instead of default ones.
- Reaktor default cfg can be retrieved via `reaktor get-config`
- '';
- };
-
- plugins = mkOption {
- default = [pkgs.ReaktorPlugins.nixos-version];
- };
-
- workdir = mkOption {
- default = "/var/lib/Reaktor";
- type = types.path;
- description = ''
- path to be used as workdir (home dir is still /var/lib/Reaktor)
- '';
- };
-
- extraConfig = mkOption {
- default = "";
- type = types.str;
- description = ''
- configuration appended to the default or overridden configuration
- '';
- };
-
- extraEnviron = mkOption {
- default = {};
- type = types.attrsOf types.str;
- description = ''
- Environment to be provided to the service, can be:
- REAKTOR_HOST
- REAKTOR_PORT
- REAKTOR_STATEDIR
-
- debug and nickname can be set separately via the Reaktor api
- '';
- };
-
- channels = mkOption {
- default = [ "#krebs" ];
- type = types.listOf types.str;
- description = ''
- Channels the Reaktor should connect to at startup.
- '';
- };
-
- debug = mkOption {
- default = false;
- description = ''
- Reaktor debug output
- '';
- };
- };}));
- };
-
- imp = {
- # TODO get user per configured bot
- # TODO get home from api
- # for reaktor get-config
- users.extraUsers = singleton rec {
- name = "Reaktor";
- uid = genid name;
- description = "Reaktor user";
- home = homedir;
- createHome = true;
- };
-
- #users.extraGroups = singleton {
- # name = "Reaktor";
- # gid = config.ids.gids.Reaktor;
- #};
-
- systemd.services = mapAttrs' (name: botcfg:
- let
- ReaktorConfig = pkgs.writeText "config.py" ''
- ${if (isString botcfg.overrideConfig ) then ''
- # Overriden Config
- ${botcfg.overrideConfig}
- '' else ""}
- ## Extra Config
- ${concatStringsSep "\n" (map (plug: plug.config) botcfg.plugins)}
- ${botcfg.extraConfig}
- '';
- in nameValuePair "Reaktor-${name}" {
- path = with pkgs; [
- git # for nag
- jq # for tell
- python # for caps
- utillinux # flock for tell
- ];
- description = "Reaktor IRC Bot";
- after = [ "network.target" ];
- wantedBy = [ "multi-user.target" ];
- environment = {
- GIT_SSL_CAINFO = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
- PYTHONPATH = "${pkgs.Reaktor}/lib/python3.6/site-packages";
- REAKTOR_NICKNAME = botcfg.nickname;
- REAKTOR_DEBUG = (if botcfg.debug then "True" else "False");
- REAKTOR_CHANNELS = lib.concatStringsSep "," botcfg.channels;
- state_dir = botcfg.workdir;
-
- } // botcfg.extraEnviron;
- serviceConfig= {
- ExecStartPre = pkgs.writeScript "Reaktor-init" ''
- #! /bin/sh
- ${if (isString botcfg.overrideConfig) then
- ''cp ${ReaktorConfig} /tmp/reaktor-${name}-config.py''
- else
- ''(${pkgs.Reaktor}/bin/reaktor get-config;cat "${ReaktorConfig}" ) > /tmp/reaktor-${name}-config.py''
- }
- mkdir -p ${botcfg.workdir}
- '';
- ExecStart = "${pkgs.Reaktor}/bin/reaktor run /tmp/reaktor-${name}-config.py";
- PrivateTmp = "true";
- User = "Reaktor";
- Restart = "always";
- RestartSec= "30" ;
- };
- }
- ) cfg;
-
- };
-
-in
-out
diff --git a/krebs/3modules/announce-activation.nix b/krebs/3modules/announce-activation.nix
index 76eb4b13..a40ae8ce 100644
--- a/krebs/3modules/announce-activation.nix
+++ b/krebs/3modules/announce-activation.nix
@@ -9,6 +9,7 @@ with import <stockholm/lib>;
${shell.escape (toString cfg.irc.port)} \
${shell.escape cfg.irc.nick} \
${shell.escape cfg.irc.channel} \
+ ${escapeShellArg cfg.irc.tls} \
"$message"
'';
default-get-message = pkgs.writeDash "announce-activation-get-message" ''
@@ -50,6 +51,10 @@ in {
default = "irc.r";
type = types.hostname;
};
+ tls = mkOption {
+ default = false;
+ type = types.bool;
+ };
};
};
config = mkIf cfg.enable {
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 30ca82b9..149995a2 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -43,7 +43,6 @@ let
./permown.nix
./per-user.nix
./power-action.nix
- ./Reaktor.nix
./reaktor2.nix
./realwallpaper.nix
./retiolum-bootstrap.nix
diff --git a/krebs/3modules/external/default.nix b/krebs/3modules/external/default.nix
index 75be5832..eff2967e 100644
--- a/krebs/3modules/external/default.nix
+++ b/krebs/3modules/external/default.nix
@@ -18,42 +18,14 @@ with import <stockholm/lib>;
in {
hosts = mapAttrs hostDefaults {
- toum = {
- owner = config.krebs.users.kmein;
- nets = {
- retiolum = {
- ip4.addr = "10.243.2.3";
- aliases = [
- "toum.r"
- "toum.kmein.r"
- ];
- tinc.pubkey = ''
- -----BEGIN PUBLIC KEY-----
- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA2tRtskPP6391+ZX9xzsx
- CUotXuqYucYmnUbrRSIlxASVqTmAf3nDOE5EDBBcTdSwnb02JcJW4Zh7+BGgMxjF
- GxDPs6ETI28mHK+6rp8TOkMnyDb5mtSGVZPvKJU9fFOt6aAX1J1BzTfwtHtVQq7K
- WBzdpeKXlw4dIQ6K6SGmPIPpEh9pE1Xb+GuVljCXKxGJFbW40dmh2ZdadO7umBDu
- vRk08jT9/BUnUP6KrZlvyePnG38z6srMrVU+XAHu5D2qZ9y+QIp3kw7Y5JUrNXc7
- 9q9P9TYx15GiIz2mSJKcLVmkLRebsaqdV7dBibPbfdGE+NB+F1FYPGDdW4cnonon
- DzzjGm/FDfOCXEnSkYGQDBWpfd/8AWum1xGJxJCPNBJElGE2o5jDWo4Y1b9gHP0M
- vARm8AOK8R1pQ7BP+pNMO0gGw2NDrtWiWpTeZ7SqXmZAZ/Gmyen9X+/fowcbTyDH
- b9joIuMQeOtxbUV2JprZIdit9NBFSZq/7Re/GBUwjGBm3LabIXFNGKZovx/f9lf8
- r5tVs4SPauiKzZS0K1Gz1NSq+3OXaY5EwVrBUXptYqRT7uyhVloOPRUsqRFeB0Fn
- Y5xOpDJ0UiJxgFbdH5Vb81D/VjNO9Q4nZib8wSEuLrYLHGoceQPX4+Ov9IdhIL4B
- BMTCaF+VCWC5PCLr0e61KqMCAwEAAQ==
- -----END PUBLIC KEY-----
- '';
- };
- };
- };
- wilde = {
+ kabsa = {
owner = config.krebs.users.kmein;
nets = {
retiolum = {
ip4.addr = "10.243.2.4";
aliases = [
- "wilde.r"
- "wilde.kmein.r"
+ "kabsa.r"
+ "kabsa.kmein.r"
];
tinc.pubkey = ''
-----BEGIN PUBLIC KEY-----
@@ -99,34 +71,6 @@ in {
};
};
};
- homeros = {
- owner = config.krebs.users.kmein;
- nets = {
- retiolum = {
- ip4.addr = "10.243.2.1";
- aliases = [
- "homeros.r"
- "homeros.kmein.r"
- ];
- tinc.pubkey = ''
- -----BEGIN PUBLIC KEY-----
- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAoZq6BwB6rV6EfTf8PWOd
- ZhEWig5VcK1FcH0qi7KgojAhGSHhWmtFlvRSoGpQrSFRN0g5eTnrrguuTiIs6djc
- 6Al9HMqwSD1IOkqFm8jM4aG5NqjYg3in6blOFarBEOglfnsYHiUPt6T4fERxRZ9v
- RguEWrishNMSv+D4vclKwctTB/6dQNsTAfnplcyDZ9un/ql9BG2cgU9yqeYLDdXd
- vRvrWX9eZKGJvTrQmAiKONlSvspr1d28FxcUrUnCsdRLvP3Cc4JZiUhSA7ixFxn3
- +LgGIZiMKTnl8syrsHk5nvLi5EUER7xkVX8iBlKA4JD4XTZVyBxPB1mJnOCUShQc
- QK6nVr6auvJbRn7DHHKxDflSBgYt4qaf92+5A4xEsZtgMpmIFH5t6ifGQsQwgYsm
- fOexviy9gMyZrHjQDUs4smQxxYq3AJLdfOg2jQXeAbgZpCVw5l8YHk3ECoAk7Fvh
- VMJVPwukErGuVn2LpCHeVyFBXNft4bem1g0gtaf2SuGFEnl7ABetQ0bRwClRSLd7
- k7PGDbdcCImsWhqyuLpkNcm95DfBrXa12GETm48Wv9jV52C5tfWFmOnJ0mOnvtxX
- gpizJjFzHz275TVnJHhmIr2DkiGpaIVUL4FRkTslejSJQoUTZfDAvKF2gRyk+n6N
- mJ/hywVtvLxNkNimyztoKKMCAwEAAQ==
- -----END PUBLIC KEY-----
- '';
- };
- };
- };
horisa = {
cores = 2;
owner = config.krebs.users.ulrich; # main laptop
@@ -205,6 +149,7 @@ in {
aliases = [
"makanek.r"
"makanek.kmein.r"
+ "grafana.kmein.r"
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
@@ -317,6 +262,7 @@ in {
aliases = [
"zaatar.r"
"zaatar.kmein.r"
+ "radio.kmein.r"
];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
@@ -639,7 +585,7 @@ in {
nets = {
retiolum = {
ip4.addr = "10.243.13.12";
- aliases = [ "catalonia.r" ];
+ aliases = [ "catalonia.r" "aleph.r" ];
tinc.pubkey = ''
-----BEGIN RSA PUBLIC KEY-----
MIICCgKCAgEAug+nej8/spuRHdzcfBYAuzUVoiq4YufmJqXSshvgf4aqjeVEt91Y
diff --git a/krebs/3modules/hidden-ssh.nix b/krebs/3modules/hidden-ssh.nix
index 1e56e62f..acbe717d 100644
--- a/krebs/3modules/hidden-ssh.nix
+++ b/krebs/3modules/hidden-ssh.nix
@@ -19,6 +19,14 @@ let
type = types.str;
default = "irc.hackint.org";
};
+ port = mkOption {
+ type = types.int;
+ default = 6697;
+ };
+ tls = mkOption {
+ type = types.bool;
+ default = true;
+ };
message = mkOption {
type = types.str;
default = "SSH Hidden Service at ";
@@ -27,14 +35,17 @@ let
imp = let
torDirectory = "/var/lib/tor"; # from tor.nix
- hiddenServiceDir = torDirectory + "/ssh-announce-service";
+ hiddenServiceDir = torDirectory + "/onion/hidden-ssh";
in {
services.tor = {
enable = true;
- extraConfig = ''
- HiddenServiceDir ${hiddenServiceDir}
- HiddenServicePort 22 127.0.0.1:22
- '';
+ relay.onionServices.hidden-ssh = {
+ version = 3;
+ map = [{
+ port = 22;
+ target.port = 22;
+ }];
+ };
client.enable = true;
};
systemd.services.hidden-ssh-announce = {
@@ -50,10 +61,14 @@ let
echo "still waiting for ${hiddenServiceDir}/hostname"
sleep 1
done
- ${pkgs.untilport}/bin/untilport ${cfg.server} 6667 && \
- ${pkgs.irc-announce}/bin/irc-announce \
- ${cfg.server} 6667 ${config.krebs.build.host.name}-ssh \
- \${cfg.channel} \
+ ${pkgs.untilport}/bin/untilport ${escapeShellArg cfg.server} ${toString cfg.port}
+
+ ${pkgs.irc-announce}/bin/irc-announce \
+ ${escapeShellArg cfg.server} \
+ ${toString cfg.port} \
+ "${config.krebs.build.host.name}-ssh" \
+ ${escapeShellArg cfg.channel} \
+ ${escapeShellArg cfg.tls} \
"${cfg.message}$(cat ${hiddenServiceDir}/hostname)"
'';
PrivateTmp = "true";
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index b19e2e6f..3419d806 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -47,6 +47,7 @@ in {
radio 60 IN A ${config.krebs.hosts.prism.nets.internet.ip4.addr}
jitsi 60 IN A ${config.krebs.hosts.prism.nets.internet.ip4.addr}
streaming 60 IN A ${config.krebs.hosts.prism.nets.internet.ip4.addr}
+ mumble 60 IN A ${config.krebs.hosts.prism.nets.internet.ip4.addr}
'';
};
nets = rec {
@@ -783,6 +784,62 @@ in {
};
ssh.privkey.path = <secrets/ssh.id_ed25519>;
ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIn+o0uCBSot254kZKlNepVKFcwDPdr8s6+lQmYGM3Hd ";
+ syncthing.id = "TT4MBZS-YNDZUYO-Y6L4GOK-5IYUCXY-2RKFOSK-5SMZYSR-5QMOXSS-6DNJIAZ";
+ };
+
+ lasspi = {
+ cores = 1;
+ nets = {
+ retiolum = {
+ ip4.addr = "10.243.1.89";
+ ip6.addr = r6 "189";
+ aliases = [
+ "lasspi.r"
+ ];
+ tinc.pubkey = ''
+ -----BEGIN PUBLIC KEY-----
+ MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA3zUXIiw8/9okrGaxlAR1
+ JvoXNxAzLj5wwE2B0A+9ppev7Vl52HJarNoM6+0RN4aZDGMhDWg8J5ZQSdGUNm5F
+ CIdxE1TwLXxzW5nd7BIb+MVsjtw0pxId7Gxq6Wgtx1QljUdsp8OVrJActqsmXYMl
+ oYEWdENHRONYTCyhs+Kd18MERyxQCqOXOnD170iaFuCcHiIa2nSOtlk+aIPNIE/P
+ Qsp7Q0RCRvqd5LszsI7bp3gZL9mgGquQEW+3ZxSaIYHGTdK/zI4PHYpEa7IvdJFS
+ BJjJj+PbilnSxy7iL826O8ckxBqA0rNS0EynCKCI0DoVimCeklk20vLagDyXiDyC
+ VW2774j1rF35eIowPTBVJNfquEptNDl9MLV3MC2P8gnCZp5x+7dEwpqsvecBQ7Z8
+ +Ry9JZ/zlWi5qT86SrwKKqJqRhWHjZZSRzWdo4ypaNOy0cKHb2DcVfgn38Kf16xs
+ QM11XLCRE8VLIVl5UFgrF6q/0f8JP1BG8RO90NDsLwIW/EwKiJ9OGFtayvxkmgHP
+ zgmzgws8cn50762OPkp4OVzVexN77d9N8GU9QXAlsFyn2FJlO26DvFON4fHIf0bP
+ 6lqI1Up2jAy0eSl2txlxxKbKRlkIaebHulhxIxQ1djA+xPb/5cfasom9Qqwf6/Lc
+ 287nChBcbY+HlshTe0lZdrkCAwEAAQ==
+ -----END PUBLIC KEY-----
+ '';
+ };
+ wiregrill = {
+ ip6.addr = w6 "189";
+ aliases = [
+ "lasspi.w"
+ ];
+ wireguard.pubkey = ''
+ IIBAiG7jZEliQJJsNUQswLsB5FQFkAfq5IwyHAp71Vw=
+ '';
+ };
+ };
+ ssh.privkey.path = <secrets/ssh.id_ed25519>;
+ ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEjYOaTQE9OvvIaWWjO+3/uSy7rvnhnJA48rWYeB2DfB";
+ };
+
+ domsen-pixel = {
+ nets = {
+ wiregrill = {
+ ip4.addr = "10.244.1.17";
+ ip6.addr = w6 "d0";
+ aliases = [
+ "domsen-pixel.w"
+ ];
+ wireguard.pubkey = "cGuBSB1DftIsanbxrSG/i4FiC+TmQrs+Z0uE6SPscHY=";
+ };
+ };
+ external = true;
+ ci = false;
};
};
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 30d90bf2..03431ce5 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -233,6 +233,7 @@ in {
"wiki.gum.r"
"wiki.makefu.r"
"warrior.gum.r"
+ "rss.makefu.r"
"sick.makefu.r"
"dl.gum.r"
"dl.makefu.r"
diff --git a/krebs/3modules/realwallpaper.nix b/krebs/3modules/realwallpaper.nix
index 76f33396..1fa6012c 100644
--- a/krebs/3modules/realwallpaper.nix
+++ b/krebs/3modules/realwallpaper.nix
@@ -51,6 +51,7 @@ let
serviceConfig = {
Type = "simple";
+ Restart = "on-failure";
ExecStart = "${pkgs.realwallpaper}/bin/generate-wallpaper";
User = "realwallpaper";
};
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-03 12:43:05 +0000