25 files changed, 292 insertions, 407 deletions
diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs.nix
index 5235c25e..2a6a70ff 100644
--- a/lass/1systems/cloudkrebs.nix
+++ b/lass/1systems/cloudkrebs.nix
@@ -1,6 +1,12 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
-{
+let
+  inherit (import ../4lib { inherit pkgs lib; }) getDefaultGateway;
+  inherit (lib) head;
+
+  ip = (head config.krebs.build.host.nets.internet.addrs4);
+  r_ip = (head config.krebs.build.host.nets.retiolum.addrs4);
+in {
   imports = [
     ../../tv/2configs/CAC-Developer-2.nix
     ../../tv/2configs/CAC-CentOS-7-64bit.nix
@@ -8,14 +14,15 @@
     ../2configs/retiolum.nix
     ../2configs/fastpoke-pages.nix
     ../2configs/new-repos.nix
+    ../2configs/realwallpaper.nix
     {
       networking.interfaces.enp2s1.ip4 = [
         {
-          address = "104.167.113.104";
+          address = ip;
           prefixLength = 24;
         }
       ];
-      networking.defaultGateway = "104.167.113.1";
+      networking.defaultGateway = getDefaultGateway ip;
       networking.nameservers = [
         "8.8.8.8"
       ];
@@ -40,4 +47,8 @@
 
   networking.hostName = "cloudkrebs";
 
+  environment.systemPackages = [
+    pkgs.dic
+  ];
+
 }
diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix
index d1a3f34f..782674cb 100644
--- a/lass/1systems/echelon.nix
+++ b/lass/1systems/echelon.nix
@@ -11,6 +11,7 @@ in {
     ../../tv/2configs/CAC-CentOS-7-64bit.nix
     ../2configs/base.nix
     ../2configs/retiolum.nix
+    ../2configs/realwallpaper.nix
     {
       networking.interfaces.enp2s1.ip4 = [
         {
diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index b7291a8f..414afcbb 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -23,6 +23,7 @@
     ../2configs/wordpress.nix
     ../2configs/bitlbee.nix
     ../2configs/firefoxPatched.nix
+    ../2configs/realwallpaper.nix
   ];
 
   krebs.build = {
@@ -174,7 +175,9 @@
 
   environment.systemPackages = with pkgs; [
     cac
+    sshpass
     get
+    genid
   ];
 
   #TODO: fix this shit
@@ -195,21 +198,11 @@
     };
   };
 
-  networking.firewall = {
-    allowPing = true;
-    allowedTCPPorts = [
-      8000
-    ];
-    allowedUDPPorts = [
-      67
-    ];
-  };
-
   services.mongodb = {
     enable = true;
   };
 
-  lass.iptables = {
+  krebs.iptables = {
     tables = {
       filter.INPUT.rules = [
         { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; precedence = 9001; }
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index 9d96e781..bd3770b4 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -12,6 +12,8 @@ with builtins;
     ../2configs/new-repos.nix
     ../2configs/chromium-patched.nix
     ../2configs/retiolum.nix
+    ../2configs/bitlbee.nix
+    ../2configs/weechat.nix
     {
       users.extraUsers = {
         root = {
@@ -82,9 +84,6 @@ with builtins;
     SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:b8:c8:2e", NAME="et0"
   '';
 
-  #services.xserver = {
-  #};
-
   services.xserver.synaptics = {
     enable = true;
     twoFingerScroll = true;
@@ -101,80 +100,4 @@ with builtins;
   #for google hangout
 
   users.extraUsers.google.extraGroups = [ "audio" "video" ];
-
-
-  #users.extraGroups = {
-  #  loot = {
-  #    members = [
-  #      "lass"
-  #      "firefox"
-  #      "chromium"
-  #      "google"
-  #    ];
-  #  };
-  #};
-  #
-  # iptables
-  #
-  #networking.firewall.enable = false;
-  #system.activationScripts.iptables =
-  #  let
-  #    log = false;
-  #    when = c: f: if c then f else "";
-  #  in
-  #    ''
-  #      ip4tables() { ${pkgs.iptables}/sbin/iptables "$@"; }
-  #      ip6tables() { ${pkgs.iptables}/sbin/ip6tables "$@"; }
-  #      ipXtables() { ip4tables "$@"; ip6tables "$@"; }
-
-  #      #
-  #      # nat
-  #      #
-
-  #      # reset tables
-  #      ipXtables -t nat -F
-  #      ipXtables -t nat -X
-
-  #      #
-  #      #ipXtables -t nat -A PREROUTING -j REDIRECT ! -i retiolum -p tcp --dport ssh --to-ports 0
-  #      ipXtables -t nat -A PREROUTING -j REDIRECT -p tcp --dport 11423 --to-ports ssh
-
-  #      #
-  #      # filter
-  #      #
-
-  #      # reset tables
-  #      ipXtables -P INPUT DROP
-  #      ipXtables -P FORWARD DROP
-  #      ipXtables -F
-  #      ipXtables -X
-
-  #      # create custom chains
-  #      ipXtables -N Retiolum
-
-  #      # INPUT
-  #      ipXtables -A INPUT -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED
-  #      ipXtables -A INPUT -j ACCEPT -i lo
-  #      ipXtables -A INPUT -j ACCEPT -p tcp --dport ssh -m conntrack --ctstate NEW
-  #      ipXtables -A INPUT -j ACCEPT -p tcp --dport http -m conntrack --ctstate NEW
-  #      ipXtables -A INPUT -j ACCEPT -p tcp --dport tinc -m conntrack --ctstate NEW
-  #      ipXtables -A INPUT -j Retiolum -i retiolum
-  #      ${when log "ipXtables -A INPUT -j LOG --log-level info --log-prefix 'INPUT DROP '"}
-
-  #      # FORWARD
-  #      ${when log "ipXtables -A FORWARD -j LOG --log-level info --log-prefix 'FORWARD DROP '"}
-
-  #      # Retiolum
-  #      ip4tables -A Retiolum -j ACCEPT -p icmp --icmp-type echo-request
-  #      ip6tables -A Retiolum -j ACCEPT -p ipv6-icmp -m icmp6 --icmpv6-type echo-request
-
-
-  #      ${when log "ipXtables -A Retiolum -j LOG --log-level info --log-prefix 'REJECT '"}
-  #      ipXtables -A Retiolum -j REJECT -p tcp --reject-with tcp-reset
-  #      ip4tables -A Retiolum -j REJECT -p udp --reject-with icmp-port-unreachable
-  #      ip4tables -A Retiolum -j REJECT        --reject-with icmp-proto-unreachable
-  #      ip6tables -A Retiolum -j REJECT -p udp --reject-with icmp6-port-unreachable
-  #      ip6tables -A Retiolum -j REJECT
-
-  #    '';
 }
diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 46435649..43c4f4e3 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -3,14 +3,13 @@
 with lib;
 {
   imports = [
-    ../3modules/iptables.nix
     ../2configs/vim.nix
     ../2configs/zsh.nix
     ../2configs/mc.nix
     {
       users.extraUsers =
         mapAttrs (_: h: { hashedPassword = h; })
-                 (import /root/src/secrets/hashedPasswords.nix);
+                 (import /root/secrets/hashedPasswords.nix);
     }
     {
       users.extraUsers = {
@@ -45,7 +44,7 @@ with lib;
     build.source = {
       git.nixpkgs = {
         url = https://github.com/Lassulus/nixpkgs;
-        rev = "68bd8e4a9dc247726ae89cc8739574261718e328";
+        rev = "e916273209560b302ab231606babf5ce1c481f08";
       };
     };
   };
@@ -71,7 +70,12 @@ with lib;
   '';
 
   environment.systemPackages = with pkgs; [
+  #stockholm
     git
+    jq
+    parallel
+
+  #style
     most
     rxvt_unicode.terminfo
 
@@ -137,7 +141,7 @@ with lib;
     RuntimeMaxUse=128M
   '';
 
-  lass.iptables = {
+  krebs.iptables = {
     enable = true;
     tables = {
       filter.INPUT.policy = "DROP";
diff --git a/lass/2configs/browsers.nix b/lass/2configs/browsers.nix
index f37dace2..5a185797 100644
--- a/lass/2configs/browsers.nix
+++ b/lass/2configs/browsers.nix
@@ -6,14 +6,12 @@ let
   mainUser = config.users.extraUsers.mainUser;
   createChromiumUser = name: extraGroups: packages:
     {
-      users.extraUsers = {
-        ${name} = {
-          inherit name;
-          inherit extraGroups;
-          home = "/home/${name}";
-          useDefaultShell = true;
-          createHome = true;
-        };
+      users.extraUsers.${name} = {
+        inherit name;
+        inherit extraGroups;
+        home = "/home/${name}";
+        useDefaultShell = true;
+        createHome = true;
       };
       lass.per-user.${name}.packages = packages;
       security.sudo.extraConfig = ''
@@ -28,14 +26,12 @@ let
 
   createFirefoxUser = name: extraGroups: packages:
     {
-      users.extraUsers = {
-        ${name} = {
-          inherit name;
-          inherit extraGroups;
-          home = "/home/${name}";
-          useDefaultShell = true;
-          createHome = true;
-        };
+      users.extraUsers.${name} = {
+        inherit name;
+        inherit extraGroups;
+        home = "/home/${name}";
+        useDefaultShell = true;
+        createHome = true;
       };
       lass.per-user.${name}.packages = packages;
       security.sudo.extraConfig = ''
@@ -66,16 +62,16 @@ in {
     ( createChromiumUser "cr" [ "audio" ] [ pkgs.chromium ] )
     ( createChromiumUser "fb" [ ] [ pkgs.chromium ] )
     ( createChromiumUser "gm" [ ] [ pkgs.chromium ] )
-    ( createChromiumUser "flash" [ ] [ pkgs.flash ] )
+   # ( createChromiumUser "flash" [ ] [ pkgs.flash ] )
   ];
 
   nixpkgs.config.packageOverrides = pkgs : {
     flash = pkgs.chromium.override {
-      pulseSupport = true;
+    #  pulseSupport = true;
       enablePepperFlash = true;
     };
-    chromium = pkgs.chromium.override {
-      pulseSupport = true;
-    };
+    #chromium = pkgs.chromium.override {
+    #  pulseSupport = true;
+    #};
   };
 }
diff --git a/lass/2configs/desktop-base.nix b/lass/2configs/desktop-base.nix
index 8ae768ca..ed84edef 100644
--- a/lass/2configs/desktop-base.nix
+++ b/lass/2configs/desktop-base.nix
@@ -34,6 +34,8 @@ in {
     haskellPackages.yeganesh
     dmenu2
     xlibs.fontschumachermisc
+
+    sxiv
   ];
 
   fonts.fonts = [
diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix
index e6d31a6c..5052da5c 100644
--- a/lass/2configs/downloading.nix
+++ b/lass/2configs/downloading.nix
@@ -2,7 +2,6 @@
 
 {
   imports = [
-    ../3modules/iptables.nix
     ../3modules/folderPerms.nix
   ];
 
@@ -47,7 +46,7 @@
     };
   };
 
-  lass.iptables = {
+  krebs.iptables = {
     enable = true;
     tables.filter.INPUT.rules = [
       { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; }
diff --git a/lass/2configs/fastpoke-pages.nix b/lass/2configs/fastpoke-pages.nix
index 1c8106a8..0470865b 100644
--- a/lass/2configs/fastpoke-pages.nix
+++ b/lass/2configs/fastpoke-pages.nix
@@ -29,9 +29,7 @@ let
     };
 
 in {
-  imports = [
-    ../3modules/iptables.nix
-  ] ++ map createStaticPage [
+  imports = map createStaticPage [
     "habsys.de"
     "pixelpocket.de"
     "karlaskop.de"
@@ -39,7 +37,7 @@ in {
     "apanowicz.de"
   ];
 
-  lass.iptables = {
+  krebs.iptables = {
     tables = {
       filter.INPUT.rules = [
         { predicate = "-p tcp --dport http"; target = "ACCEPT"; }
diff --git a/lass/2configs/mors/repos.nix b/lass/2configs/mors/repos.nix
deleted file mode 100644
index 1f7f3345..00000000
--- a/lass/2configs/mors/repos.nix
+++ /dev/null
@@ -1,87 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ../lass/gitolite-base.nix
-    ../common/krebs-keys.nix
-    ../common/krebs-repos.nix
-  ];
-
-  services.gitolite = {
-    repos = {
-
-      config = {
-        users = {
-          lass = "RW+";
-          uriel = "R";
-          tv = "R";
-        };
-        extraConfig = "option hook.post-receive = irc-announce";
-      };
-
-      pass = {
-        users = {
-          lass = "RW+";
-          uriel = "R";
-        };
-      };
-
-      load-env = {
-        users = {
-          lass = "RW+";
-          uriel = "R";
-          tv = "R";
-        };
-        extraConfig = "option hook.post-receive = irc-announce";
-      };
-
-      emse-drywall = {
-        users = {
-          lass = "RW+";
-          uriel = "R";
-          tv = "R";
-        };
-        extraConfig = "option hook.post-receive = irc-announce";
-      };
-
-      emse-hsdb = {
-        users = {
-          lass = "RW+";
-          uriel = "R";
-          tv = "R";
-        };
-        extraConfig = "option hook.post-receive = irc-announce";
-      };
-
-      brain = {
-        users = {
-          lass = "RW+";
-        };
-        extraConfig = "option hook.post-receive = irc-announce";
-        #hooks.post-receive = irc-announce;
-      };
-
-      painload = {
-        users = {
-          lass = "RW+";
-        };
-        extraConfig = "option hook.post-receive = irc-announce";
-      };
-
-      services = {
-        users = {
-          lass = "RW+";
-        };
-        extraConfig = "option hook.post-receive = irc-announce";
-      };
-
-      xmonad-config = {
-        users = {
-          lass = "RW+";
-          uriel = "R";
-        };
-      };
-
-    };
-  };
-}
diff --git a/lass/2configs/new-repos.nix b/lass/2configs/new-repos.nix
index 026f9a66..3d293d65 100644
--- a/lass/2configs/new-repos.nix
+++ b/lass/2configs/new-repos.nix
@@ -47,6 +47,7 @@ let
         nick = config.krebs.build.host.name;
         channel = "#retiolum";
         server = "cd.retiolum";
+        verbose = config.krebs.build.host.name == "cloudkrebs";
       };
     };
   };
diff --git a/lass/2configs/privoxy-retiolum.nix b/lass/2configs/privoxy-retiolum.nix
new file mode 100644
index 00000000..3a3641ad
--- /dev/null
+++ b/lass/2configs/privoxy-retiolum.nix
@@ -0,0 +1,21 @@
+{ config, lib, ... }:
+
+let
+  r_ip = (head config.krebs.build.host.nets.retiolum.addrs4);
+  inherit (lib) head;
+
+in {
+  imports = [
+    ./privoxy.nix
+  ];
+
+  services.privoxy.listenAddress = "${r_ip}:8118";
+
+  krebs.iptables = {
+    tables = {
+      filter.INPUT.rules = [
+        { predicate = "-i retiolum -p tcp --dport 8118"; target = "ACCEPT"; }
+      ];
+    };
+  };
+}
diff --git a/lass/2configs/privoxy.nix b/lass/2configs/privoxy.nix
new file mode 100644
index 00000000..bf5f6e20
--- /dev/null
+++ b/lass/2configs/privoxy.nix
@@ -0,0 +1,15 @@
+{ config, ... }:
+
+{
+  services.privoxy = {
+    enable = true;
+    extraConfig = ''
+      #use polipo
+      forward / localhost:8123
+
+      #route .onion through tor
+      forward-socks4a .onion localhost:9050
+    '';
+  };
+  services.polipo.enable = true;
+}
diff --git a/lass/2configs/realwallpaper-server.nix b/lass/2configs/realwallpaper-server.nix
new file mode 100644
index 00000000..7340fc7c
--- /dev/null
+++ b/lass/2configs/realwallpaper-server.nix
@@ -0,0 +1,32 @@
+{ config, lib, ... }:
+
+let
+  hostname = config.krebs.build.host.name;
+  inherit (lib)
+    nameValuePair
+  ;
+
+in {
+  imports = [
+    ./realwallpaper.nix
+  ];
+
+  krebs.nginx.servers.wallpaper = {
+    server-names = [
+      hostname
+    ];
+    locations = [
+      (nameValuePair "/wallpaper.png" ''
+        root /tmp/;
+      '')
+    ];
+  };
+
+  krebs.iptables = {
+    tables = {
+      filter.INPUT.rules = [
+        { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; }
+      ];
+    };
+  };
+}
diff --git a/lass/2configs/realwallpaper.nix b/lass/2configs/realwallpaper.nix
new file mode 100644
index 00000000..f1c8861e
--- /dev/null
+++ b/lass/2configs/realwallpaper.nix
@@ -0,0 +1,9 @@
+{ config, ... }:
+
+{
+  imports = [
+    ../3modules/realwallpaper.nix
+  ];
+
+  lass.realwallpaper.enable = true;
+}
diff --git a/lass/2configs/retiolum.nix b/lass/2configs/retiolum.nix
index d7df1502..7f0bcc5e 100644
--- a/lass/2configs/retiolum.nix
+++ b/lass/2configs/retiolum.nix
@@ -1,11 +1,8 @@
 { ... }:
 
 {
-  imports = [
-    ../3modules/iptables.nix
-  ];
 
-  lass.iptables = {
+  krebs.iptables = {
     tables = {
       filter.INPUT.rules = [
         { predicate = "-p tcp --dport smtp"; target = "ACCEPT"; }
diff --git a/lass/2configs/steam.nix b/lass/2configs/steam.nix
index bd895e15..225ddd30 100644
--- a/lass/2configs/steam.nix
+++ b/lass/2configs/steam.nix
@@ -16,7 +16,9 @@
   environment.systemPackages = with pkgs; [
     steam
   ];
-  lass.iptables = {
+
+  #ports for inhome streaming
+  krebs.iptables = {
     tables = {
       filter.INPUT.rules = [
         { predicate = "-p tcp --dport 27031"; target = "ACCEPT"; }
diff --git a/lass/2configs/virtualbox.nix b/lass/2configs/virtualbox.nix
index 9769cd68..f7d19605 100644
--- a/lass/2configs/virtualbox.nix
+++ b/lass/2configs/virtualbox.nix
@@ -4,6 +4,8 @@ let
   mainUser = config.users.extraUsers.mainUser;
 
 in {
+  #services.virtualboxHost.enable = true;
+  virtualisation.virtualbox.host.enable = true;
 
   users.extraUsers = {
     virtual = {
diff --git a/lass/2configs/weechat.nix b/lass/2configs/weechat.nix
new file mode 100644
index 00000000..cfcc1a2f
--- /dev/null
+++ b/lass/2configs/weechat.nix
@@ -0,0 +1,22 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+{
+  imports = [
+    ../3modules/per-user.nix
+  ];
+
+  lass.per-user.chat.packages = [
+    pkgs.weechat
+    pkgs.tmux
+  ];
+
+  users.extraUsers.chat = {
+    home = "/home/chat";
+    useDefaultShell = true;
+    createHome = true;
+    openssh.authorizedKeys.keys = map readFile [
+      ../../krebs/Zpubkeys/lass.ssh.pub
+    ];
+  };
+}
diff --git a/lass/2configs/wordpress.nix b/lass/2configs/wordpress.nix
index 9458deb3..bd59080d 100644
--- a/lass/2configs/wordpress.nix
+++ b/lass/2configs/wordpress.nix
@@ -8,10 +8,10 @@
 
     config = {
       imports = [
-        ../3modules/iptables.nix
+        ../../krebs/3modules/iptables.nix
       ];
 
-      lass.iptables = {
+      krebs.iptables = {
         enable = true;
         tables = {
           filter.INPUT.policy = "DROP";
diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix
index d4e231ec..9b621127 100644
--- a/lass/3modules/default.nix
+++ b/lass/3modules/default.nix
@@ -3,6 +3,6 @@ _:
 {
   imports = [
     ./xresources.nix
-    ./iptables.nix
+    ./realwallpaper.nix
   ];
 }
diff --git a/lass/3modules/iptables.nix b/lass/3modules/iptables.nix
deleted file mode 100644
index 8c6ad3fa..00000000
--- a/lass/3modules/iptables.nix
+++ /dev/null
@@ -1,187 +0,0 @@
-arg@{ config, lib, pkgs, ... }:
-
-let
-  inherit (pkgs) writeScript writeText;
-
-  inherit (lib)
-    concatMapStringsSep
-    concatStringsSep
-    attrNames
-    unique
-    fold
-    any
-    attrValues
-    catAttrs
-    filter
-    flatten
-    length
-    hasAttr
-    mkEnableOption
-    mkOption
-    mkIf
-    types
-    sort;
-
-  elemIsIn = a: as:
-    any (x: x == a) as;
-
-  cfg = config.lass.iptables;
-
-  out = {
-    options.lass.iptables = api;
-    config = mkIf cfg.enable imp;
-  };
-
-  api = {
-    enable = mkEnableOption "iptables";
-
-    #tables.filter.INPUT = {
-    # policy = "DROP";
-    # rules = [
-    #   { predicate = "-i retiolum"; target = "ACCEPT"; priority = -10; }
-    # ];
-    #};
-    #new api
-    tables = mkOption {
-      type = with types; attrsOf (attrsOf (submodule ({
-        options = {
-          policy = mkOption {
-            type = str;
-            default = "-";
-          };
-          rules = mkOption {
-            type = nullOr (listOf (submodule ({
-              options = {
-                predicate = mkOption {
-                  type = str;
-                };
-                target = mkOption {
-                  type = str;
-                };
-                precedence = mkOption {
-                  type = int;
-                  default = 0;
-                };
-              };
-            })));
-            default = null;
-          };
-        };
-      })));
-    };
-  };
-
-  imp = {
-    networking.firewall.enable = false;
-
-    systemd.services.lass-iptables = {
-      description = "lass-iptables";
-      wantedBy = [ "network-pre.target" ];
-      before = [ "network-pre.target" ];
-      after = [ "systemd-modules-load.service" ];
-
-      path = with pkgs; [
-        iptables
-      ];
-
-      restartIfChanged = true;
-
-      serviceConfig = {
-        Type = "simple";
-        RemainAfterExit = true;
-        Restart = "always";
-        ExecStart = "@${startScript} lass-iptables_start";
-      };
-    };
-  };
-
-  #buildTable :: iptablesVersion -> iptablesAttrSet` -> str
-  #todo: differentiate by iptables-version
-  buildTables = v: ts:
-    let
-
-      declareChain = t: cn:
-        #TODO: find out what to do whit these count numbers
-        ":${cn} ${t."${cn}".policy} [0:0]";
-
-      buildChain = tn: cn:
-        let
-          sortedRules = sort (a: b: a.precedence > b.precedence) ts."${tn}"."${cn}".rules;
-
-        in
-          #TODO: double check should be unneccessary, refactor!
-          if (hasAttr "rules" ts."${tn}"."${cn}") then
-            if (ts."${tn}"."${cn}".rules == null) then
-              ""
-            else
-              concatMapStringsSep "\n" (rule: "\n-A ${cn} ${rule}") ([]
-                ++ map (buildRule tn cn) sortedRules
-              )
-          else
-            ""
-          ;
-
-
-      buildRule = tn: cn: rule:
-        #target validation test:
-        assert (elemIsIn rule.target ([ "ACCEPT" "REJECT" "DROP" "QUEUE" "LOG" "RETURN" ] ++ (attrNames ts."${tn}")));
-
-        #predicate validation test:
-        #maybe use iptables-test
-        #TODO: howto exit with evaluation error by shellscript?
-          #apperantly not possible from nix because evalatution wouldn't be deterministic.
-        "${rule.predicate} -j ${rule.target}";
-
-      buildTable = tn:
-        "*${tn}\n" +
-        concatStringsSep "\n" ([]
-          ++ map (declareChain ts."${tn}") (attrNames ts."${tn}")
-        ) +
-        #this looks dirty, find a better way to do this (maybe optionalString)
-        concatStringsSep "" ([]
-          ++ map (buildChain tn) (attrNames ts."${tn}")
-        ) +
-        "\nCOMMIT";
-    in
-      concatStringsSep "\n" ([]
-        ++ map buildTable (attrNames ts)
-      );
-
-#=====
-
-  rules4 = iptables-version:
-    let
-      #TODO: find out good defaults.
-      tables-defaults = {
-        nat.PREROUTING.policy = "ACCEPT";
-        nat.INPUT.policy = "ACCEPT";
-        nat.OUTPUT.policy = "ACCEPT";
-        nat.POSTROUTING.policy = "ACCEPT";
-        filter.INPUT.policy = "ACCEPT";
-        filter.FORWARD.policy = "ACCEPT";
-        filter.OUTPUT.policy = "ACCEPT";
-
-        #if someone specifies any other rules on this chain, the default rules get lost.
-        #is this wanted beahiviour or a bug?
-        #TODO: implement abstraction of rules
-        filter.INPUT.rules = [
-          { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
-        ];
-      };
-      tables = tables-defaults // cfg.tables;
-
-    in
-      writeText "lass-iptables-rules${toString iptables-version}" ''
-        ${buildTables iptables-version tables}
-      '';
-
-  startScript = writeScript "lass-iptables_start" ''
-    #! /bin/sh
-    set -euf
-    iptables-restore < ${rules4 4}
-    ip6tables-restore < ${rules4 6}
-  '';
-
-in
-out
-
diff --git a/lass/3modules/realwallpaper.nix b/lass/3modules/realwallpaper.nix
new file mode 100644
index 00000000..85dd3523
--- /dev/null
+++ b/lass/3modules/realwallpaper.nix
@@ -0,0 +1,102 @@
+arg@{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    types
+    mkIf
+  ;
+
+  lpkgs = import ../5pkgs { inherit pkgs; };
+
+  cfg = config.lass.realwallpaper;
+
+  out = {
+    options.lass.realwallpaper = api;
+    config = mkIf cfg.enable imp;
+  };
+
+  api = {
+    enable = mkEnableOption "realwallpaper";
+
+    workingDir = mkOption {
+      type = types.str;
+      default = "/var/realwallpaper/";
+    };
+
+    nightmap = mkOption {
+      type = types.str;
+      default = "http://eoimages.gsfc.nasa.gov/images/imagerecords/55000/55167/earth_lights_lrg.jpg";
+    };
+
+    daymap = mkOption {
+      type = types.str;
+      default = "http://www.nnvl.noaa.gov/images/globaldata/SnowIceCover_Daily.png";
+    };
+
+    cloudmap = mkOption {
+      type = types.str;
+      default = "http://xplanetclouds.com/free/local/clouds_2048.jpg";
+    };
+
+    outFile = mkOption {
+      type = types.str;
+      default = "/tmp/wallpaper.png";
+    };
+
+    timerConfig = mkOption {
+      type = types.unspecified;
+      default = {
+        OnCalendar = "*:0/15";
+      };
+    };
+
+  };
+