12 files changed, 199 insertions, 12 deletions
diff --git a/lass/1systems/echelon/config.nix b/lass/1systems/echelon/config.nix
new file mode 100644
index 000000000..9e72916b3
--- /dev/null
+++ b/lass/1systems/echelon/config.nix
@@ -0,0 +1,14 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    <stockholm/lass>
+
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/tor-initrd.nix>
+  ];
+
+  krebs.build.host = config.krebs.hosts.echelon;
+
+  boot.tmpOnTmpfs = true;
+}
+
diff --git a/lass/1systems/echelon/physical.nix b/lass/1systems/echelon/physical.nix
new file mode 100644
index 000000000..fbacc3927
--- /dev/null
+++ b/lass/1systems/echelon/physical.nix
@@ -0,0 +1,33 @@
+{ config, lib, pkgs, modulesPath, ... }:
+{
+  imports = [
+    ./config.nix
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  # Use the GRUB 2 boot loader.
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.efiSupport = true;
+  boot.loader.grub.efiInstallAsRemovable = true;
+  # Define on which hard drive you want to install Grub.
+  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.initrd.luks.devices.luksroot.device = "/dev/sda3";
+
+  networking.useDHCP = false;
+  networking.interfaces.ens18.useDHCP = true;
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/5186edb1-9234-48ae-8679-61facb56b818";
+    fsType = "xfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/56D1-34A0";
+    fsType = "vfat";
+  };
+
+}
diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index 6f61ea57e..25d688696 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -194,6 +194,7 @@ with import <stockholm/lib>;
     }
     <stockholm/lass/2configs/minecraft.nix>
     <stockholm/lass/2configs/codimd.nix>
+    <stockholm/lass/2configs/searx.nix>
     {
       services.taskserver = {
         enable = true;
diff --git a/lass/2configs/fetchWallpaper.nix b/lass/2configs/fetchWallpaper.nix
index 065ee9c42..251f886a9 100644
--- a/lass/2configs/fetchWallpaper.nix
+++ b/lass/2configs/fetchWallpaper.nix
@@ -5,8 +5,7 @@ let
 in {
   krebs.fetchWallpaper = {
     enable = true;
-    unitConfig.ConditionPathExists = "!/var/run/ppp0.pid";
-    url = "prism/realwallpaper-krebs.png";
+    url = "prism/realwallpaper-krebs-stars.png";
   };
 }
 
diff --git a/lass/2configs/hass/default.nix b/lass/2configs/hass/default.nix
index 7765db84e..be9c32809 100644
--- a/lass/2configs/hass/default.nix
+++ b/lass/2configs/hass/default.nix
@@ -43,11 +43,9 @@ in {
 
   services.home-assistant = {
     enable = true;
-    package = (unstable.home-assistant.overrideAttrs (old: {
+    package = unstable.home-assistant.overrideAttrs (old: {
       doInstallCheck = false;
-    })).override {
-      extraPackages = _: [ dwdwfsapi ];
-    };
+    });
     configWritable = true;
     lovelaceConfigWritable = true;
     config = let
diff --git a/lass/2configs/realwallpaper.nix b/lass/2configs/realwallpaper.nix
index 7a2f6e916..0bae91d89 100644
--- a/lass/2configs/realwallpaper.nix
+++ b/lass/2configs/realwallpaper.nix
@@ -28,6 +28,12 @@ in {
     locations."/realwallpaper-krebs.png".extraConfig = ''
       root /var/realwallpaper/;
     '';
+    locations."/realwallpaper-krebs-stars.png".extraConfig = ''
+      root /var/realwallpaper/;
+    '';
+    locations."/realwallpaper-krebs-stars-berlin.png".extraConfig = ''
+      root /var/realwallpaper/;
+    '';
     locations."/realwallpaper-video.mp4".extraConfig = ''
       root /var/realwallpaper/archive;
     '';
diff --git a/lass/2configs/searx.nix b/lass/2configs/searx.nix
new file mode 100644
index 000000000..ed6586a26
--- /dev/null
+++ b/lass/2configs/searx.nix
@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+let
+  port = 8889;
+in {
+  services.nginx.virtualHosts.search = {
+    serverAliases = [ "search.r" ];
+    locations."/".extraConfig = ''
+      proxy_set_header Host $host;
+      proxy_pass http://127.0.0.1:${builtins.toString port};
+    '';
+  };
+
+  services.searx = {
+    enable = true;
+    configFile = pkgs.writeText "searx.cfg" (builtins.toJSON {
+      use_default_settings = true;
+      server = {
+        port = port;
+        secret_key = builtins.readFile <secrets/searx.key>;
+      };
+    });
+  };
+}
diff --git a/lass/2configs/syncthing.nix b/lass/2configs/syncthing.nix
index 7801c758c..7b8850681 100644
--- a/lass/2configs/syncthing.nix
+++ b/lass/2configs/syncthing.nix
@@ -3,10 +3,6 @@
   imports = [ <stockholm/krebs/2configs/syncthing.nix> ];
   services.syncthing = {
     group = "syncthing";
-    declarative = {
-      key = toString <secrets/syncthing.key>;
-      cert = toString <secrets/syncthing.cert>;
-    };
   };
   krebs.iptables.tables.filter.INPUT.rules = [
     { predicate = "-p tcp --dport 22000"; target = "ACCEPT";}
@@ -16,6 +12,4 @@
   system.activationScripts.syncthing-home = mkDefault ''
     ${pkgs.coreutils}/bin/chmod a+x /home/lass
   '';
-
-  boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
 }
diff --git a/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key b/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/lass/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key
diff --git a/lass/2configs/tests/dummy-secrets/searx.key b/lass/2configs/tests/dummy-secrets/searx.key
new file mode 100644
index 000000000..bd88e01cd
--- /dev/null
+++ b/lass/2configs/tests/dummy-secrets/searx.key
@@ -0,0 +1 @@
+yolo
diff --git a/lass/2configs/tor-initrd.nix b/lass/2configs/tor-initrd.nix
new file mode 100644
index 000000000..64e64b5b3
--- /dev/null
+++ b/lass/2configs/tor-initrd.nix
@@ -0,0 +1,49 @@
+{config, pkgs, ... }:
+## unlock command:
+# (pass admin/$host/root;echo) | torify ssh root@$(pass hosts/$host/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
+{
+  boot.initrd.network.enable = true;
+  boot.initrd.network.ssh = {
+    enable = true;
+    port = 22;
+    authorizedKeys = [
+      config.krebs.users.lass.pubkey
+      config.krebs.users.lass-mors.pubkey
+      config.krebs.users.lass-green.pubkey
+    ];
+    hostKeys = [ <secrets/initrd/ssh.ed25519_key> ];
+  };
+  boot.initrd.availableKernelModules = [ "e1000e" ];
+
+  boot.initrd.secrets = {
+    "/etc/tor/onion/bootup" = <secrets/initrd>;
+  };
+
+  boot.initrd.extraUtilsCommands = ''
+    copy_bin_and_libs ${pkgs.tor}/bin/tor
+  '';
+
+  # start tor during boot process
+  boot.initrd.network.postCommands = let
+    torRc = (pkgs.writeText "tor.rc" ''
+      DataDirectory /etc/tor
+      SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+      SOCKSPort 127.0.0.1:9063
+      HiddenServiceDir /etc/tor/onion/bootup
+      HiddenServicePort 22 127.0.0.1:22
+    '');
+  in ''
+    echo "tor: preparing onion folder"
+    # have to do this otherwise tor does not want to start
+    chmod -R 700 /etc/tor
+
+    echo "make sure localhost is up"
+    ip a a 127.0.0.1/8 dev lo
+    ip link set lo up
+
+    echo "tor: starting tor"
+    tor -f ${torRc} --verify-config
+    tor -f ${torRc} &
+  '';
+}
+
diff --git a/lass/5pkgs/searx/default.nix b/lass/5pkgs/searx/default.nix
new file mode 100644
index 000000000..e5ce5788a
--- /dev/null
+++ b/lass/5pkgs/searx/default.nix
@@ -0,0 +1,69 @@
+{ lib, nixosTests, python3, python3Packages, fetchFromGitHub, fetchpatch }:
+
+with python3Packages;
+
+toPythonModule (buildPythonApplication rec {
+  pname = "searx";
+  version = "1.0.0";
+
+  # Can not use PyPI because certain test files are missing.
+  src = fetchFromGitHub {
+    owner = "searx";
+    repo = "searx";
+    rev = "v${version}";
+    sha256 = "0ghkx8g8jnh8yd46p4mlbjn2zm12nx27v7qflr4c8xhlgi0px0mh";
+  };
+
+  postPatch = ''
+    sed -i 's/==.*$//' requirements.txt
+  '';
+
+  preBuild = ''
+    export SEARX_DEBUG="true";
+  '';
+
+  propagatedBuildInputs = [
+    Babel
+    certifi
+    dateutil
+    flask
+    flaskbabel
+    gevent
+    grequests
+    jinja2
+    langdetect
+    lxml
+    ndg-httpsclient
+    pyasn1
+    pyasn1-modules
+    pygments
+    pysocks
+    pytz
+    pyyaml
+    requests
+    speaklater
+    werkzeug
+  ];
+
+  # tests try to connect to network
+  doCheck = false;
+  # checkInputs = [
+  #   Babel mock nose2 covCore pep8 plone-testing splinter
+  #   unittest2 zope_testrunner selenium
+  # ];
+
+  postInstall = ''
+    # Create a symlink for easier access to static data
+    mkdir -p $out/share
+    ln -s ../${python3.sitePackages}/searx/static $out/share/
+  '';
+
+  passthru.tests = { inherit (nixosTests) searx; };
+
+  meta = with lib; {
+    homepage = "https://github.com/searx/searx";
+    description = "A privacy-respecting, hackable metasearch engine";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ matejc fpletz globin danielfullmer ];
+  };
+})