summaryrefslogtreecommitdiffstats
path: root/makefu
diff options
context:
space:
mode:
Diffstat (limited to 'makefu')
-rw-r--r--makefu/1systems/pornocauster.nix1
-rw-r--r--makefu/1systems/wry.nix85
-rw-r--r--makefu/2configs/Reaktor/random-emoji.nix1
-rw-r--r--makefu/2configs/Reaktor/random-emoji.sh3
-rw-r--r--makefu/2configs/base-sources.nix6
-rw-r--r--makefu/2configs/bepasty-dual.nix52
-rw-r--r--makefu/2configs/exim-retiolum.nix4
-rw-r--r--makefu/2configs/git/cgit-retiolum.nix3
-rw-r--r--makefu/2configs/iodined.nix16
-rw-r--r--makefu/2configs/mail-client.nix12
-rw-r--r--makefu/2configs/unstable-sources.nix19
-rw-r--r--makefu/3modules/default.nix1
-rw-r--r--makefu/3modules/tinc_graphs.nix133
-rw-r--r--makefu/5pkgs/tinc_graphs/default.nix5
14 files changed, 167 insertions, 174 deletions
diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix
index 8f7f5ea7..97cf86a4 100644
--- a/makefu/1systems/pornocauster.nix
+++ b/makefu/1systems/pornocauster.nix
@@ -21,6 +21,7 @@
# applications
../2configs/exim-retiolum.nix
+ ../2configs/mail-client.nix
#../2configs/virtualization.nix
../2configs/virtualization-virtualbox.nix
../2configs/wwan.nix
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index 819a208a..6627d87b 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -1,47 +1,72 @@
{ config, lib, pkgs, ... }:
+with lib;
let
- ip = (lib.head config.krebs.build.host.nets.internet.addrs4);
+ external-ip = head config.krebs.build.host.nets.internet.addrs4;
+ internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
in {
imports = [
- ../../tv/2configs/CAC-CentOS-7-64bit.nix
- ../2configs/base.nix
- ../2configs/base-sources.nix
- ../2configs/tinc-basic-retiolum.nix
+ # TODO: copy this config or move to krebs
+ ../../tv/2configs/CAC-CentOS-7-64bit.nix
+ ../2configs/base.nix
+ ../2configs/unstable-sources.nix
+ ../2configs/tinc-basic-retiolum.nix
+
+ ../2configs/bepasty-dual.nix
+
+ ../2configs/iodined.nix
+
+ # Reaktor
+ ../2configs/Reaktor/simpleExtend.nix
];
- networking.firewall.allowPing = true;
- networking.interfaces.enp2s1.ip4 = [
- {
- address = ip;
- prefixLength = 24;
- }
- ];
- networking.defaultGateway = "104.233.87.1";
- networking.nameservers = [
- "8.8.8.8"
- ];
+ krebs.build = {
+ user = config.krebs.users.makefu;
+ target = "root@wry";
+ host = config.krebs.hosts.wry;
+ };
- # based on ../../tv/2configs/CAC-Developer-2.nix
- sound.enable = false;
+
+
+ krebs.Reaktor.enable = true;
+
+ # bepasty to listen only on the correct interfaces
+ krebs.bepasty.servers.internal.nginx.listen = [ "${internal-ip}:80" ];
+ krebs.bepasty.servers.external.nginx.listen = [ "${external-ip}:80" "${external-ip}:443 ssl" ];
# prepare graphs
- nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
krebs.nginx.enable = true;
- makefu.tinc_graphs.enable = true;
- makefu.tinc_graphs.krebsNginx = {
+ krebs.retiolum-bootstrap.enable = true;
+
+ nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
+ krebs.tinc_graphs = {
enable = true;
- # TODO: remove hard-coded hostname
- hostnames_complete = [ "graphs.wry" ];
- hostnames_anonymous = [ "graphs.krebsco.de" ];
+ nginx = {
+ enable = true;
+ # TODO: remove hard-coded hostname
+ complete = {
+ listen = [ "${internal-ip}:80" ];
+ server-names = [ "graphs.wry" ];
+ };
+ anonymous = {
+ listen = [ "${external-ip}:80" ] ;
+ server-names = [ "graphs.krebsco.de" ];
+ };
+ };
};
- networking.firewall.allowedTCPPorts = [80];
-
- krebs.build = {
- user = config.krebs.users.makefu;
- target = "root@${ip}";
- host = config.krebs.hosts.wry;
+ networking = {
+ firewall.allowPing = true;
+ firewall.allowedTCPPorts = [ 53 80 443 ];
+ interfaces.enp2s1.ip4 = [{
+ address = external-ip;
+ prefixLength = 24;
+ }];
+ defaultGateway = "104.233.87.1";
+ nameservers = [ "8.8.8.8" ];
};
+
+ # based on ../../tv/2configs/CAC-Developer-2.nix
+ sound.enable = false;
}
diff --git a/makefu/2configs/Reaktor/random-emoji.nix b/makefu/2configs/Reaktor/random-emoji.nix
index b2d99b36..3113a826 100644
--- a/makefu/2configs/Reaktor/random-emoji.nix
+++ b/makefu/2configs/Reaktor/random-emoji.nix
@@ -12,6 +12,7 @@ let
coreutils
gnused
gnugrep
+ xmlstarlet
curl]);
in {
# TODO: make origin a variable, <- module is generic enough to handle different origins, not only stockholm
diff --git a/makefu/2configs/Reaktor/random-emoji.sh b/makefu/2configs/Reaktor/random-emoji.sh
index 913d615b..386aa68b 100644
--- a/makefu/2configs/Reaktor/random-emoji.sh
+++ b/makefu/2configs/Reaktor/random-emoji.sh
@@ -2,4 +2,5 @@
curl http://emojicons.com/random -s | \
grep data-text | \
sed -n 's/.*>\(.*\)<\/textarea>/\1/p' | \
- head -n 1
+ head -n 1 | \
+ xmlstarlet unesc
diff --git a/makefu/2configs/base-sources.nix b/makefu/2configs/base-sources.nix
index 826cd6fe..7e6bebec 100644
--- a/makefu/2configs/base-sources.nix
+++ b/makefu/2configs/base-sources.nix
@@ -3,9 +3,9 @@
{
krebs.build.source = {
git.nixpkgs = {
- url = https://github.com/NixOS/nixpkgs;
- #url = https://github.com/makefu/nixpkgs;
- rev = "dc18f39bfb2f9d1ba62c7e8ad98544bb15cb26b2"; # nixos-15.09
+ #url = https://github.com/NixOS/nixpkgs;
+ url = https://github.com/makefu/nixpkgs;
+ rev = "78340b042463fd35caa587b0db2e400e5666dbe1"; # nixos-15.09 + cherry-picked iodine
};
dir.secrets = {
diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix
new file mode 100644
index 00000000..fb170957
--- /dev/null
+++ b/makefu/2configs/bepasty-dual.nix
@@ -0,0 +1,52 @@
+{ config, lib, pkgs, ... }:
+
+# 1systems should configure itself:
+# krebs.bepasty.servers.internal.nginx.listen = [ "80" ]
+# krebs.bepasty.servers.external.nginx.listen = [ "80" "443 ssl" ]
+# 80 is redirected to 443 ssl
+
+# secrets used:
+# wildcard.krebsco.de.crt
+# wildcard.krebsco.de.key
+# bepasty-secret.nix <- contains single string
+
+with lib;
+{
+
+ krebs.nginx.enable = mkDefault true;
+ krebs.bepasty = {
+ enable = true;
+ serveNginx= true;
+
+ servers = {
+ internal = {
+ nginx = {
+ server-names = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ];
+ };
+ defaultPermissions = "admin,list,create,read,delete";
+ secretKey = import <secrets/bepasty-secret.nix>;
+ };
+
+ external = {
+ nginx = {
+ server-names = [ "paste.krebsco.de" ];
+ extraConfig = ''
+ ssl_session_cache shared:SSL:1m;
+ ssl_session_timeout 10m;
+ ssl_certificate /root/secrets/wildcard.krebsco.de.crt;
+ ssl_certificate_key /root/secrets/wildcard.krebsco.de.key;
+ ssl_verify_client off;
+ proxy_ssl_session_reuse off;
+ ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ ssl_ciphers RC4:HIGH:!aNULL:!MD5;
+ ssl_prefer_server_ciphers on;
+ if ($scheme = http){
+ return 301 https://$server_name$request_uri;
+ }'';
+ };
+ defaultPermissions = "read";
+ secretKey = import <secrets/bepasty-secret.nix>;
+ };
+ };
+ };
+}
diff --git a/makefu/2configs/exim-retiolum.nix b/makefu/2configs/exim-retiolum.nix
index cebfd7ce..b8c5c523 100644
--- a/makefu/2configs/exim-retiolum.nix
+++ b/makefu/2configs/exim-retiolum.nix
@@ -5,10 +5,6 @@ with lib;
krebs.exim-retiolum.enable = true;
environment.systemPackages = with pkgs; [
msmtp
- mutt-kz
- notmuch
- # TODO: put this somewhere else
- offlineimap
];
}
diff --git a/makefu/2configs/git/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix
index 1277a014..189dd66c 100644
--- a/makefu/2configs/git/cgit-retiolum.nix
+++ b/makefu/2configs/git/cgit-retiolum.nix
@@ -10,6 +10,9 @@ let
stockholm = {
desc = "Make all the systems into 1systems!";
};
+ tinc_graphs = {
+ desc = "Tinc Advanced Graph Generation";
+ };
};
priv-repos = mapAttrs make-priv-repo {
diff --git a/makefu/2configs/iodined.nix b/makefu/2configs/iodined.nix
new file mode 100644
index 00000000..db8a1bfe
--- /dev/null
+++ b/makefu/2configs/iodined.nix
@@ -0,0 +1,16 @@
+{ services,builtins,environment,pkgs, ... }:
+
+let
+ # TODO: make this a parameter
+ domain = "io.krebsco.de";
+ pw = import <secrets/iodinepw.nix>;
+in {
+
+ services.iodined = {
+ enable = true;
+ domain = domain;
+ ip = "172.16.10.1/24";
+ extraConfig = "-P ${pw}";
+ };
+
+}
diff --git a/makefu/2configs/mail-client.nix b/makefu/2configs/mail-client.nix
new file mode 100644
index 00000000..a6ae33d2
--- /dev/null
+++ b/makefu/2configs/mail-client.nix
@@ -0,0 +1,12 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+{
+ environment.systemPackages = with pkgs; [
+ msmtp
+ mutt-kz
+ notmuch
+ offlineimap
+ ];
+
+}
diff --git a/makefu/2configs/unstable-sources.nix b/makefu/2configs/unstable-sources.nix
new file mode 100644
index 00000000..f2d28dca
--- /dev/null
+++ b/makefu/2configs/unstable-sources.nix
@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+
+{
+ krebs.build.source = {
+ git.nixpkgs = {
+ url = https://github.com/makefu/nixpkgs;
+ rev = "984d33884d63d404ff2da76920b8bc8b15471552";
+ };
+
+ dir.secrets = {
+ host = config.krebs.hosts.pornocauster;
+ path = "/home/makefu/secrets/${config.krebs.build.host.name}/";
+ };
+ dir.stockholm = {
+ host = config.krebs.hosts.pornocauster;
+ path = toString ../.. ;
+ };
+ };
+}
diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix
index 598365c3..a8a1f69d 100644
--- a/makefu/3modules/default.nix
+++ b/makefu/3modules/default.nix
@@ -2,7 +2,6 @@ _:
{
imports = [
- ./tinc_graphs.nix
];
}
diff --git a/makefu/3modules/tinc_graphs.nix b/makefu/3modules/tinc_graphs.nix
deleted file mode 100644
index 62d60752..00000000
--- a/makefu/3modules/tinc_graphs.nix
+++ /dev/null
@@ -1,133 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-let
- cfg = config.makefu.tinc_graphs;
- internal_dir = "${cfg.workingDir}/internal";
- external_dir = "${cfg.workingDir}/external";
-
- out = {
- options.makefu.tinc_graphs = api;
- config = mkIf cfg.enable imp ;
- };
-
- api = {
- enable = mkEnableOption "tinc graphs";
-
- geodbPath = mkOption {
- type = types.str;
- description = "Path to geocitydb, defaults to geolite-legacy";
- default = "${pkgs.geolite-legacy}/share/GeoIP/GeoIPCity.dat";
- };
-
- krebsNginx = {
- # configure krebs nginx to serve the new graphs
- enable = mkEnableOption "tinc_graphs nginx";
-
- hostnames_complete = mkOption {
- #TODO: this is not a secure way to serve these graphs,better listen to
- # the correct interface, krebs.nginx does not support this yet
-
- type = with types; listOf str;
- description = "hostname which serves complete graphs";
- default = [ "graphs.${config.krebs.build.host.name}" ];
- };
-
- hostnames_anonymous = mkOption {
- type = with types; listOf str;
- description = ''
- hostname which serves anonymous graphs
- must be different from hostname_complete
- '';
- default = [ "anongraphs.${config.krebs.build.host.name}" ];
- };
- };
-
- workingDir = mkOption {
- type = types.str;
- description = ''
- Path to working dir, will create interal and external/.
- Defaults to the new users home dir which defaults to
- /var/cache/tinc_graphs'';
- default = config.users.extraUsers.tinc_graphs.home;
- };
-
- timerConfig = mkOption {
- type = with types; attrsOf str;
- default = {
- OnCalendar = "*:0/15";
- };
- };
- };
-
- imp = {
- environment.systemPackages = [ pkgs.tinc_graphs];
- systemd.timers.tinc_graphs = {
- description = "Build Tinc Graphs via via timer";
- wantedBy = [ "timers.target"];
- timerConfig = cfg.timerConfig;
- };
- systemd.services.tinc_graphs = {
- description = "Build Tinc Graphs";
- environment = {
- EXTERNAL_FOLDER = external_dir;
- INTERNAL_FOLDER = internal_dir;
- GEODB = cfg.geodbPath;
- TINC_HOSTPATH=config.krebs.retiolum.hosts;
- };
-
- restartIfChanged = true;
-
- serviceConfig = {
- Type = "simple";
-
- ExecStartPre = pkgs.writeScript "tinc_graphs-init" ''
- #!/bin/sh
- mkdir -p "${external_dir}" "${internal_dir}"
- '';
-
- ExecStart = "${pkgs.tinc_graphs}/bin/all-the-graphs";
-
- ExecStartPost = pkgs.writeScript "tinc_graphs-post" ''
- #!/bin/sh
- # TODO: this may break if workingDir is set to something stupid
- # this is needed because homedir is created with 700
- chmod 755 "${cfg.workingDir}"
- '';
-
- User = "root"; # tinc cannot be queried as user,
- # seems to be a tinc-pre issue
- privateTmp = true;
- };
- };
-
- users.extraUsers.tinc_graphs = {
- uid = 3925439960; #genid tinc_graphs
- home = "/var/spool/tinc_graphs";
- createHome = true;
- };
-
- krebs.nginx.servers = mkIf cfg.krebsNginx.enable {
- tinc_graphs_complete = {
- server-names = cfg.krebsNginx.hostnames_complete;
- locations = [
- (nameValuePair "/" ''
- autoindex on;
- root ${internal_dir};
- '')
- ];
- };
- tinc_graphs_anonymous = {
- server-names = cfg.krebsNginx.hostnames_anonymous;
- locations = [
- (nameValuePair "/" ''
- autoindex on;
- root ${external_dir};
- '')
- ];
- };
- };
- };
-
-in
-out
diff --git a/makefu/5pkgs/tinc_graphs/default.nix b/makefu/5pkgs/tinc_graphs/default.nix
index 5bc97415..62a787d3 100644
--- a/makefu/5pkgs/tinc_graphs/default.nix
+++ b/makefu/5pkgs/tinc_graphs/default.nix
@@ -2,20 +2,21 @@
python3Packages.buildPythonPackage rec {
name = "tinc_graphs-${version}";
- version = "0.2.12";
+ version = "0.3.6";
propagatedBuildInputs = with pkgs;[
python3Packages.pygeoip
## ${geolite-legacy}/share/GeoIP/GeoIPCity.dat
];
src = fetchurl {
url = "https://pypi.python.org/packages/source/t/tinc_graphs/tinc_graphs-${version}.tar.gz";
- sha256 = "03jxvxahpcbpnz4668x32b629dwaaz5jcjkyaijm0zzpgcn4cbgp";
+ sha256 = "0ghdx9aaipmppvc2b6cgks4nxw6zsb0fhjrmnisbx7rz0vjvzc74";
};
preFixup = with pkgs;''
wrapProgram $out/bin/build-graphs --prefix PATH : "$out/bin"
wrapProgram $out/bin/all-the-graphs --prefix PATH : "${imagemagick}/bin:${graphviz}/bin:$out/bin"
wrapProgram $out/bin/tinc-stats2json --prefix PATH : "${tinc}/bin"
'';
+
meta = {
homepage = http://krebsco.de/;
description = "Create Graphs from Tinc Stats";
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-30 23:08:05 +0000