diff options
Diffstat (limited to 'lass')
| -rw-r--r-- | lass/1systems/mors/config.nix | 11 | ||||
| -rw-r--r-- | lass/2configs/downloading.nix | 1 | ||||
| -rw-r--r-- | lass/2configs/git.nix | 14 | ||||
| -rw-r--r-- | lass/2configs/otp-ssh.nix | 18 | ||||
| -rw-r--r-- | lass/2configs/wine.nix | 3 | ||||
| -rw-r--r-- | lass/source.nix | 2 |
6 files changed, 41 insertions, 8 deletions
diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix index 45b3f740f..29dacf8dc 100644 --- a/lass/1systems/mors/config.nix +++ b/lass/1systems/mors/config.nix @@ -24,6 +24,7 @@ with import <stockholm/lib>; <stockholm/lass/2configs/ircd.nix> <stockholm/lass/2configs/logf.nix> <stockholm/lass/2configs/syncthing.nix> + <stockholm/lass/2configs/otp-ssh.nix> { #risk of rain port krebs.iptables.tables.filter.INPUT.rules = [ @@ -110,11 +111,11 @@ with import <stockholm/lib>; "/boot" = { device = "/dev/sda2"; }; - #"/bku" = { - # device = "/dev/mapper/pool-bku"; - # fsType = "btrfs"; - # options = ["defaults" "noatime" "ssd" "compress=lzo"]; - #}; + "/bku" = { + device = "/dev/mapper/pool-bku"; + fsType = "btrfs"; + options = ["defaults" "noatime" "ssd" "compress=lzo"]; + }; "/home" = { device = "/dev/mapper/pool-home"; fsType = "btrfs"; diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix index d32262810..9582413ed 100644 --- a/lass/2configs/downloading.nix +++ b/lass/2configs/downloading.nix @@ -17,6 +17,7 @@ with import <stockholm/lib>; lass-shodan.pubkey lass-icarus.pubkey makefu.pubkey + wine-mors.pubkey ]; }; diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix index 4137c482e..a66d08927 100644 --- a/lass/2configs/git.nix +++ b/lass/2configs/git.nix @@ -49,6 +49,7 @@ let { brain = { collaborators = with config.krebs.users; [ tv makefu ]; + announce = true; }; } // import <secrets/repos.nix> { inherit config lib pkgs; } @@ -75,9 +76,20 @@ let public = true; }; - make-restricted-repo = name: { collaborators ? [], ... }: { + make-restricted-repo = name: { collaborators ? [], announce ? false, ... }: { inherit collaborators name; public = false; + hooks = optionalAttrs announce { + post-receive = pkgs.git-hooks.irc-announce { + # TODO make nick = config.krebs.build.host.name the default + nick = config.krebs.build.host.name; + channel = "#retiolum"; + server = "ni.r"; + verbose = true; + # TODO define branches in some kind of option per repo + branches = [ "master" "staging*" ]; + }; + }; }; make-rules = diff --git a/lass/2configs/otp-ssh.nix b/lass/2configs/otp-ssh.nix new file mode 100644 index 000000000..f9984e245 --- /dev/null +++ b/lass/2configs/otp-ssh.nix @@ -0,0 +1,18 @@ +{ pkgs, ... }: +# Enables second factor for ssh password login + +## Usage: +# gen-oath-safe <username> totp +## scan the qrcode with google authenticator (or FreeOTP) +## copy last line into secrets/<host>/users.oath (chmod 700) +{ + security.pam.oath = { + # enabling it will make it a requisite of `all` services + # enable = true; + digits = 6; + # TODO assert existing + usersFile = (toString <secrets>) + "/users.oath"; + }; + # I want TFA only active for sshd with password-auth + security.pam.services.sshd.oathAuth = true; +} diff --git a/lass/2configs/wine.nix b/lass/2configs/wine.nix index d4a91e645..2444d32d3 100644 --- a/lass/2configs/wine.nix +++ b/lass/2configs/wine.nix @@ -5,7 +5,8 @@ let in { krebs.per-user.wine.packages = with pkgs; [ - wineUnstable + wineFull + #(wineFull.override { wineBuild = "wine64"; }) ]; users.users= { wine = { diff --git a/lass/source.nix b/lass/source.nix index 836460d07..63adbd95c 100644 --- a/lass/source.nix +++ b/lass/source.nix @@ -19,6 +19,6 @@ in # 87a4615 & 334ac4f # + acme permissions for groups # fd7a8f1 - ref = "67956cc"; + ref = "d486531"; }; } |