From 0b00e7e70eefd3b22b65a29506003bd984dfb6f2 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 28 Jul 2015 20:19:54 +0200 Subject: makefu:rename to user-toplevel structure --- 1systems/makefu/pnp.nix | 47 ------------------- 2configs/makefu/base.nix | 99 --------------------------------------- 2configs/makefu/cgit-retiolum.nix | 70 --------------------------- 3modules/makefu/default.nix | 19 -------- makefu/1systems/pnp.nix | 47 +++++++++++++++++++ makefu/2configs/base.nix | 99 +++++++++++++++++++++++++++++++++++++++ makefu/2configs/cgit-retiolum.nix | 70 +++++++++++++++++++++++++++ makefu/3modules/default.nix | 19 ++++++++ 8 files changed, 235 insertions(+), 235 deletions(-) delete mode 100644 1systems/makefu/pnp.nix delete mode 100644 2configs/makefu/base.nix delete mode 100644 2configs/makefu/cgit-retiolum.nix delete mode 100644 3modules/makefu/default.nix create mode 100644 makefu/1systems/pnp.nix create mode 100644 makefu/2configs/base.nix create mode 100644 makefu/2configs/cgit-retiolum.nix create mode 100644 makefu/3modules/default.nix diff --git a/1systems/makefu/pnp.nix b/1systems/makefu/pnp.nix deleted file mode 100644 index 1019c4d70..000000000 --- a/1systems/makefu/pnp.nix +++ /dev/null @@ -1,47 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page -# and in the NixOS manual (accessible by running ‘nixos-help’). - -{ config, pkgs, ... }: - -{ - imports = - [ # Include the results of the hardware scan. - - ../../2configs/makefu/base.nix - ../../2configs/makefu/cgit-retiolum.nix - ]; - krebs.build.host = config.krebs.hosts.pnp; - - boot.loader.grub.enable = true; - boot.loader.grub.version = 2; - boot.loader.grub.device = "/dev/vda"; - - boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ehci_pci" "virtio_pci" "virtio_blk" ]; - boot.kernelModules = [ ]; - boot.extraModulePackages = [ ]; - hardware.enableAllFirmware = true; - hardware.cpu.amd.updateMicrocode = true; - -# networking.firewall is enabled by default - networking.firewall.allowedTCPPorts = [ 80 ]; - - fileSystems."/" = - { device = "/dev/disk/by-label/nixos"; - fsType = "ext4"; - }; - krebs.retiolum = { - enable = true; - hosts = ../../Zhosts; - connectTo = [ - "gum" - "pigstarter" - "fastpoke" - ]; - }; - -# $ nix-env -qaP | grep wget - environment.systemPackages = with pkgs; [ - jq - ]; -} diff --git a/2configs/makefu/base.nix b/2configs/makefu/base.nix deleted file mode 100644 index b052b13e4..000000000 --- a/2configs/makefu/base.nix +++ /dev/null @@ -1,99 +0,0 @@ -{ config, lib, pkgs, ... }: - -with lib; -{ - imports = [ ]; - krebs.enable = true; - krebs.search-domain = "retiolum"; - - networking.hostName = config.krebs.build.host.name; - users.extraUsers = { - root = { - openssh.authorizedKeys.keys = [ config.krebs.users.makefu.pubkey ]; - }; - makefu = { - uid = 9001; - group = "users"; - home = "/home/makefu"; - createHome = true; - useDefaultShell = true; - extraGroups = [ - "wheel" - ]; - openssh.authorizedKeys.keys = [ config.krebs.users.makefu.pubkey ]; - }; - }; - - services.openssh.enable = true; - nix.useChroot = true; - - users.mutableUsers = true; - - boot.tmpOnTmpfs = true; - systemd.tmpfiles.rules = [ - "d /tmp 1777 root root - -" - ]; - - environment.extraInit = '' - EDITOR=vim - ''; - - environment.systemPackages = with pkgs; [ - git - vim - gnumake - rxvt_unicode.terminfo - ]; - - programs.bash = { - enableCompletion = true; - interactiveShellInit = '' - HISTCONTROL='erasedups:ignorespace' - HISTSIZE=900001 - HISTFILESIZE=$HISTSIZE - - shopt -s checkhash - shopt -s histappend histreedit histverify - shopt -s no_empty_cmd_completion - complete -d cd - ''; - - promptInit = '' - case $UID in - 0) PS1='\[\e[1;31m\]\w\[\e[0m\] ' ;; - 9001) PS1='\[\e[1;32m\]\w\[\e[0m\] ' ;; - *) PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] ' ;; - esac - if test -n "$SSH_CLIENT"; then - PS1='\[\033[35m\]\h'" $PS1" - fi - ''; - }; - - environment.shellAliases = { - lsl = "ls -lAtr"; - }; - - nixpkgs.config.packageOverrides = pkgs: { - nano = pkgs.runCommand "empty" {} "mkdir -p $out"; - }; - - services.cron.enable = false; - services.nscd.enable = false; - - security.setuidPrograms = [ "sendmail" ]; - services.journald.extraConfig = '' - SystemMaxUse=1G - RuntimeMaxUse=128M - ''; - # Enable IPv6 Privacy Extensions - boot.kernel.sysctl = { - "net.ipv6.conf.all.use_tempaddr" = 2; - "net.ipv6.conf.default.use_tempaddr" = 2; - }; - - i18n = { - consoleKeyMap = "us"; - defaultLocale = "en_US.UTF-8"; - }; -} diff --git a/2configs/makefu/cgit-retiolum.nix b/2configs/makefu/cgit-retiolum.nix deleted file mode 100644 index 7b8e3bc97..000000000 --- a/2configs/makefu/cgit-retiolum.nix +++ /dev/null @@ -1,70 +0,0 @@ -{ config, lib, pkgs, ... }: -# TODO: remove tv lib :) -with import ../../4lib/tv { inherit lib pkgs; }; -let - - out = { - imports = [ ../../3modules/krebs/git.nix ]; - krebs.git = { - enable = true; - root-title = "public repositories "; - root-desc = "keep on krebsing"; - inherit repos rules; - }; - }; - repos = priv-repos // krebs-repos ; - rules = concatMap krebs-rules (attrValues krebs-repos) ++ concatMap priv-rules (attrValues priv-repos); - - krebs-repos = mapAttrs make-krebs-repo { - stockholm = { - desc = "take all the computers hostage, they'll love you!"; - }; - }; - - priv-repos = mapAttrs make-priv-repo { - autosync = { }; - }; - - - # TODO move users to separate module - make-priv-repo = name: { desc ? null, ... }: { - inherit name desc; - public = false; - }; - - make-krebs-repo = with git; name: { desc ? null, ... }: { - inherit name desc; - public = true; - hooks = { - post-receive = git.irc-announce { - nick = config.networking.hostName; - channel = "#retiolum"; - server = "cd.retiolum"; - }; - }; - }; - - set-owners = with git; repo: user: - singleton { - inherit user; - repo = [ repo ]; - perm = push "refs/*" [ non-fast-forward create delete merge ]; - }; - - set-ro-access = with git; repo: user: - optional repo.public { - inherit user; - repo = [ repo ]; - perm = fetch; - }; - - # TODO: get the list of all krebsministers - krebsminister = with config.krebs.users; [ lass tv uriel ]; - - priv-rules = with config.krebs.users; repo: - set-owners repo [ makefu ]; - - krebs-rules = with config.krebs.users; repo: - set-owners repo [ makefu ] ++ set-ro-access repo krebsminister ; - -in out diff --git a/3modules/makefu/default.nix b/3modules/makefu/default.nix deleted file mode 100644 index 45ca8c3eb..000000000 --- a/3modules/makefu/default.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ config, lib, ... }: - -with import ../../4lib/krebs { inherit lib; }; -let - cfg = config.krebs; - - out = { - imports = [ - ]; - options.krebs = api; - config = mkIf cfg.enable imp; - }; - - api = { }; - - imp = { }; - -in -out diff --git a/makefu/1systems/pnp.nix b/makefu/1systems/pnp.nix new file mode 100644 index 000000000..1019c4d70 --- /dev/null +++ b/makefu/1systems/pnp.nix @@ -0,0 +1,47 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, ... }: + +{ + imports = + [ # Include the results of the hardware scan. + + ../../2configs/makefu/base.nix + ../../2configs/makefu/cgit-retiolum.nix + ]; + krebs.build.host = config.krebs.hosts.pnp; + + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.device = "/dev/vda"; + + boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ehci_pci" "virtio_pci" "virtio_blk" ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + hardware.enableAllFirmware = true; + hardware.cpu.amd.updateMicrocode = true; + +# networking.firewall is enabled by default + networking.firewall.allowedTCPPorts = [ 80 ]; + + fileSystems."/" = + { device = "/dev/disk/by-label/nixos"; + fsType = "ext4"; + }; + krebs.retiolum = { + enable = true; + hosts = ../../Zhosts; + connectTo = [ + "gum" + "pigstarter" + "fastpoke" + ]; + }; + +# $ nix-env -qaP | grep wget + environment.systemPackages = with pkgs; [ + jq + ]; +} diff --git a/makefu/2configs/base.nix b/makefu/2configs/base.nix new file mode 100644 index 000000000..b052b13e4 --- /dev/null +++ b/makefu/2configs/base.nix @@ -0,0 +1,99 @@ +{ config, lib, pkgs, ... }: + +with lib; +{ + imports = [ ]; + krebs.enable = true; + krebs.search-domain = "retiolum"; + + networking.hostName = config.krebs.build.host.name; + users.extraUsers = { + root = { + openssh.authorizedKeys.keys = [ config.krebs.users.makefu.pubkey ]; + }; + makefu = { + uid = 9001; + group = "users"; + home = "/home/makefu"; + createHome = true; + useDefaultShell = true; + extraGroups = [ + "wheel" + ]; + openssh.authorizedKeys.keys = [ config.krebs.users.makefu.pubkey ]; + }; + }; + + services.openssh.enable = true; + nix.useChroot = true; + + users.mutableUsers = true; + + boot.tmpOnTmpfs = true; + systemd.tmpfiles.rules = [ + "d /tmp 1777 root root - -" + ]; + + environment.extraInit = '' + EDITOR=vim + ''; + + environment.systemPackages = with pkgs; [ + git + vim + gnumake + rxvt_unicode.terminfo + ]; + + programs.bash = { + enableCompletion = true; + interactiveShellInit = '' + HISTCONTROL='erasedups:ignorespace' + HISTSIZE=900001 + HISTFILESIZE=$HISTSIZE + + shopt -s checkhash + shopt -s histappend histreedit histverify + shopt -s no_empty_cmd_completion + complete -d cd + ''; + + promptInit = '' + case $UID in + 0) PS1='\[\e[1;31m\]\w\[\e[0m\] ' ;; + 9001) PS1='\[\e[1;32m\]\w\[\e[0m\] ' ;; + *) PS1='\[\e[1;35m\]\u \[\e[1;32m\]\w\[\e[0m\] ' ;; + esac + if test -n "$SSH_CLIENT"; then + PS1='\[\033[35m\]\h'" $PS1" + fi + ''; + }; + + environment.shellAliases = { + lsl = "ls -lAtr"; + }; + + nixpkgs.config.packageOverrides = pkgs: { + nano = pkgs.runCommand "empty" {} "mkdir -p $out"; + }; + + services.cron.enable = false; + services.nscd.enable = false; + + security.setuidPrograms = [ "sendmail" ]; + services.journald.extraConfig = '' + SystemMaxUse=1G + RuntimeMaxUse=128M + ''; + # Enable IPv6 Privacy Extensions + boot.kernel.sysctl = { + "net.ipv6.conf.all.use_tempaddr" = 2; + "net.ipv6.conf.default.use_tempaddr" = 2; + }; + + i18n = { + consoleKeyMap = "us"; + defaultLocale = "en_US.UTF-8"; + }; +} diff --git a/makefu/2configs/cgit-retiolum.nix b/makefu/2configs/cgit-retiolum.nix new file mode 100644 index 000000000..7b8e3bc97 --- /dev/null +++ b/makefu/2configs/cgit-retiolum.nix @@ -0,0 +1,70 @@ +{ config, lib, pkgs, ... }: +# TODO: remove tv lib :) +with import ../../4lib/tv { inherit lib pkgs; }; +let + + out = { + imports = [ ../../3modules/krebs/git.nix ]; + krebs.git = { + enable = true; + root-title = "public repositories "; + root-desc = "keep on krebsing"; + inherit repos rules; + }; + }; + repos = priv-repos // krebs-repos ; + rules = concatMap krebs-rules (attrValues krebs-repos) ++ concatMap priv-rules (attrValues priv-repos); + + krebs-repos = mapAttrs make-krebs-repo { + stockholm = { + desc = "take all the computers hostage, they'll love you!"; + }; + }; + + priv-repos = mapAttrs make-priv-repo { + autosync = { }; + }; + + + # TODO move users to separate module + make-priv-repo = name: { desc ? null, ... }: { + inherit name desc; + public = false; + }; + + make-krebs-repo = with git; name: { desc ? null, ... }: { + inherit name desc; + public = true; + hooks = { + post-receive = git.irc-announce { + nick = config.networking.hostName; + channel = "#retiolum"; + server = "cd.retiolum"; + }; + }; + }; + + set-owners = with git; repo: user: + singleton { + inherit user; + repo = [ repo ]; + perm = push "refs/*" [ non-fast-forward create delete merge ]; + }; + + set-ro-access = with git; repo: user: + optional repo.public { + inherit user; + repo = [ repo ]; + perm = fetch; + }; + + # TODO: get the list of all krebsministers + krebsminister = with config.krebs.users; [ lass tv uriel ]; + + priv-rules = with config.krebs.users; repo: + set-owners repo [ makefu ]; + + krebs-rules = with config.krebs.users; repo: + set-owners repo [ makefu ] ++ set-ro-access repo krebsminister ; + +in out diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix new file mode 100644 index 000000000..45ca8c3eb --- /dev/null +++ b/makefu/3modules/default.nix @@ -0,0 +1,19 @@ +{ config, lib, ... }: + +with import ../../4lib/krebs { inherit lib; }; +let + cfg = config.krebs; + + out = { + imports = [ + ]; + options.krebs = api; + config = mkIf cfg.enable imp; + }; + + api = { }; + + imp = { }; + +in +out -- cgit v1.2.3 From a8724063ff3651aaf129acd498b2afdcdecb4ca2 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 28 Jul 2015 20:27:12 +0200 Subject: makefu/0make: mv pnp --- 0make/makefu/pnp.makefile | 4 ---- makefu/0make/pnp.makefile | 4 ++++ 2 files changed, 4 insertions(+), 4 deletions(-) delete mode 100644 0make/makefu/pnp.makefile create mode 100644 makefu/0make/pnp.makefile diff --git a/0make/makefu/pnp.makefile b/0make/makefu/pnp.makefile deleted file mode 100644 index a18efe0e0..000000000 --- a/0make/makefu/pnp.makefile +++ /dev/null @@ -1,4 +0,0 @@ -deploy_host := root@pnp -nixpkgs_url := https://github.com/nixos/nixpkgs -nixpkgs_rev := 4c01e6d91993b6de128795f4fbdd25f6227fb870 -secrets_dir := /home/makefu/secrets/pnp diff --git a/makefu/0make/pnp.makefile b/makefu/0make/pnp.makefile new file mode 100644 index 000000000..a18efe0e0 --- /dev/null +++ b/makefu/0make/pnp.makefile @@ -0,0 +1,4 @@ +deploy_host := root@pnp +nixpkgs_url := https://github.com/nixos/nixpkgs +nixpkgs_rev := 4c01e6d91993b6de128795f4fbdd25f6227fb870 +secrets_dir := /home/makefu/secrets/pnp -- cgit v1.2.3 From 9575e56d6980cd9770befce5605eabd290ca5dbb Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 29 Jul 2015 01:07:41 +0200 Subject: update paths in makefu cfg --- makefu/1systems/pnp.nix | 4 ++-- makefu/2configs/base.nix | 1 + makefu/2configs/cgit-retiolum.nix | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/makefu/1systems/pnp.nix b/makefu/1systems/pnp.nix index 1019c4d70..e28c82938 100644 --- a/makefu/1systems/pnp.nix +++ b/makefu/1systems/pnp.nix @@ -8,8 +8,8 @@ imports = [ # Include the results of the hardware scan. - ../../2configs/makefu/base.nix - ../../2configs/makefu/cgit-retiolum.nix + ../2configs/base.nix + ../2configs/cgit-retiolum.nix ]; krebs.build.host = config.krebs.hosts.pnp; diff --git a/makefu/2configs/base.nix b/makefu/2configs/base.nix index b052b13e4..8dfb2ef27 100644 --- a/makefu/2configs/base.nix +++ b/makefu/2configs/base.nix @@ -39,6 +39,7 @@ with lib; ''; environment.systemPackages = with pkgs; [ + jq git vim gnumake diff --git a/makefu/2configs/cgit-retiolum.nix b/makefu/2configs/cgit-retiolum.nix index 7b8e3bc97..e10769335 100644 --- a/makefu/2configs/cgit-retiolum.nix +++ b/makefu/2configs/cgit-retiolum.nix @@ -1,10 +1,10 @@ { config, lib, pkgs, ... }: # TODO: remove tv lib :) -with import ../../4lib/tv { inherit lib pkgs; }; +with import ../../tv/4lib/{ inherit lib pkgs; }; let out = { - imports = [ ../../3modules/krebs/git.nix ]; + imports = [ ]; krebs.git = { enable = true; root-title = "public repositories "; -- cgit v1.2.3 From 671710c573980d859cb82993cd0514058a63262f Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 29 Jul 2015 14:22:24 +0200 Subject: makefu: add new git user makefu-omo --- Zpubkeys/makefu_omo.ssh.pub | 1 + makefu/0make/pnp.makefile | 4 ---- makefu/2configs/cgit-retiolum.nix | 24 +++++++++++++++++------- 3 files changed, 18 insertions(+), 11 deletions(-) create mode 100644 Zpubkeys/makefu_omo.ssh.pub delete mode 100644 makefu/0make/pnp.makefile diff --git a/Zpubkeys/makefu_omo.ssh.pub b/Zpubkeys/makefu_omo.ssh.pub new file mode 100644 index 000000000..5567040fb --- /dev/null +++ b/Zpubkeys/makefu_omo.ssh.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAtDhAxjiCH0SmTGNDqmlKPug9qTf+IFOVjdXfk01lAV2KMVW00CgNo2d5kl5+6pM99K7zZO7Uo7pmSFLSCAg8J6cMRI3v5OxFsnQfcJ9TeGLZt/ua7F8YsyIIr5wtqKtFbujqve31q9xJMypEpiX4np3nLiHfYwcWu7AFAUY8UHcCNl4JXm6hsmPe+9f6Mg2jICOdkfMMn0LtW+iq1KZpw1Nka2YUSiE2YuUtV+V+YaVMzdcjknkVkZNqcVk6tbJ1ZyZKM+bFEnE4VkHJYDABZfELpcgBAszfWrVG0QpEFjVCUq5atpIVHJcWWDx072r0zgdTPcBuzsHHC5PRfVBLEw== makefu@servarch diff --git a/makefu/0make/pnp.makefile b/makefu/0make/pnp.makefile deleted file mode 100644 index a18efe0e0..000000000 --- a/makefu/0make/pnp.makefile +++ /dev/null @@ -1,4 +0,0 @@ -deploy_host := root@pnp -nixpkgs_url := https://github.com/nixos/nixpkgs -nixpkgs_rev := 4c01e6d91993b6de128795f4fbdd25f6227fb870 -secrets_dir := /home/makefu/secrets/pnp diff --git a/makefu/2configs/cgit-retiolum.nix b/makefu/2configs/cgit-retiolum.nix index 777c16cfb..7dfb181c5 100644 --- a/makefu/2configs/cgit-retiolum.nix +++ b/makefu/2configs/cgit-retiolum.nix @@ -30,12 +30,13 @@ let post-receive = git.irc-announce { nick = config.networking.hostName; channel = "#retiolum"; + # TODO remove the hardcoded hostname server = "cd.retiolum"; }; }; }; - set-owners = with git; repo: user: + set-owners = with git;repo: user: singleton { inherit user; repo = [ repo ]; @@ -52,17 +53,26 @@ let # TODO: get the list of all krebsministers krebsminister = with config.krebs.users; [ lass tv uriel ]; - priv-rules = with config.krebs.users; repo: - set-owners repo [ makefu ]; + #all-makefu = with config.krebs.users; [ makefu ]; - krebs-rules = with config.krebs.users; repo: - set-owners repo [ makefu ] ++ set-ro-access repo krebsminister ; + + all-makefu = with config.krebs.users; [ makefu makefu-omo ]; + + priv-rules = repo: set-owners repo all-makefu; + + krebs-rules = repo: + set-owners repo all-makefu ++ set-ro-access repo krebsminister; in { - imports = [ ../../3modules/krebs/git.nix ]; + imports = [{ + krebs.users.makefu-omo = { + name = "makefu-omo" ; + pubkey= with builtins; readFile ../../Zpubkeys/makefu_omo.ssh.pub; + }; + }]; krebs.git = { enable = true; - root-title = "public repositories "; + root-title = "public repositories"; root-desc = "keep on krebsing"; inherit repos rules; }; -- cgit v1.2.3 From fe188078f3ee9536bb0eb5a63058346c75c8ab53 Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 29 Jul 2015 14:57:25 +0200 Subject: update path to new krebs lib --- makefu/3modules/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/makefu/3modules/default.nix b/makefu/3modules/default.nix index 45ca8c3eb..015f472f7 100644 --- a/makefu/3modules/default.nix +++ b/makefu/3modules/default.nix @@ -1,6 +1,6 @@ { config, lib, ... }: -with import ../../4lib/krebs { inherit lib; }; +with import ../../krebs/4lib { inherit lib; }; let cfg = config.krebs; -- cgit v1.2.3 From e5b8e2e4a4e15f587586d308b159d657bf0ede9c Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 29 Jul 2015 15:14:52 +0200 Subject: init: repunit --- makefu/1systems/repunit | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 makefu/1systems/repunit diff --git a/makefu/1systems/repunit b/makefu/1systems/repunit new file mode 100644 index 000000000..e69de29bb -- cgit v1.2.3