diff options
Diffstat (limited to 'lass')
-rw-r--r-- | lass/1systems/icarus.nix | 4 | ||||
-rw-r--r-- | lass/1systems/mors.nix | 2 | ||||
-rw-r--r-- | lass/1systems/prism.nix | 32 | ||||
-rw-r--r-- | lass/1systems/shodan.nix | 8 | ||||
-rw-r--r-- | lass/2configs/baseX.nix | 8 | ||||
-rw-r--r-- | lass/2configs/default.nix | 6 | ||||
-rw-r--r-- | lass/2configs/hfos.nix | 4 | ||||
-rw-r--r-- | lass/2configs/nixpkgs.nix | 2 | ||||
-rw-r--r-- | lass/2configs/retiolum.nix | 4 | ||||
-rw-r--r-- | lass/2configs/vim.nix | 1 | ||||
-rw-r--r-- | lass/2configs/websites/domsen.nix | 42 | ||||
-rw-r--r-- | lass/2configs/websites/fritz.nix | 9 | ||||
-rw-r--r-- | lass/2configs/xserver/default.nix | 35 | ||||
-rw-r--r-- | lass/3modules/default.nix | 2 | ||||
-rw-r--r-- | lass/3modules/kapacitor.nix | 101 | ||||
-rw-r--r-- | lass/3modules/telegraf.nix | 67 | ||||
-rw-r--r-- | lass/5pkgs/xmonad-lass.nix | 10 |
17 files changed, 263 insertions, 74 deletions
diff --git a/lass/1systems/icarus.nix b/lass/1systems/icarus.nix index 3998fc177..8402613da 100644 --- a/lass/1systems/icarus.nix +++ b/lass/1systems/icarus.nix @@ -54,7 +54,7 @@ with import <stockholm/lib>; }; services.udev.extraRules = '' - SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:29:26:bc", NAME="wl0" - SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:0c:a7:63", NAME="et0" + SUBSYSTEM=="net", ATTR{address}=="08:11:96:0a:5d:6c", NAME="wl0" + SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:71:cb:35", NAME="et0" ''; } diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index 012bd359f..19b512dde 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -289,7 +289,7 @@ with import <stockholm/lib>; services.udev.extraRules = '' SUBSYSTEM=="net", ATTR{address}=="00:24:d7:f0:a0:0c", NAME="wl0" - SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:8f:85:c9", NAME="et0" + SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:71:cb:35", NAME="et0" ''; #TODO activationScripts seem broken, fix them! diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix index 854c98f46..d07acebee 100644 --- a/lass/1systems/prism.nix +++ b/lass/1systems/prism.nix @@ -12,6 +12,22 @@ let in { imports = [ ../. + { + networking.interfaces.et0.ip4 = [ + { + address = ip; + prefixLength = 24; + } + ]; + networking.defaultGateway = "213.239.205.225"; + networking.nameservers = [ + "8.8.8.8" + ]; + services.udev.extraRules = '' + SUBSYSTEM=="net", ATTR{address}=="54:04:a6:7e:f4:06", NAME="et0" + ''; + + } ../2configs/retiolum.nix ../2configs/exim-smarthost.nix ../2configs/downloading.nix @@ -49,22 +65,6 @@ in { }; } { - networking.interfaces.et0.ip4 = [ - { - address = ip; - prefixLength = 24; - } - ]; - networking.defaultGateway = "213.239.205.225"; - networking.nameservers = [ - "8.8.8.8" - ]; - services.udev.extraRules = '' - SUBSYSTEM=="net", ATTR{address}=="54:04:a6:7e:f4:06", NAME="et0" - ''; - - } - { boot.loader.grub = { devices = [ "/dev/sda" diff --git a/lass/1systems/shodan.nix b/lass/1systems/shodan.nix index 095898380..232e91d90 100644 --- a/lass/1systems/shodan.nix +++ b/lass/1systems/shodan.nix @@ -59,17 +59,13 @@ with import <stockholm/lib>; fileSystems = { "/" = { device = "/dev/pool/nix"; - fsType = "ext4"; + fsType = "btrfs"; }; "/boot" = { device = "/dev/sda1"; }; - "/home/lass" = { - device = "/dev/pool/home-lass"; - fsType = "ext4"; - }; "/tmp" = { device = "tmpfs"; fsType = "tmpfs"; @@ -77,7 +73,7 @@ with import <stockholm/lib>; }; "/bku" = { device = "/dev/pool/bku"; - fsType = "ext4"; + fsType = "btrfs"; }; }; diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix index 1e796015a..a67c25145 100644 --- a/lass/2configs/baseX.nix +++ b/lass/2configs/baseX.nix @@ -13,6 +13,14 @@ in { systemWide = true; }; } + { + krebs.per-user.lass.packages = [ + pkgs.sshuttle + ]; + security.sudo.extraConfig = '' + lass ALL= (root) NOPASSWD:SETENV: ${pkgs.sshuttle}/bin/.sshuttle-wrapped + ''; + } ]; users.extraUsers.mainUser.extraGroups = [ "audio" "video" ]; diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index 6fea97728..1cb68a985 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -56,6 +56,12 @@ with import <stockholm/lib>; SSL_CERT_FILE = ca-bundle; }; }) + { + #for sshuttle + environment.systemPackages = [ + pkgs.pythonPackages.python + ]; + } ]; networking.hostName = config.krebs.build.host.name; diff --git a/lass/2configs/hfos.nix b/lass/2configs/hfos.nix index f6f09e226..7d4d544aa 100644 --- a/lass/2configs/hfos.nix +++ b/lass/2configs/hfos.nix @@ -7,7 +7,7 @@ with import <stockholm/lib>; isNormalUser = true; extraGroups = [ "libvirtd" ]; openssh.authorizedKeys.keys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5NnADMRySix1kcxQwseHfem/SCDmkbvwc+ZZu7HFz4zss1k4Fh1knsukMY83zlno8p/8bBPWyixLTxuZHNy26af8GP95bvV3brnpRmrijkE4dOlpd+wvPcIyTKNunJvMzNDP/ry9g2GczEZKGWvQZudq/nI54HaCaRWM2kzEMEg8Rr9SGlZEKo8B+8HGVsz1a8USOnm8dqYP9dmfLdpy/s+7yWJSPh8wokvWeOOrahirOhO99ZfXm2gcdHqSKvbD2+4EYEm5w8iFrbYBT2wZ3u9ZOiooL/JuEBBdnDrcqZqeaTw0vOdKPvkUP8/rzRjvIwSkynMSD8fixpdGRNeIB riot@lagrange" + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMkyCwdwBrsbs3qrNQcy/SqQpex4aaQoAMuT+NDefFc8KVHOMfmkDccEyAggDTgQhUrEVIvo/fFUmGBd9sm1vN1IthO2Qh5nX+qiK/A2R7sxci0Ry6piU03R27JfpZqi6g8TSPNi1C9rC8eBqOfO3OB8oQOkFmM48Q9cmS8AV3ERLR0LaHoEqUbs86JELbtHrMdKk4Hzo8zTM/isP3GO8iDHRt4dBS/03Ve7+WVxgNwWU2HW3a3jJd3tWHrqGmS/ZfCEC/47eIj4WSW+JiH9Q0BarNEbkkMV1Mvm32MX52stGPd5FaIIUtFqD4745iVSiw8esUGFUxJ1RjWgUHr99h riot@vortex" config.krebs.users.lass.pubkey ]; }; @@ -21,12 +21,14 @@ with import <stockholm/lib>; krebs.iptables.tables.nat.PREROUTING.rules = [ { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 22"; target = "DNAT --to-destination 192.168.122.208:22"; } + { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 25"; target = "DNAT --to-destination 192.168.122.208:25"; } { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 80"; target = "DNAT --to-destination 192.168.122.208:1080"; } { v6 = false; precedence = 1000; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; } ]; krebs.iptables.tables.filter.FORWARD.rules = [ { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } + { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 1080 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } { v6 = false; precedence = 1000; predicate = "-d 192.168.122.208 -p tcp --dport 1443 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; } ]; diff --git a/lass/2configs/nixpkgs.nix b/lass/2configs/nixpkgs.nix index 6885ef59d..a33e69bf8 100644 --- a/lass/2configs/nixpkgs.nix +++ b/lass/2configs/nixpkgs.nix @@ -3,6 +3,6 @@ { krebs.build.source.nixpkgs.git = { url = https://github.com/lassulus/nixpkgs; - ref = "819c1ab486a9c81d6a6b76c759aedece2df39037"; + ref = "d98b556864f2b3a634e39ed1ae29f47c0e3fae35"; }; } diff --git a/lass/2configs/retiolum.nix b/lass/2configs/retiolum.nix index eba40532d..7a7bf95be 100644 --- a/lass/2configs/retiolum.nix +++ b/lass/2configs/retiolum.nix @@ -16,9 +16,9 @@ enable = true; connectTo = [ "prism" - "pigstarter" "gum" - "flap" + "ni" + "dishfire" ]; }; diff --git a/lass/2configs/vim.nix b/lass/2configs/vim.nix index bfaae24c8..f79e6b807 100644 --- a/lass/2configs/vim.nix +++ b/lass/2configs/vim.nix @@ -5,6 +5,7 @@ let out = { environment.systemPackages = [ vim + pkgs.pythonPackages.flake8 ]; environment.etc.vimrc.source = vimrc; diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix index 2bbfe7333..5ed73a22c 100644 --- a/lass/2configs/websites/domsen.nix +++ b/lass/2configs/websites/domsen.nix @@ -7,7 +7,6 @@ let genid_signed ; inherit (import <stockholm/lass/2configs/websites/util.nix> {inherit lib pkgs;}) - ssl servePage serveOwncloud serveWordpress; @@ -25,47 +24,16 @@ let in { imports = [ ./sqlBackup.nix - (ssl [ "reich-gebaeudereinigung.de" "www.reich-gebaeudereinigung.de" ]) (servePage [ "reich-gebaeudereinigung.de" "www.reich-gebaeudereinigung.de" ]) - (ssl [ "karlaskop.de" "www.karlaskop.de" ]) (servePage [ "karlaskop.de" "www.karlaskop.de" ]) - (ssl [ "makeup.apanowicz.de" "www.makeup.apanowicz.de" ]) (servePage [ "makeup.apanowicz.de" "www.makeup.apanowicz.de" ]) - (ssl [ "pixelpocket.de" ]) (servePage [ "pixelpocket.de" ]) - (ssl [ "o.ubikmedia.de" ]) (serveOwncloud [ "o.ubikmedia.de" ]) - (ssl [ - "ubikmedia.de" - "aldona.ubikmedia.de" - "apanowicz.de" - "nirwanabluete.de" - "aldonasiech.com" - "360gradvideo.tv" - "ubikmedia.eu" - "facts.cloud" - "youthtube.xyz" - "illucloud.eu" - "illucloud.de" - "illucloud.com" - "www.ubikmedia.de" - "www.aldona.ubikmedia.de" - "www.apanowicz.de" - "www.nirwanabluete.de" - "www.aldonasiech.com" - "www.360gradvideo.tv" - "www.ubikmedia.eu" - "www.facts.cloud" - "www.youthtube.xyz" - "www.illucloud.eu" - "www.illucloud.de" - "www.illucloud.com" - ]) (serveWordpress [ "ubikmedia.de" "apanowicz.de" @@ -88,6 +56,16 @@ in { "www.illucloud.eu" "www.illucloud.de" "www.illucloud.com" + "www.ubikmedia.de" + "aldona2.ubikmedia.de" + "apanowicz.ubikmedia.de" + "cinevita.ubikmedia.de" + "factscloud.ubikmedia.de" + "illucloud.ubikmedia.de" + "joemisch.ubikmedia.de" + "karlaskop.ubikmedia.de" + "nb.ubikmedia.de" + "youthtube.ubikmedia.de" ]) ]; diff --git a/lass/2configs/websites/fritz.nix b/lass/2configs/websites/fritz.nix index 00e987116..9bf7e4a9c 100644 --- a/lass/2configs/websites/fritz.nix +++ b/lass/2configs/websites/fritz.nix @@ -7,7 +7,6 @@ let head ; inherit (import <stockholm/lass/2configs/websites/util.nix> {inherit lib pkgs;}) - ssl servePage serveWordpress ; @@ -29,28 +28,20 @@ in { imports = [ ./sqlBackup.nix - (ssl [ "radical-dreamers.de" "www.radical-dreamers.de" ]) (serveWordpress [ "radical-dreamers.de" "www.radical-dreamers.de" ]) - (ssl [ "gs-maubach.de" "www.gs-maubach.de" ]) (serveWordpress [ "gs-maubach.de" "www.gs-maubach.de" ]) - (ssl [ "spielwaren-kern.de" "www.spielwaren-kern.de" ]) (serveWordpress [ "spielwaren-kern.de" "www.spielwaren-kern.de" ]) - (ssl [ "familienpraxis-korntal.de" "www.familienpraxis-korntal.de" ]) (servePage [ "familienpraxis-korntal.de" "www.familienpraxis-korntal.de" ]) - (ssl [ "ttf-kleinaspach.de" "www.ttf-kleinaspach.de" ]) (serveWordpress [ "ttf-kleinaspach.de" "www.ttf-kleinaspach.de" ]) - (ssl [ "eastuttgart.de" "www.eastuttgart.de" ]) (serveWordpress [ "eastuttgart.de" "www.eastuttgart.de" ]) - (ssl [ "habsys.de" "www.habsys.de" "habsys.eu" "www.habsys.eu" ]) (servePage [ "habsys.de" "www.habsys.de" "habsys.eu" "www.habsys.eu" ]) - (ssl [ "goldbarrendiebstahl.radical-dreamers.de" ]) (serveWordpress [ "goldbarrendiebstahl.radical-dreamers.de" ]) ]; diff --git a/lass/2configs/xserver/default.nix b/lass/2configs/xserver/default.nix index 53c8f9444..cba4db766 100644 --- a/lass/2configs/xserver/default.nix +++ b/lass/2configs/xserver/default.nix @@ -2,6 +2,24 @@ with import <stockholm/lib>; let user = config.krebs.build.user; + + copyqConfig = pkgs.writeDash "copyq-config" '' + ${pkgs.copyq}/bin/copyq config check_clipboard true + ${pkgs.copyq}/bin/copyq config check_selection true + ${pkgs.copyq}/bin/copyq config copy_clipboard true + ${pkgs.copyq}/bin/copyq config copy_selection true + + ${pkgs.copyq}/bin/copyq config activate_closes true + ${pkgs.copyq}/bin/copyq config clipboard_notification_lines 0 + ${pkgs.copyq}/bin/copyq config clipboard_tab &clipboard + ${pkgs.copyq}/bin/copyq config disable_tray true + ${pkgs.copyq}/bin/copyq config hide_tabs true + ${pkgs.copyq}/bin/copyq config hide_toolbar true + ${pkgs.copyq}/bin/copyq config item_popup_interval true + ${pkgs.copyq}/bin/copyq config maxitems 1000 + ${pkgs.copyq}/bin/copyq config move true + ${pkgs.copyq}/bin/copyq config text_wrap true + ''; in { environment.systemPackages = [ @@ -109,4 +127,21 @@ in { User = user.name; }; }; + + systemd.services.copyq = { + wantedBy = [ "multi-user.target" ]; + requires = [ "xserver.service" ]; + environment = { + DISPLAY = ":${toString config.services.xserver.display}"; + }; + serviceConfig = { + SyslogIdentifier = "copyq"; + ExecStart = "${pkgs.copyq}/bin/copyq"; + ExecStartPost = copyqConfig; + Restart = "always"; + RestartSec = "2s"; + StartLimitBurst = 0; + User = user.name; + }; + }; } diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix index b169fea40..2bf2df8b3 100644 --- a/lass/3modules/default.nix +++ b/lass/3modules/default.nix @@ -9,5 +9,7 @@ _: ./urxvtd.nix ./usershadow.nix ./xresources.nix + ./kapacitor.nix + ./telegraf.nix ]; } diff --git a/lass/3modules/kapacitor.nix b/lass/3modules/kapacitor.nix new file mode 100644 index 000000000..023801987 --- /dev/null +++ b/lass/3modules/kapacitor.nix @@ -0,0 +1,101 @@ +{ config, lib, pkgs, ... }: + +with builtins; +with lib; + +let + cfg = config.lass.kapacitor; + + out = { + options.lass.kapacitor = api; + config = mkIf cfg.enable imp; + }; + + api = { + enable = mkEnableOption "kapacitor"; + dataDir = mkOption { + type = types.str; + default = "/var/lib/kapacitor"; + }; + user = mkOption { + type = types.str; + default = "kapacitor"; + }; + config = mkOption { + type = types.str; + #TODO: find a good default + default = '' + hostname = "localhost" + data_dir = "/home/lass/.kapacitor" + + [http] + bind-address = ":9092" + auth-enabled = false + log-enabled = true + write-tracing = false + pprof-enabled = false + https-enabled = false + https-certificate = "/etc/ssl/kapacitor.pem" + shutdown-timeout = "10s" + shared-secret = "" + + [replay] + dir = "${cfg.dataDir}/replay" + + [storage] + boltdb = "${cfg.dataDir}/kapacitor.db" + + [task] + dir = "${cfg.dataDir}/tasks" + snapshot-interval = "1m0s" + + [[influxdb]] + enabled = true + name = "default" + default = false + urls = ["http://localhost:8086"] + username = "" + password = "" + ssl-ca = "" + ssl-cert = "" + ssl-key = "" + insecure-skip-verify = false + timeout = "0s" + disable-subscriptions = false + subscription-protocol = "http" + udp-bind = "" + udp-buffer = 1000 + udp-read-buffer = 0 + startup-timeout = "5m0s" + subscriptions-sync-interval = "1m0s" + [influxdb.subscriptions] + [influxdb.excluded-subscriptions] + _kapacitor = ["autogen"] + + [logging] + file = "STDERR" + level = "INFO" + ''; + description = "configuration kapacitor is started with"; + }; + }; + + configFile = pkgs.writeText "kapacitor.conf" cfg.config; + + imp = { + + systemd.services.kapacitor = { + description = "kapacitor"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + + restartIfChanged = true; + + serviceConfig = { + Restart = "always"; + ExecStart = "${pkgs.kapacitor}/bin/kapacitord -config ${configFile}"; + }; + }; + }; + +in out diff --git a/lass/3modules/telegraf.nix b/lass/3modules/telegraf.nix new file mode 100644 index 000000000..64b323460 --- /dev/null +++ b/lass/3modules/telegraf.nix @@ -0,0 +1,67 @@ +{ config, lib, pkgs, ... }: + +with builtins; +with lib; + +let + cfg = config.lass.telegraf; + + out = { + options.lass.telegraf = api; + config = mkIf cfg.enable imp; + }; + + api = { + enable = mkEnableOption "telegraf"; + dataDir = mkOption { + type = types.str; + default = "/var/lib/telegraf"; + }; + user = mkOption { + type = types.str; + default = "telegraf"; + }; + config = mkOption { + type = types.str; + #TODO: find a good default + default = '' + [agent] + interval = "1s" + + [outputs] + + # Configuration to send data to InfluxDB. + [outputs.influxdb] + urls = ["http://localhost:8086"] + database = "kapacitor_example" + user_agent = "telegraf" + + # Collect metrics about cpu usage + [cpu] + percpu = false + totalcpu = true + drop = ["cpu_time"] + ''; + description = "configuration telegraf is started with"; + }; + }; + + configFile = pkgs.writeText "telegraf.conf" cfg.config; + + imp = { + + systemd.services.telegraf = { + description = "telegraf"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + + restartIfChanged = true; + + serviceConfig = { + Restart = "always"; + ExecStart = "${pkgs.telegraf}/bin/telegraf -config ${configFile}"; + }; + }; + }; + +in out diff --git a/lass/5pkgs/xmonad-lass.nix b/lass/5pkgs/xmonad-lass.nix index ec3ad82af..debcf97a5 100644 --- a/lass/5pkgs/xmonad-lass.nix +++ b/lass/5pkgs/xmonad-lass.nix @@ -114,10 +114,10 @@ myKeyMap = [ ("M4-<F11>", spawn "${pkgs.i3lock}/bin/i3lock -i /var/lib/wallpaper/wallpaper -f") , ("M4-C-p", spawn "${pkgs.scrot}/bin/scrot ~/public_html/scrot.png") , ("M4-p", spawn "${pkgs.pass}/bin/passmenu --type") - , ("<XF86AudioRaiseVolume>", spawn "${pkgs.pulseaudioLight.out}/bin/pactl -- set-sink-volume 0 +4%") - , ("<XF86AudioLowerVolume>", spawn "${pkgs.pulseaudioLight.out}/bin/pactl -- set-sink-volume 0 -4%") - , ("<XF86AudioMute>", spawn "${pkgs.pulseaudioLight.out}/bin/pactl -- set-sink-mute 0 toggle") - , ("<XF86AudioMicMute>", spawn "${pkgs.pulseaudioLight.out}/bin/pactl -- set-source-mute 1 toggle") + , ("<XF86AudioRaiseVolume>", spawn "${pkgs.pulseaudioLight.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ +4%") + , ("<XF86AudioLowerVolume>", spawn "${pkgs.pulseaudioLight.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ -4%") + , ("<XF86MonBrightnessDown>", spawn "${pkgs.xorg.xbacklight}/bin/xbacklight -dec 10%") + , ("<XF86MonBrightnessUp>", spawn "${pkgs.xorg.xbacklight}/bin/xbacklight -inc 10") , ("<XF86Launch1>", gridselectWorkspace gridConfig W.view) , ("M4-C-k", spawn "${pkgs.xorg.xkill}/bin/xkill") @@ -144,6 +144,8 @@ myKeyMap = , ("M4-C-q", windowPromptBringCopy infixAutoXPConfig) , ("M4-S-q", return ()) + + , ("M4-w", floatNext True >> spawn "${pkgs.copyq}/bin/copyq show") ] forkFile :: FilePath -> [String] -> Maybe [(String, String)] -> X () |