summaryrefslogtreecommitdiffstats
path: root/tv
diff options
context:
space:
mode:
Diffstat (limited to 'tv')
-rw-r--r--tv/1systems/cd.nix3
-rw-r--r--tv/1systems/mkdir.nix3
-rw-r--r--tv/1systems/nomic.nix3
-rw-r--r--tv/1systems/rmdir.nix3
-rw-r--r--tv/1systems/wu.nix14
-rw-r--r--tv/1systems/xu.nix14
-rw-r--r--tv/2configs/default.nix (renamed from tv/2configs/base.nix)21
-rw-r--r--tv/2configs/vim.nix7
-rw-r--r--tv/2configs/xserver/default.nix8
-rw-r--r--tv/2configs/z.nix40
10 files changed, 51 insertions, 65 deletions
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 1122e6a19..126c6feb5 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -14,11 +14,9 @@ with lib;
rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
};
dir.secrets = {
- host = config.krebs.hosts.wu;
path = "/home/tv/secrets/cd";
};
dir.stockholm = {
- host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
};
};
@@ -26,7 +24,6 @@ with lib;
imports = [
../2configs/hw/CAC-Developer-2.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
- ../2configs/base.nix
#../2configs/consul-server.nix
../2configs/exim-smarthost.nix
../2configs/git.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index e8e354197..55d83f8f3 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -27,11 +27,9 @@ in
rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
};
dir.secrets = {
- host = config.krebs.hosts.wu;
path = "/home/tv/secrets/mkdir";
};
dir.stockholm = {
- host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
};
};
@@ -39,7 +37,6 @@ in
imports = [
../2configs/hw/CAC-Developer-1.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
- ../2configs/base.nix
../2configs/consul-server.nix
../2configs/exim-smarthost.nix
../2configs/git.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index df45b8177..c2bb4dc78 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -14,18 +14,15 @@ with lib;
rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
};
dir.secrets = {
- host = config.krebs.hosts.wu;
path = "/home/tv/secrets/nomic";
};
dir.stockholm = {
- host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
};
};
imports = [
../2configs/hw/AO753.nix
- ../2configs/base.nix
#../2configs/consul-server.nix
../2configs/git.nix
{
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index e24ef64fc..53f14d7df 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -27,11 +27,9 @@ in
rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
};
dir.secrets = {
- host = config.krebs.hosts.wu;
path = "/home/tv/secrets/rmdir";
};
dir.stockholm = {
- host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
};
};
@@ -39,7 +37,6 @@ in
imports = [
../2configs/hw/CAC-Developer-1.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
- ../2configs/base.nix
../2configs/consul-server.nix
../2configs/exim-smarthost.nix
../2configs/git.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index b12e7df93..33292c608 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -15,11 +15,9 @@ with lib;
target-path = "/var/src/nixpkgs";
};
dir.secrets = {
- host = config.krebs.hosts.wu;
path = "/home/tv/secrets/wu";
};
dir.stockholm = {
- host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
target-path = "/var/src/stockholm";
};
@@ -27,11 +25,11 @@ with lib;
imports = [
../2configs/hw/w110er.nix
- ../2configs/base.nix
#../2configs/consul-client.nix
../2configs/git.nix
../2configs/mail-client.nix
../2configs/xserver
+ ../2configs/z.nix
{
environment.systemPackages = with pkgs; [
@@ -287,16 +285,6 @@ with lib;
onion = {
uid = 6660010;
};
-
- zalora = {
- uid = 1000301;
- extraGroups = [
- "audio"
- # TODO remove vboxusers when hardening is active
- "vboxusers"
- "video"
- ];
- };
};
security.sudo.extraConfig =
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index e2cc2c06a..607f89aea 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -14,22 +14,20 @@ with lib;
rev = "c44a593aa43bba6a0708f6f36065a514a5110613";
};
dir.secrets = {
- host = config.krebs.hosts.wu;
path = "/home/tv/secrets/xu";
};
dir.stockholm = {
- host = config.krebs.hosts.wu;
path = "/home/tv/stockholm";
};
};
imports = [
../2configs/hw/x220.nix
- ../2configs/base.nix
#../2configs/consul-client.nix
../2configs/git.nix
../2configs/mail-client.nix
../2configs/xserver
+ ../2configs/z.nix
{
environment.systemPackages = with pkgs; [
@@ -286,16 +284,6 @@ with lib;
onion = {
uid = 6660010;
};
-
- zalora = {
- uid = 1000301;
- extraGroups = [
- "audio"
- # TODO remove vboxusers when hardening is active
- "vboxusers"
- "video"
- ];
- };
};
security.sudo.extraConfig =
diff --git a/tv/2configs/base.nix b/tv/2configs/default.nix
index 41159690d..d3f4eed0d 100644
--- a/tv/2configs/base.nix
+++ b/tv/2configs/default.nix
@@ -1,6 +1,5 @@
{ config, lib, pkgs, ... }:
-with builtins;
with lib;
{
@@ -23,6 +22,9 @@ with lib;
(import <secrets/hashedPasswords.nix>);
}
{
+ users.groups.subusers.gid = 1093178926; # genid subusers
+ }
+ {
users.defaultUserShell = "/run/current-system/sw/bin/bash";
users.mutableUsers = false;
}
@@ -31,6 +33,7 @@ with lib;
root = {
openssh.authorizedKeys.keys = [
config.krebs.users.tv.pubkey
+ config.krebs.users.tv_xu.pubkey
];
};
tv = {
@@ -69,22 +72,8 @@ with lib;
nix.useChroot = true;
}
{
- # oldvim
- environment.systemPackages = with pkgs; [
- vim
- ];
+ environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
- environment.etc."vim/vimrc".text = ''
- set nocp
- '';
-
- environment.etc."vim/vim${majmin pkgs.vim.version}".source =
- "${pkgs.vim}/share/vim/vim${majmin pkgs.vim.version}";
-
- environment.variables.EDITOR = mkForce "vim";
- environment.variables.VIM = "/etc/vim";
- }
- {
environment.systemPackages = with pkgs; [
rxvt_unicode.terminfo
];
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 14f086e5c..04b1480c1 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -66,9 +66,10 @@ let
au BufRead,BufNewFile *.nix so ${pkgs.writeText "nix.vim" ''
setf nix
+ set isk=@,48-57,_,192-255,-,'
" Ref <nix/src/libexpr/lexer.l>
- syn match INT /[0-9]\+/
+ syn match INT /\<[0-9]\+\>/
syn match PATH /[a-zA-Z0-9\.\_\-\+]*\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/
syn match HPATH /\~\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/
syn match SPATH /<[a-zA-Z0-9\.\_\-\+]\+\(\/[a-zA-Z0-9\.\_\-\+]\+\)*>/
@@ -79,8 +80,8 @@ let
hi link SPATH Constant
hi link URI Constant
- syn match String /"\([^"]\|\\\"\)*"/
- syn match Comment /\s#.*/
+ syn match String /"\([^\\"]\|\\.\)*"/
+ syn match Comment /\(^\|\s\)#.*/
''}
au BufRead,BufNewFile /dev/shm/* set nobackup nowritebackup noswapfile
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 4d2fe9e45..df00203be 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -70,14 +70,6 @@ let
ExecStart = "${xserver}/bin/xserver";
};
};
-
- programs.bash.interactiveShellInit = ''
- case ''${XMONAD_SPAWN_WORKSPACE-} in
- za|zh|zj|zs)
- exec sudo -u zalora -i
- ;;
- esac
- '';
};
xmonad-environment = {
diff --git a/tv/2configs/z.nix b/tv/2configs/z.nix
new file mode 100644
index 000000000..e5494ecc9
--- /dev/null
+++ b/tv/2configs/z.nix
@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+ krebs.per-user.z.packages = [
+ (pkgs.writeScriptBin "cr" ''
+ #! /bin/sh
+ set -efu
+ export LC_TIME=de_DE.utf8
+ exec ${pkgs.chromium}/bin/chromium \
+ --ssl-version-min=tls1 \
+ --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
+ --disk-cache-size=50000000 \
+ "%@"
+ '')
+ ];
+
+ programs.bash.interactiveShellInit = ''
+ case ''${XMONAD_SPAWN_WORKSPACE-} in
+ za|zh|zj|zs)
+ exec sudo -u z -i
+ ;;
+ esac
+ '';
+
+ security.sudo.extraConfig = "tv ALL=(z) NOPASSWD: ALL";
+
+ users.users.z = {
+ extraGroups = [
+ "audio"
+ "vboxusers"
+ "video"
+ ];
+ group = "subusers";
+ home = "/home/z";
+ uid = 3043726074; # genid z
+ useDefaultShell = true;
+ };
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 19:15:47 +0000