summaryrefslogtreecommitdiffstats
path: root/tv
diff options
context:
space:
mode:
Diffstat (limited to 'tv')
-rw-r--r--tv/1systems/cd.nix43
-rw-r--r--tv/1systems/mkdir.nix1
-rw-r--r--tv/1systems/nomic.nix39
-rw-r--r--tv/1systems/rmdir.nix1
-rw-r--r--tv/1systems/wu.nix41
-rw-r--r--tv/1systems/xu.nix42
-rw-r--r--tv/2configs/consul-client.nix9
-rw-r--r--tv/2configs/consul-server.nix21
-rw-r--r--tv/2configs/default.nix20
-rw-r--r--tv/2configs/exim-retiolum.nix8
-rw-r--r--tv/2configs/exim-smarthost.nix5
-rw-r--r--tv/2configs/git.nix9
-rw-r--r--tv/2configs/hw/AO753.nix9
-rw-r--r--tv/2configs/hw/x220.nix1
-rw-r--r--tv/2configs/nginx-public_html.nix15
-rw-r--r--tv/2configs/retiolum.nix17
-rw-r--r--tv/2configs/vim.nix7
-rw-r--r--tv/3modules/consul.nix118
-rw-r--r--tv/3modules/default.nix1
19 files changed, 85 insertions, 322 deletions
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index b69d7655a..8297a56df 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -6,17 +6,12 @@ with lib;
krebs.build.host = config.krebs.hosts.cd;
krebs.build.target = "root@cd.internet";
- krebs.build.source.upstream-nixpkgs = {
- url = https://github.com/NixOS/nixpkgs;
- rev = "b7ff030";
- };
-
imports = [
../2configs/hw/CAC-Developer-2.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
- #../2configs/consul-server.nix
../2configs/exim-smarthost.nix
../2configs/git.nix
+ ../2configs/retiolum.nix
../2configs/urlwatch.nix
{
imports = [ ../2configs/charybdis.nix ];
@@ -30,6 +25,10 @@ with lib;
enable = true;
hosts = [ "jabber.viljetic.de" ];
};
+ tv.iptables.input-internet-accept-new-tcp = [
+ "xmpp-client"
+ "xmpp-server"
+ ];
}
{
krebs.github-hosts-sync.enable = true;
@@ -37,38 +36,17 @@ with lib;
singleton config.krebs.github-hosts-sync.port;
}
{
- tv.iptables = {
- enable = true;
- input-internet-accept-new-tcp = [
- "ssh"
- "tinc"
- "smtp"
- "xmpp-client"
- "xmpp-server"
- ];
- input-retiolum-accept-new-tcp = [
- "http"
- ];
- };
- }
- {
- tv.iptables.input-internet-accept-new-tcp = singleton "http";
krebs.nginx.servers.cgit.server-names = [
"cgit.cd.krebsco.de"
"cgit.cd.viljetic.de"
];
- }
- {
# TODO make public_html also available to cd, cd.retiolum (AKA default)
- tv.iptables.input-internet-accept-new-tcp = singleton "http";
krebs.nginx.servers.public_html = {
server-names = singleton "cd.viljetic.de";
locations = singleton (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
alias /home/$1/public_html$2;
'');
};
- }
- {
krebs.nginx.servers.viljetic = {
server-names = singleton "viljetic.de";
# TODO directly set root (instead via location)
@@ -76,16 +54,7 @@ with lib;
root ${pkgs.viljetic-pages};
'');
};
- }
- {
- krebs.retiolum = {
- enable = true;
- connectTo = [
- "fastpoke"
- "pigstarter"
- "ire"
- ];
- };
+ tv.iptables.input-internet-accept-new-tcp = singleton "http";
}
];
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 9d8a0bcfa..79e5f73b9 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -22,7 +22,6 @@ in
imports = [
../2configs/hw/CAC-Developer-1.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
- ../2configs/consul-server.nix
../2configs/exim-smarthost.nix
../2configs/git.nix
{
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 7bc7b70d2..37ef204c7 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -5,47 +5,14 @@ with lib;
{
krebs.build.host = config.krebs.hosts.nomic;
- krebs.build.target = "root@nomic.gg23";
-
imports = [
../2configs/hw/AO753.nix
- #../2configs/consul-server.nix
+ ../2configs/exim-retiolum.nix
../2configs/git.nix
+ ../2configs/nginx-public_html.nix
../2configs/pulse.nix
+ ../2configs/retiolum.nix
../2configs/xserver
- {
- tv.iptables = {
- enable = true;
- input-internet-accept-new-tcp = [
- "ssh"
- "http"
- "tinc"
- "smtp"
- ];
- };
- }
- {
- krebs.exim-retiolum.enable = true;
- }
- {
- krebs.nginx = {
- enable = true;
- servers.default.locations = [
- (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
- alias /home/$1/public_html$2;
- '')
- ];
- };
- }
- {
- krebs.retiolum = {
- enable = true;
- connectTo = [
- "gum"
- "pigstarter"
- ];
- };
- }
];
boot.initrd.luks = {
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 1f1d975c9..6fd79c596 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -23,7 +23,6 @@ in
imports = [
../2configs/hw/CAC-Developer-1.nix
../2configs/fs/CAC-CentOS-7-64bit.nix
- ../2configs/consul-server.nix
../2configs/exim-smarthost.nix
../2configs/git.nix
{
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 3bdf8d37a..29e6de08b 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -7,10 +7,12 @@ with lib;
imports = [
../2configs/hw/w110er.nix
- #../2configs/consul-client.nix
+ ../2configs/exim-retiolum.nix
../2configs/git.nix
../2configs/mail-client.nix
+ ../2configs/nginx-public_html.nix
../2configs/pulse.nix
+ ../2configs/retiolum.nix
../2configs/xserver
{
environment.systemPackages = with pkgs; [
@@ -41,7 +43,7 @@ with lib;
# tv
bc
bind # dig
- cac
+ cac-api
dic
file
get
@@ -123,39 +125,6 @@ with lib;
unison
];
}
- {
- tv.iptables = {
- enable = true;
- input-internet-accept-new-tcp = [
- "ssh"
- "http"
- "tinc"
- "smtp"
- ];
- };
- }
- {
- krebs.exim-retiolum.enable = true;
- }
- {
- krebs.nginx = {
- enable = true;
- servers.default.locations = [
- (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
- alias /home/$1/public_html$2;
- '')
- ];
- };
- }
- {
- krebs.retiolum = {
- enable = true;
- connectTo = [
- "gum"
- "pigstarter"
- ];
- };
- }
];
boot.initrd.luks = {
@@ -188,7 +157,7 @@ with lib;
nixpkgs.config.chromium.enablePepperFlash = true;
- nixpkgs.config.allowUnfree = true;
+ nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name;
hardware.bumblebee.enable = true;
hardware.bumblebee.group = "video";
hardware.enableAllFirmware = true;
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index e6894b55e..8c4af2bd3 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -5,15 +5,14 @@ with lib;
{
krebs.build.host = config.krebs.hosts.xu;
- krebs.build.source.git.nixpkgs.rev =
- "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
-
imports = [
../2configs/hw/x220.nix
- #../2configs/consul-client.nix
+ ../2configs/exim-retiolum.nix
../2configs/git.nix
../2configs/mail-client.nix
+ ../2configs/nginx-public_html.nix
../2configs/pulse.nix
+ ../2configs/retiolum.nix
../2configs/xserver
{
environment.systemPackages = with pkgs; [
@@ -124,40 +123,6 @@ with lib;
unison
];
}
- {
- tv.iptables = {
- enable = true;
- input-internet-accept-new-tcp = [
- "ssh"
- "http"
- "tinc"
- "smtp"
- ];
- };
- }
- {
- krebs.exim-retiolum.enable = true;
- }
- {
- krebs.nginx = {
- enable = true;
- servers.default.locations = [
- (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
- alias /home/$1/public_html$2;
- '')
- ];
- };
- }
- {
- krebs.retiolum = {
- enable = true;
- connectTo = [
- "cd"
- "gum"
- "pigstarter"
- ];
- };
- }
];
boot.initrd.luks = {
@@ -190,7 +155,6 @@ with lib;
nixpkgs.config.chromium.enablePepperFlash = true;
- nixpkgs.config.allowUnfree = true;
#hardware.bumblebee.enable = true;
#hardware.bumblebee.group = "video";
hardware.enableAllFirmware = true;
diff --git a/tv/2configs/consul-client.nix b/tv/2configs/consul-client.nix
deleted file mode 100644
index 0a8bf4d75..000000000
--- a/tv/2configs/consul-client.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ pkgs, ... }:
-
-{
- imports = [ ./consul-server.nix ];
-
- tv.consul = {
- server = pkgs.lib.mkForce false;
- };
-}
diff --git a/tv/2configs/consul-server.nix b/tv/2configs/consul-server.nix
deleted file mode 100644
index d10f9ea75..000000000
--- a/tv/2configs/consul-server.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ config, ... }:
-
-{
- tv.consul = rec {
- enable = true;
-
- self = config.krebs.build.host;
- inherit (self) dc;
-
- server = true;
-
- hosts = with config.krebs.hosts; [
- # TODO get this list automatically from each host where tv.consul.enable is true
- cd
- mkdir
- nomic
- rmdir
- #wu
- ];
- };
-}
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 310077021..57c4620c4 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -8,15 +8,13 @@ with lib;
krebs.build = {
user = config.krebs.users.tv;
target = mkDefault "root@${config.krebs.build.host.name}";
- source-version = 2;
source = mapAttrs (_: mkDefault) ({
- nixos-config = "symlink:stockholm-private/1systems/${config.krebs.build.host.name}.nix";
- nixpkgs = symlink:stockholm-nixpkgs;
+ nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix";
+ nixpkgs = symlink:stockholm/nixpkgs;
secrets = "/home/tv/secrets/${config.krebs.build.host.name}";
secrets-common = "/home/tv/secrets/common";
- stockholm-krebs = "/home/tv/stockholm/krebs";
- stockholm-nixpkgs = "/home/tv/stockholm/nixpkgs";
- stockholm-private = "/home/tv/stockholm/tv";
+ stockholm = "/home/tv/stockholm";
+ stockholm-user = "symlink:stockholm/tv";
upstream-nixpkgs = {
url = https://github.com/NixOS/nixpkgs;
rev = "77f8f35d57618c1ba456d968524f2fb2c3448295";
@@ -70,6 +68,9 @@ with lib;
nix.useChroot = true;
}
{
+ nixpkgs.config.allowUnfree = false;
+ }
+ {
environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
environment.systemPackages = with pkgs; [
@@ -101,7 +102,7 @@ with lib;
};
environment.variables = {
- NIX_PATH = mkForce "/var/src";
+ NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
};
programs.bash = {
@@ -163,12 +164,17 @@ with lib;
}
{
+ tv.iptables.enable = true;
+ }
+
+ {
services.openssh = {
enable = true;
hostKeys = [
{ type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
];
};
+ tv.iptables.input-internet-accept-new-tcp = singleton "ssh";
}
{
diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
new file mode 100644
index 000000000..aedf25823
--- /dev/null
+++ b/tv/2configs/exim-retiolum.nix
@@ -0,0 +1,8 @@
+{ lib, ... }:
+
+with lib;
+
+{
+ krebs.exim-retiolum.enable = true;
+ tv.iptables.input-retiolum-accept-new-tcp = singleton "smtp";
+}
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index f5f63d284..bcfea7821 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -1,4 +1,6 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
+
+with lib;
{
krebs.exim-smarthost = {
@@ -34,4 +36,5 @@
{ from = "mirko"; to = "mv"; }
];
};
+ tv.iptables.input-internet-accept-new-tcp = singleton "smtp";
}
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index 800deff1b..b8180085f 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -9,7 +9,7 @@ let
enable = true;
root-title = "public repositories at ${config.krebs.build.host.name}";
root-desc = "keep calm and engage";
- repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) repos;
+ repos = repos;
rules = rules;
};
};
@@ -22,8 +22,8 @@ let
public-repos = mapAttrs make-public-repo ({
} // mapAttrValues (setAttr "section" "1. Miscellaneous") {
- cac = {
- desc = "CloudAtCost command line interface";
+ cac-api = {
+ desc = "CloudAtCost API command line interface";
};
get = {};
hack = {};
@@ -39,6 +39,7 @@ let
stockholm = {
desc = "take all the computers hostage, they'll love you!";
};
+ with-tmpdir = {};
} // mapAttrValues (setAttr "section" "2. Haskell libraries") {
blessings = {};
mime = {};
@@ -98,7 +99,7 @@ let
repo = [ repo ];
perm = fetch;
} ++
- optional (length (repo.collaborators or []) > 0) {
+ optional (repo.collaborators or [] != []) {
user = repo.collaborators;
repo = [ repo ];
perm = fetch;
diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix
index acd9ee32b..72a40819f 100644
--- a/tv/2configs/hw/AO753.nix
+++ b/tv/2configs/hw/AO753.nix
@@ -1,4 +1,6 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
+
+with lib;
{
imports = [
@@ -39,8 +41,5 @@
HandleSuspendKey=ignore
'';
- nixpkgs.config = {
- allowUnfree = false;
- allowUnfreePredicate = (x: pkgs.lib.hasPrefix "broadcom-sta-" x.name);
- };
+ nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name;
}
diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix
index 8549311e7..7cec670fa 100644
--- a/tv/2configs/hw/x220.nix
+++ b/tv/2configs/hw/x220.nix
@@ -14,7 +14,6 @@
networking.wireless.enable = true;
#hardware.enableAllFirmware = true;
- #nixpkgs.config.allowUnfree = true;
#zramSwap.enable = true;
#zramSwap.numDevices = 2;
diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix
new file mode 100644
index 000000000..dc74f7f8d
--- /dev/null
+++ b/tv/2configs/nginx-public_html.nix
@@ -0,0 +1,15 @@
+{ lib, ... }:
+
+with lib;
+
+{
+ krebs.nginx = {
+ enable = true;
+ servers.default.locations = [
+ (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
+ alias /home/$1/public_html$2;
+ '')
+ ];
+ };
+ tv.iptables.input-internet-accept-new-tcp = singleton "http";
+}
diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix
new file mode 100644
index 000000000..d2bb9e6cf
--- /dev/null
+++ b/tv/2configs/retiolum.nix
@@ -0,0 +1,17 @@
+{ config, lib, ... }:
+
+with lib;
+
+{
+ krebs.retiolum = {
+ enable = true;
+ connectTo = filter (ne config.krebs.build.host.name) [
+ "gum"
+ "prism"
+ "echelon"
+ "cd"
+ "ire"
+ ];
+ };
+ tv.iptables.input-internet-accept-new-tcp = singleton "tinc";
+}
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index bab949270..23f90af05 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -7,11 +7,6 @@ let
vim
];
- # Nano really is just a stupid name for Vim.
- nixpkgs.config.packageOverrides = pkgs: {
- nano = pkgs.vim;
- };
-
environment.etc.vimrc.source = vimrc;
environment.variables.EDITOR = mkForce "vim";
@@ -110,6 +105,8 @@ let
syn match String /"\([^\\"]\|\\.\)*"/
syn match Comment /\(^\|\s\)#.*/
+
+ let b:current_syntax = "nix"
''}
au BufRead,BufNewFile /dev/shm/* set nobackup nowritebackup noswapfile
diff --git a/tv/3modules/consul.nix b/tv/3modules/consul.nix
deleted file mode 100644
index 5c955fdb5..000000000
--- a/tv/3modules/consul.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-# if quorum gets lost, then start any node with a config that doesn't contain bootstrap_expect
-# but -bootstrap
-# TODO consul-bootstrap HOST that actually does is
-# TODO tools to inspect state of a cluster in outage state
-
-with lib;
-let
- cfg = config.tv.consul;
-
- out = {
- options.tv.consul = api;
- config = mkIf cfg.enable (mkMerge [
- imp
- { tv.iptables.input-retiolum-accept-new-tcp = [ "8300" "8301" ]; }
- # TODO udp for 8301
- ]);
- };
-
- api = {
- enable = mkEnableOption "tv.consul";
-
- dc = mkOption {
- type = types.label;
- };
- hosts = mkOption {
- type = with types; listOf host;
- };
- encrypt-file = mkOption {
- type = types.str; # TODO path (but not just into store)
- default = toString <secrets/consul-encrypt.json>;
- };
- data-dir = mkOption {
- type = types.str; # TODO path (but not just into store)
- default = "/var/lib/consul";
- };
- self = mkOption {
- type = types.host;
- };
- server = mkOption {
- type = types.bool;
- default = false;
- };
- GOMAXPROCS = mkOption {
- type = types.int;
- default = cfg.self.cores;
- };
- };
-
- consul-config = {
- datacenter = cfg.dc;
- data_dir = cfg.data-dir;
- log_level = "INFO";
- #node_name =
- server = cfg.server;
- enable_syslog = true;
- retry_join =
- # TODO allow consul in other nets than retiolum [maybe]
- concatMap (host: host.nets.retiolum.addrs)
- (filter (host: host.name != cfg.self.name) cfg.hosts);
- leave_on_terminate = true;
- } // optionalAttrs cfg.server {
- bootstrap_expect = length cfg.hosts;
- leave_on_terminate = false;
- };
-
- imp = {
- environment.systemPackages = with pkgs; [
- consul
- ];
-
- systemd.services.consul = {
- after = [ "network.target" ];
- wantedBy = [ "multi-user.target" ];
- path = with pkgs; [
- consul
- ];
- environment = {
- GOMAXPROCS = toString cfg.GOMAXPROCS;
- };
- serviceConfig = {
- PermissionsStartOnly = "true";
- SyslogIdentifier = "consul";
- User = user.name;
- PrivateTmp = "true";
- Restart = "always";
- ExecStartPre = pkgs.writeScript "consul-init" ''
- #! /bin/sh
- mkdir -p ${cfg.data-dir}
- chown ${user.name}: ${cfg.data-dir}
- install -o ${user.name} -m 0400 ${cfg.encrypt-file} /tmp/encrypt.json
- '';
- ExecStart = pkgs.writeScript "consul-service" ''
- #! /bin/sh
- set -euf
- exec >/dev/null
- exec consul agent \
- -config-file=${toFile "consul.json" (toJSON consul-config)} \
- -config-file=/tmp/encrypt.json
- '';
- #-node=${cfg.self.fqdn} \
- #ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user} -D";
- };
- };
-
- users.extraUsers = singleton {
- inherit (user) name uid;
- };
- };
-
- user = rec {
- name = "consul";
- uid = genid name;
- };
-
-in
-out
diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
index bb10d8261..f7889b245 100644
--- a/tv/3modules/default.nix
+++ b/tv/3modules/default.nix
@@ -2,7 +2,6 @@ _:
{
imports = [
- ./consul.nix
./ejabberd.nix
./iptables.nix
];
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-07 08:38:14 +0000