diff options
Diffstat (limited to 'lass')
-rw-r--r-- | lass/1systems/cloudkrebs.nix | 19 | ||||
-rw-r--r-- | lass/1systems/echelon.nix | 1 | ||||
-rw-r--r-- | lass/1systems/mors.nix | 15 | ||||
-rw-r--r-- | lass/1systems/uriel.nix | 81 | ||||
-rw-r--r-- | lass/2configs/base.nix | 12 | ||||
-rw-r--r-- | lass/2configs/browsers.nix | 38 | ||||
-rw-r--r-- | lass/2configs/desktop-base.nix | 2 | ||||
-rw-r--r-- | lass/2configs/downloading.nix | 3 | ||||
-rw-r--r-- | lass/2configs/fastpoke-pages.nix | 6 | ||||
-rw-r--r-- | lass/2configs/mors/repos.nix | 87 | ||||
-rw-r--r-- | lass/2configs/new-repos.nix | 1 | ||||
-rw-r--r-- | lass/2configs/privoxy-retiolum.nix | 21 | ||||
-rw-r--r-- | lass/2configs/privoxy.nix | 15 | ||||
-rw-r--r-- | lass/2configs/realwallpaper-server.nix | 32 | ||||
-rw-r--r-- | lass/2configs/realwallpaper.nix | 9 | ||||
-rw-r--r-- | lass/2configs/retiolum.nix | 5 | ||||
-rw-r--r-- | lass/2configs/steam.nix | 4 | ||||
-rw-r--r-- | lass/2configs/virtualbox.nix | 2 | ||||
-rw-r--r-- | lass/2configs/weechat.nix | 22 | ||||
-rw-r--r-- | lass/2configs/wordpress.nix | 4 | ||||
-rw-r--r-- | lass/3modules/default.nix | 2 | ||||
-rw-r--r-- | lass/3modules/iptables.nix | 187 | ||||
-rw-r--r-- | lass/3modules/realwallpaper.nix | 102 | ||||
-rw-r--r-- | lass/5pkgs/default.nix | 1 | ||||
-rw-r--r-- | lass/5pkgs/realwallpaper.nix | 28 |
25 files changed, 292 insertions, 407 deletions
diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs.nix index 5235c25e..2a6a70ff 100644 --- a/lass/1systems/cloudkrebs.nix +++ b/lass/1systems/cloudkrebs.nix @@ -1,6 +1,12 @@ -{ config, pkgs, ... }: +{ config, lib, pkgs, ... }: -{ +let + inherit (import ../4lib { inherit pkgs lib; }) getDefaultGateway; + inherit (lib) head; + + ip = (head config.krebs.build.host.nets.internet.addrs4); + r_ip = (head config.krebs.build.host.nets.retiolum.addrs4); +in { imports = [ ../../tv/2configs/CAC-Developer-2.nix ../../tv/2configs/CAC-CentOS-7-64bit.nix @@ -8,14 +14,15 @@ ../2configs/retiolum.nix ../2configs/fastpoke-pages.nix ../2configs/new-repos.nix + ../2configs/realwallpaper.nix { networking.interfaces.enp2s1.ip4 = [ { - address = "104.167.113.104"; + address = ip; prefixLength = 24; } ]; - networking.defaultGateway = "104.167.113.1"; + networking.defaultGateway = getDefaultGateway ip; networking.nameservers = [ "8.8.8.8" ]; @@ -40,4 +47,8 @@ networking.hostName = "cloudkrebs"; + environment.systemPackages = [ + pkgs.dic + ]; + } diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix index d1a3f34f..782674cb 100644 --- a/lass/1systems/echelon.nix +++ b/lass/1systems/echelon.nix @@ -11,6 +11,7 @@ in { ../../tv/2configs/CAC-CentOS-7-64bit.nix ../2configs/base.nix ../2configs/retiolum.nix + ../2configs/realwallpaper.nix { networking.interfaces.enp2s1.ip4 = [ { diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix index b7291a8f..414afcbb 100644 --- a/lass/1systems/mors.nix +++ b/lass/1systems/mors.nix @@ -23,6 +23,7 @@ ../2configs/wordpress.nix ../2configs/bitlbee.nix ../2configs/firefoxPatched.nix + ../2configs/realwallpaper.nix ]; krebs.build = { @@ -174,7 +175,9 @@ environment.systemPackages = with pkgs; [ cac + sshpass get + genid ]; #TODO: fix this shit @@ -195,21 +198,11 @@ }; }; - networking.firewall = { - allowPing = true; - allowedTCPPorts = [ - 8000 - ]; - allowedUDPPorts = [ - 67 - ]; - }; - services.mongodb = { enable = true; }; - lass.iptables = { + krebs.iptables = { tables = { filter.INPUT.rules = [ { predicate = "-p tcp --dport 8000"; target = "ACCEPT"; precedence = 9001; } diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix index 9d96e781..bd3770b4 100644 --- a/lass/1systems/uriel.nix +++ b/lass/1systems/uriel.nix @@ -12,6 +12,8 @@ with builtins; ../2configs/new-repos.nix ../2configs/chromium-patched.nix ../2configs/retiolum.nix + ../2configs/bitlbee.nix + ../2configs/weechat.nix { users.extraUsers = { root = { @@ -82,9 +84,6 @@ with builtins; SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:b8:c8:2e", NAME="et0" ''; - #services.xserver = { - #}; - services.xserver.synaptics = { enable = true; twoFingerScroll = true; @@ -101,80 +100,4 @@ with builtins; #for google hangout users.extraUsers.google.extraGroups = [ "audio" "video" ]; - - - #users.extraGroups = { - # loot = { - # members = [ - # "lass" - # "firefox" - # "chromium" - # "google" - # ]; - # }; - #}; - # - # iptables - # - #networking.firewall.enable = false; - #system.activationScripts.iptables = - # let - # log = false; - # when = c: f: if c then f else ""; - # in - # '' - # ip4tables() { ${pkgs.iptables}/sbin/iptables "$@"; } - # ip6tables() { ${pkgs.iptables}/sbin/ip6tables "$@"; } - # ipXtables() { ip4tables "$@"; ip6tables "$@"; } - - # # - # # nat - # # - - # # reset tables - # ipXtables -t nat -F - # ipXtables -t nat -X - - # # - # #ipXtables -t nat -A PREROUTING -j REDIRECT ! -i retiolum -p tcp --dport ssh --to-ports 0 - # ipXtables -t nat -A PREROUTING -j REDIRECT -p tcp --dport 11423 --to-ports ssh - - # # - # # filter - # # - - # # reset tables - # ipXtables -P INPUT DROP - # ipXtables -P FORWARD DROP - # ipXtables -F - # ipXtables -X - - # # create custom chains - # ipXtables -N Retiolum - - # # INPUT - # ipXtables -A INPUT -j ACCEPT -m conntrack --ctstate RELATED,ESTABLISHED - # ipXtables -A INPUT -j ACCEPT -i lo - # ipXtables -A INPUT -j ACCEPT -p tcp --dport ssh -m conntrack --ctstate NEW - # ipXtables -A INPUT -j ACCEPT -p tcp --dport http -m conntrack --ctstate NEW - # ipXtables -A INPUT -j ACCEPT -p tcp --dport tinc -m conntrack --ctstate NEW - # ipXtables -A INPUT -j Retiolum -i retiolum - # ${when log "ipXtables -A INPUT -j LOG --log-level info --log-prefix 'INPUT DROP '"} - - # # FORWARD - # ${when log "ipXtables -A FORWARD -j LOG --log-level info --log-prefix 'FORWARD DROP '"} - - # # Retiolum - # ip4tables -A Retiolum -j ACCEPT -p icmp --icmp-type echo-request - # ip6tables -A Retiolum -j ACCEPT -p ipv6-icmp -m icmp6 --icmpv6-type echo-request - - - # ${when log "ipXtables -A Retiolum -j LOG --log-level info --log-prefix 'REJECT '"} - # ipXtables -A Retiolum -j REJECT -p tcp --reject-with tcp-reset - # ip4tables -A Retiolum -j REJECT -p udp --reject-with icmp-port-unreachable - # ip4tables -A Retiolum -j REJECT --reject-with icmp-proto-unreachable - # ip6tables -A Retiolum -j REJECT -p udp --reject-with icmp6-port-unreachable - # ip6tables -A Retiolum -j REJECT - - # ''; } diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix index 46435649..43c4f4e3 100644 --- a/lass/2configs/base.nix +++ b/lass/2configs/base.nix @@ -3,14 +3,13 @@ with lib; { imports = [ - ../3modules/iptables.nix ../2configs/vim.nix ../2configs/zsh.nix ../2configs/mc.nix { users.extraUsers = mapAttrs (_: h: { hashedPassword = h; }) - (import /root/src/secrets/hashedPasswords.nix); + (import /root/secrets/hashedPasswords.nix); } { users.extraUsers = { @@ -45,7 +44,7 @@ with lib; build.source = { git.nixpkgs = { url = https://github.com/Lassulus/nixpkgs; - rev = "68bd8e4a9dc247726ae89cc8739574261718e328"; + rev = "e916273209560b302ab231606babf5ce1c481f08"; }; }; }; @@ -71,7 +70,12 @@ with lib; ''; environment.systemPackages = with pkgs; [ + #stockholm git + jq + parallel + + #style most rxvt_unicode.terminfo @@ -137,7 +141,7 @@ with lib; RuntimeMaxUse=128M ''; - lass.iptables = { + krebs.iptables = { enable = true; tables = { filter.INPUT.policy = "DROP"; diff --git a/lass/2configs/browsers.nix b/lass/2configs/browsers.nix index f37dace2..5a185797 100644 --- a/lass/2configs/browsers.nix +++ b/lass/2configs/browsers.nix @@ -6,14 +6,12 @@ let mainUser = config.users.extraUsers.mainUser; createChromiumUser = name: extraGroups: packages: { - users.extraUsers = { - ${name} = { - inherit name; - inherit extraGroups; - home = "/home/${name}"; - useDefaultShell = true; - createHome = true; - }; + users.extraUsers.${name} = { + inherit name; + inherit extraGroups; + home = "/home/${name}"; + useDefaultShell = true; + createHome = true; }; lass.per-user.${name}.packages = packages; security.sudo.extraConfig = '' @@ -28,14 +26,12 @@ let createFirefoxUser = name: extraGroups: packages: { - users.extraUsers = { - ${name} = { - inherit name; - inherit extraGroups; - home = "/home/${name}"; - useDefaultShell = true; - createHome = true; - }; + users.extraUsers.${name} = { + inherit name; + inherit extraGroups; + home = "/home/${name}"; + useDefaultShell = true; + createHome = true; }; lass.per-user.${name}.packages = packages; security.sudo.extraConfig = '' @@ -66,16 +62,16 @@ in { ( createChromiumUser "cr" [ "audio" ] [ pkgs.chromium ] ) ( createChromiumUser "fb" [ ] [ pkgs.chromium ] ) ( createChromiumUser "gm" [ ] [ pkgs.chromium ] ) - ( createChromiumUser "flash" [ ] [ pkgs.flash ] ) + # ( createChromiumUser "flash" [ ] [ pkgs.flash ] ) ]; nixpkgs.config.packageOverrides = pkgs : { flash = pkgs.chromium.override { - pulseSupport = true; + # pulseSupport = true; enablePepperFlash = true; }; - chromium = pkgs.chromium.override { - pulseSupport = true; - }; + #chromium = pkgs.chromium.override { + # pulseSupport = true; + #}; }; } diff --git a/lass/2configs/desktop-base.nix b/lass/2configs/desktop-base.nix index 8ae768ca..ed84edef 100644 --- a/lass/2configs/desktop-base.nix +++ b/lass/2configs/desktop-base.nix @@ -34,6 +34,8 @@ in { haskellPackages.yeganesh dmenu2 xlibs.fontschumachermisc + + sxiv ]; fonts.fonts = [ diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix index e6d31a6c..5052da5c 100644 --- a/lass/2configs/downloading.nix +++ b/lass/2configs/downloading.nix @@ -2,7 +2,6 @@ { imports = [ - ../3modules/iptables.nix ../3modules/folderPerms.nix ]; @@ -47,7 +46,7 @@ }; }; - lass.iptables = { + krebs.iptables = { enable = true; tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } diff --git a/lass/2configs/fastpoke-pages.nix b/lass/2configs/fastpoke-pages.nix index 1c8106a8..0470865b 100644 --- a/lass/2configs/fastpoke-pages.nix +++ b/lass/2configs/fastpoke-pages.nix @@ -29,9 +29,7 @@ let }; in { - imports = [ - ../3modules/iptables.nix - ] ++ map createStaticPage [ + imports = map createStaticPage [ "habsys.de" "pixelpocket.de" "karlaskop.de" @@ -39,7 +37,7 @@ in { "apanowicz.de" ]; - lass.iptables = { + krebs.iptables = { tables = { filter.INPUT.rules = [ { predicate = "-p tcp --dport http"; target = "ACCEPT"; } diff --git a/lass/2configs/mors/repos.nix b/lass/2configs/mors/repos.nix deleted file mode 100644 index 1f7f3345..00000000 --- a/lass/2configs/mors/repos.nix +++ /dev/null @@ -1,87 +0,0 @@ -{ ... }: - -{ - imports = [ - ../lass/gitolite-base.nix - ../common/krebs-keys.nix - ../common/krebs-repos.nix - ]; - - services.gitolite = { - repos = { - - config = { - users = { - lass = "RW+"; - uriel = "R"; - tv = "R"; - }; - extraConfig = "option hook.post-receive = irc-announce"; - }; - - pass = { - users = { - lass = "RW+"; - uriel = "R"; - }; - }; - - load-env = { - users = { - lass = "RW+"; - uriel = "R"; - tv = "R"; - }; - extraConfig = "option hook.post-receive = irc-announce"; - }; - - emse-drywall = { - users = { - lass = "RW+"; - uriel = "R"; - tv = "R"; - }; - extraConfig = "option hook.post-receive = irc-announce"; - }; - - emse-hsdb = { - users = { - lass = "RW+"; - uriel = "R"; - tv = "R"; - }; - extraConfig = "option hook.post-receive = irc-announce"; - }; - - brain = { - users = { - lass = "RW+"; - }; - extraConfig = "option hook.post-receive = irc-announce"; - #hooks.post-receive = irc-announce; - }; - - painload = { - users = { - lass = "RW+"; - }; - extraConfig = "option hook.post-receive = irc-announce"; - }; - - services = { - users = { - lass = "RW+"; - }; - extraConfig = "option hook.post-receive = irc-announce"; - }; - - xmonad-config = { - users = { - lass = "RW+"; - uriel = "R"; - }; - }; - - }; - }; -} diff --git a/lass/2configs/new-repos.nix b/lass/2configs/new-repos.nix index 026f9a66..3d293d65 100644 --- a/lass/2configs/new-repos.nix +++ b/lass/2configs/new-repos.nix @@ -47,6 +47,7 @@ let nick = config.krebs.build.host.name; channel = "#retiolum"; server = "cd.retiolum"; + verbose = config.krebs.build.host.name == "cloudkrebs"; }; }; }; diff --git a/lass/2configs/privoxy-retiolum.nix b/lass/2configs/privoxy-retiolum.nix new file mode 100644 index 00000000..3a3641ad --- /dev/null +++ b/lass/2configs/privoxy-retiolum.nix @@ -0,0 +1,21 @@ +{ config, lib, ... }: + +let + r_ip = (head config.krebs.build.host.nets.retiolum.addrs4); + inherit (lib) head; + +in { + imports = [ + ./privoxy.nix + ]; + + services.privoxy.listenAddress = "${r_ip}:8118"; + + krebs.iptables = { + tables = { + filter.INPUT.rules = [ + { predicate = "-i retiolum -p tcp --dport 8118"; target = "ACCEPT"; } + ]; + }; + }; +} diff --git a/lass/2configs/privoxy.nix b/lass/2configs/privoxy.nix new file mode 100644 index 00000000..bf5f6e20 --- /dev/null +++ b/lass/2configs/privoxy.nix @@ -0,0 +1,15 @@ +{ config, ... }: + +{ + services.privoxy = { + enable = true; + extraConfig = '' + #use polipo + forward / localhost:8123 + + #route .onion through tor + forward-socks4a .onion localhost:9050 + ''; + }; + services.polipo.enable = true; +} diff --git a/lass/2configs/realwallpaper-server.nix b/lass/2configs/realwallpaper-server.nix new file mode 100644 index 00000000..7340fc7c --- /dev/null +++ b/lass/2configs/realwallpaper-server.nix @@ -0,0 +1,32 @@ +{ config, lib, ... }: + +let + hostname = config.krebs.build.host.name; + inherit (lib) + nameValuePair + ; + +in { + imports = [ + ./realwallpaper.nix + ]; + + krebs.nginx.servers.wallpaper = { + server-names = [ + hostname + ]; + locations = [ + (nameValuePair "/wallpaper.png" '' + root /tmp/; + '') + ]; + }; + + krebs.iptables = { + tables = { + filter.INPUT.rules = [ + { predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; } + ]; + }; + }; +} diff --git a/lass/2configs/realwallpaper.nix b/lass/2configs/realwallpaper.nix new file mode 100644 index 00000000..f1c8861e --- /dev/null +++ b/lass/2configs/realwallpaper.nix @@ -0,0 +1,9 @@ +{ config, ... }: + +{ + imports = [ + ../3modules/realwallpaper.nix + ]; + + lass.realwallpaper.enable = true; +} diff --git a/lass/2configs/retiolum.nix b/lass/2configs/retiolum.nix index d7df1502..7f0bcc5e 100644 --- a/lass/2configs/retiolum.nix +++ b/lass/2configs/retiolum.nix @@ -1,11 +1,8 @@ { ... }: { - imports = [ - ../3modules/iptables.nix - ]; - lass.iptables = { + krebs.iptables = { tables = { filter.INPUT.rules = [ { predicate = "-p tcp --dport smtp"; target = "ACCEPT"; } diff --git a/lass/2configs/steam.nix b/lass/2configs/steam.nix index bd895e15..225ddd30 100644 --- a/lass/2configs/steam.nix +++ b/lass/2configs/steam.nix @@ -16,7 +16,9 @@ environment.systemPackages = with pkgs; [ steam ]; - lass.iptables = { + + #ports for inhome streaming + krebs.iptables = { tables = { filter.INPUT.rules = [ { predicate = "-p tcp --dport 27031"; target = "ACCEPT"; } diff --git a/lass/2configs/virtualbox.nix b/lass/2configs/virtualbox.nix index 9769cd68..f7d19605 100644 --- a/lass/2configs/virtualbox.nix +++ b/lass/2configs/virtualbox.nix @@ -4,6 +4,8 @@ let mainUser = config.users.extraUsers.mainUser; in { + #services.virtualboxHost.enable = true; + virtualisation.virtualbox.host.enable = true; users.extraUsers = { virtual = { diff --git a/lass/2configs/weechat.nix b/lass/2configs/weechat.nix new file mode 100644 index 00000000..cfcc1a2f --- /dev/null +++ b/lass/2configs/weechat.nix @@ -0,0 +1,22 @@ +{ config, lib, pkgs, ... }: + +with lib; +{ + imports = [ + ../3modules/per-user.nix + ]; + + lass.per-user.chat.packages = [ + pkgs.weechat + pkgs.tmux + ]; + + users.extraUsers.chat = { + home = "/home/chat"; + useDefaultShell = true; + createHome = true; + openssh.authorizedKeys.keys = map readFile [ + ../../krebs/Zpubkeys/lass.ssh.pub + ]; + }; +} diff --git a/lass/2configs/wordpress.nix b/lass/2configs/wordpress.nix index 9458deb3..bd59080d 100644 --- a/lass/2configs/wordpress.nix +++ b/lass/2configs/wordpress.nix @@ -8,10 +8,10 @@ config = { imports = [ - ../3modules/iptables.nix + ../../krebs/3modules/iptables.nix ]; - lass.iptables = { + krebs.iptables = { enable = true; tables = { filter.INPUT.policy = "DROP"; diff --git a/lass/3modules/default.nix b/lass/3modules/default.nix index d4e231ec..9b621127 100644 --- a/lass/3modules/default.nix +++ b/lass/3modules/default.nix @@ -3,6 +3,6 @@ _: { imports = [ ./xresources.nix - ./iptables.nix + ./realwallpaper.nix ]; } diff --git a/lass/3modules/iptables.nix b/lass/3modules/iptables.nix deleted file mode 100644 index 8c6ad3fa..00000000 --- a/lass/3modules/iptables.nix +++ /dev/null @@ -1,187 +0,0 @@ -arg@{ config, lib, pkgs, ... }: - -let - inherit (pkgs) writeScript writeText; - - inherit (lib) - concatMapStringsSep - concatStringsSep - attrNames - unique - fold - any - attrValues - catAttrs - filter - flatten - length - hasAttr - mkEnableOption - mkOption - mkIf - types - sort; - - elemIsIn = a: as: - any (x: x == a) as; - - cfg = config.lass.iptables; - - out = { - options.lass.iptables = api; - config = mkIf cfg.enable imp; - }; - - api = { - enable = mkEnableOption "iptables"; - - #tables.filter.INPUT = { - # policy = "DROP"; - # rules = [ - # { predicate = "-i retiolum"; target = "ACCEPT"; priority = -10; } - # ]; - #}; - #new api - tables = mkOption { - type = with types; attrsOf (attrsOf (submodule ({ - options = { - policy = mkOption { - type = str; - default = "-"; - }; - rules = mkOption { - type = nullOr (listOf (submodule ({ - options = { - predicate = mkOption { - type = str; - }; - target = mkOption { - type = str; - }; - precedence = mkOption { - type = int; - default = 0; - }; - }; - }))); - default = null; - }; - }; - }))); - }; - }; - - imp = { - networking.firewall.enable = false; - - systemd.services.lass-iptables = { - description = "lass-iptables"; - wantedBy = [ "network-pre.target" ]; - before = [ "network-pre.target" ]; - after = [ "systemd-modules-load.service" ]; - - path = with pkgs; [ - iptables - ]; - - restartIfChanged = true; - - serviceConfig = { - Type = "simple"; - RemainAfterExit = true; - Restart = "always"; - ExecStart = "@${startScript} lass-iptables_start"; - }; - }; - }; - - #buildTable :: iptablesVersion -> iptablesAttrSet` -> str - #todo: differentiate by iptables-version - buildTables = v: ts: - let - - declareChain = t: cn: - #TODO: find out what to do whit these count numbers - ":${cn} ${t."${cn}".policy} [0:0]"; - - buildChain = tn: cn: - let - sortedRules = sort (a: b: a.precedence > b.precedence) ts."${tn}"."${cn}".rules; - - in - #TODO: double check should be unneccessary, refactor! - if (hasAttr "rules" ts."${tn}"."${cn}") then - if (ts."${tn}"."${cn}".rules == null) then - "" - else - concatMapStringsSep "\n" (rule: "\n-A ${cn} ${rule}") ([] - ++ map (buildRule tn cn) sortedRules - ) - else - "" - ; - - - buildRule = tn: cn: rule: - #target validation test: - assert (elemIsIn rule.target ([ "ACCEPT" "REJECT" "DROP" "QUEUE" "LOG" "RETURN" ] ++ (attrNames ts."${tn}"))); - - #predicate validation test: - #maybe use iptables-test - #TODO: howto exit with evaluation error by shellscript? - #apperantly not possible from nix because evalatution wouldn't be deterministic. - "${rule.predicate} -j ${rule.target}"; - - buildTable = tn: - "*${tn}\n" + - concatStringsSep "\n" ([] - ++ map (declareChain ts."${tn}") (attrNames ts."${tn}") - ) + - #this looks dirty, find a better way to do this (maybe optionalString) - concatStringsSep "" ([] - ++ map (buildChain tn) (attrNames ts."${tn}") - ) + - "\nCOMMIT"; - in - concatStringsSep "\n" ([] - ++ map buildTable (attrNames ts) - ); - -#===== - - rules4 = iptables-version: - let - #TODO: find out good defaults. - tables-defaults = { - nat.PREROUTING.policy = "ACCEPT"; - nat.INPUT.policy = "ACCEPT"; - nat.OUTPUT.policy = "ACCEPT"; - nat.POSTROUTING.policy = "ACCEPT"; - filter.INPUT.policy = "ACCEPT"; - filter.FORWARD.policy = "ACCEPT"; - filter.OUTPUT.policy = "ACCEPT"; - - #if someone specifies any other rules on this chain, the default rules get lost. - #is this wanted beahiviour or a bug? - #TODO: implement abstraction of rules - filter.INPUT.rules = [ - { predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } - ]; - }; - tables = tables-defaults // cfg.tables; - - in - writeText "lass-iptables-rules${toString iptables-version}" '' - ${buildTables iptables-version tables} - ''; - - startScript = writeScript "lass-iptables_start" '' - #! /bin/sh - set -euf - iptables-restore < ${rules4 4} - ip6tables-restore < ${rules4 6} - ''; - -in -out - diff --git a/lass/3modules/realwallpaper.nix b/lass/3modules/realwallpaper.nix new file mode 100644 index 00000000..85dd3523 --- /dev/null +++ b/lass/3modules/realwallpaper.nix @@ -0,0 +1,102 @@ +arg@{ config, lib, pkgs, ... }: + +let + inherit (lib) + mkEnableOption + mkOption + types + mkIf + ; + + lpkgs = import ../5pkgs { inherit pkgs; }; + + cfg = config.lass.realwallpaper; + + out = { + options.lass.realwallpaper = api; + config = mkIf cfg.enable imp; + }; + + api = { + enable = mkEnableOption "realwallpaper"; + + workingDir = mkOption { + type = types.str; + default = "/var/realwallpaper/"; + }; + + nightmap = mkOption { + type = types.str; + default = "http://eoimages.gsfc.nasa.gov/images/imagerecords/55000/55167/earth_lights_lrg.jpg"; + }; + + daymap = mkOption { + type = types.str; + default = "http://www.nnvl.noaa.gov/images/globaldata/SnowIceCover_Daily.png"; + }; + + cloudmap = mkOption { + type = types.str; + default = "http://xplanetclouds.com/free/local/clouds_2048.jpg"; + }; + + outFile = mkOption { + type = types.str; + default = "/tmp/wallpaper.png"; + }; + + timerConfig = mkOption { + type = types.unspecified; + default = { + OnCalendar = "*:0/15"; + }; + }; + + }; + |