From 1e4658d0aef7b0cb5f889d3b66e35853730a942a Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 27 Oct 2020 19:32:27 +0100
Subject: switch to 20.09

---
 krebs/nixpkgs.json      | 6 +++---
 krebs/update-nixpkgs.sh | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index 161a099e..1f60931c 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
 {
   "url": "https://github.com/NixOS/nixpkgs",
-  "rev": "7c2a362b58a1c2ba72d24aa3869da3b1a91d39e1",
-  "date": "2020-10-20T09:32:31+02:00",
-  "sha256": "0gl4xndyahasa9dv5mi3x9w8s457wl2xh9lcldizcn1irjvkrzs4",
+  "rev": "95d26c9a9f2a102e25cf318a648de44537f42e09",
+  "date": "2020-10-24T10:37:53+02:00",
+  "sha256": "0ymhj252dq7z2ajdjsdz99h106ylm4vsmz5v3xiwsylcs4bz2nl8",
   "fetchSubmodules": false
 }
diff --git a/krebs/update-nixpkgs.sh b/krebs/update-nixpkgs.sh
index b0ffb6ad..9a0ea7ed 100755
--- a/krebs/update-nixpkgs.sh
+++ b/krebs/update-nixpkgs.sh
@@ -3,7 +3,7 @@ dir=$(dirname $0)
 oldrev=$(cat $dir/nixpkgs.json | jq -r .rev | sed 's/\(.\{7\}\).*/\1/')
 nix-shell -p nix-prefetch-git --run 'nix-prefetch-git \
   --url https://github.com/NixOS/nixpkgs \
-  --rev refs/heads/nixos-20.03' \
+  --rev refs/heads/nixos-20.09' \
 > $dir/nixpkgs.json
 newrev=$(cat $dir/nixpkgs.json | jq -r .rev | sed 's/\(.\{7\}\).*/\1/')
 git commit $dir/nixpkgs.json -m "nixpkgs: $oldrev -> $newrev"
-- 
cgit v1.2.3


From 26342f9bbbfab2ded2c03f11346094fa8d6971d1 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 27 Oct 2020 19:40:50 +0100
Subject: l morpheus.r: use new luks devices config

---
 lass/1systems/morpheus/physical.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/lass/1systems/morpheus/physical.nix b/lass/1systems/morpheus/physical.nix
index 3fb03cda..6e59a227 100644
--- a/lass/1systems/morpheus/physical.nix
+++ b/lass/1systems/morpheus/physical.nix
@@ -34,10 +34,7 @@
   };
   boot.initrd.luks = {
     cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
-    devices =  [{
-       name = "luksroot";
-       device = "/dev/nvme0n1p3";
-    }];
+    devices.luksroot.device = "/dev/nvme0n1p3";
   };
 
   services.udev.extraRules = ''
-- 
cgit v1.2.3


From de124026ab74fa9a3611e7fd6cdf54ad2273b79a Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 27 Oct 2020 19:47:38 +0100
Subject: remove deprecated dcso vpn

---
 lass/2configs/dcso-vpn.nix                         | 44 ----------------------
 lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem   |  0
 lass/2configs/tests/dummy-secrets/dcsovpn/cert.key |  0
 lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem |  0
 .../2configs/tests/dummy-secrets/dcsovpn/login.txt |  0
 5 files changed, 44 deletions(-)
 delete mode 100644 lass/2configs/dcso-vpn.nix
 delete mode 100644 lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem
 delete mode 100644 lass/2configs/tests/dummy-secrets/dcsovpn/cert.key
 delete mode 100644 lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem
 delete mode 100644 lass/2configs/tests/dummy-secrets/dcsovpn/login.txt

diff --git a/lass/2configs/dcso-vpn.nix b/lass/2configs/dcso-vpn.nix
deleted file mode 100644
index 0a5623bf..00000000
--- a/lass/2configs/dcso-vpn.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-with import <stockholm/lib>;
-{ ... }:
-
-{
-
-  users.extraUsers = {
-    dcsovpn = rec {
-      name = "dcsovpn";
-      uid = genid "dcsovpn";
-      description = "user for running dcso openvpn";
-      home = "/home/${name}";
-    };
-  };
-
-  users.extraGroups.dcsovpn.gid = genid "dcsovpn";
-
-  services.openvpn.servers = {
-    dcso = {
-      config = ''
-        client
-        dev tun
-        tun-mtu 1356
-        mssfix
-        proto udp
-        float
-        remote 217.111.55.41 1194
-        nobind
-        user dcsovpn
-        group dcsovpn
-        persist-key
-        persist-tun
-        ca ${toString <secrets/dcsovpn/ca.pem>}
-        cert ${toString <secrets/dcsovpn/cert.pem>}
-        key ${toString <secrets/dcsovpn/cert.key>}
-        verb 3
-        mute 20
-        auth-user-pass ${toString <secrets/dcsovpn/login.txt>}
-        route-method exe
-        route-delay 2
-      '';
-      updateResolvConf = true;
-    };
-  };
-}
diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem b/lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem
deleted file mode 100644
index e69de29b..00000000
diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/cert.key b/lass/2configs/tests/dummy-secrets/dcsovpn/cert.key
deleted file mode 100644
index e69de29b..00000000
diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem b/lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem
deleted file mode 100644
index e69de29b..00000000
diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/login.txt b/lass/2configs/tests/dummy-secrets/dcsovpn/login.txt
deleted file mode 100644
index e69de29b..00000000
-- 
cgit v1.2.3


From 80d1d762d91c2bbebc495a4c1633d0026b278272 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 27 Oct 2020 19:50:50 +0100
Subject: nixpkgs: 95d26c9 -> 13d0c31

---
 krebs/nixpkgs.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index 1f60931c..72f85ab3 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
 {
   "url": "https://github.com/NixOS/nixpkgs",
-  "rev": "95d26c9a9f2a102e25cf318a648de44537f42e09",
-  "date": "2020-10-24T10:37:53+02:00",
-  "sha256": "0ymhj252dq7z2ajdjsdz99h106ylm4vsmz5v3xiwsylcs4bz2nl8",
+  "rev": "13d0c311e3ae923a00f734b43fd1d35b47d8943a",
+  "date": "2020-10-27T08:58:28+01:00",
+  "sha256": "0izp5y55whbdaf26w3zy2xvkjvlll39lib1ifvb61ps9gmvlqn39",
   "fetchSubmodules": false
 }
-- 
cgit v1.2.3


From cb24733b91e40d82b8fb5b39ff08be1b0f68c512 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 27 Oct 2020 19:59:35 +0100
Subject: l uriel.r: use new luks devices config

---
 lass/1systems/uriel/physical.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lass/1systems/uriel/physical.nix b/lass/1systems/uriel/physical.nix
index 2d21f00d..82a08864 100644
--- a/lass/1systems/uriel/physical.nix
+++ b/lass/1systems/uriel/physical.nix
@@ -15,7 +15,7 @@
     loader.systemd-boot.enable = true;
     loader.timeout = 5;
 
-    initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; } ];
+    initrd.luks.devices.luksroot.device = "/dev/sda2";
     initrd.luks.cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
     initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
     #kernelModules = [ "kvm-intel" "msr" ];
-- 
cgit v1.2.3


From 2871761a933c3c63faff0cf13fd10e679ce87093 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 27 Oct 2020 20:20:12 +0100
Subject: l copyq: remove (broken) path extensions

---
 lass/2configs/copyq.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/lass/2configs/copyq.nix b/lass/2configs/copyq.nix
index 56c091a6..ed78699b 100644
--- a/lass/2configs/copyq.nix
+++ b/lass/2configs/copyq.nix
@@ -25,9 +25,6 @@ in {
     environment = {
       DISPLAY = ":${toString config.services.xserver.display}";
     };
-    path = with pkgs; [
-      qt5.full
-    ];
     serviceConfig = {
       SyslogIdentifier = "copyq";
       ExecStart = "${pkgs.copyq}/bin/copyq";
-- 
cgit v1.2.3


From 4ed62e280e52ce373c6f1a9c44c5d365c24f572c Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 27 Oct 2020 20:23:33 +0100
Subject: l icarus.r shodan.r: remove borken ssh-cryptsetup

---
 lass/1systems/icarus/config.nix | 1 -
 lass/1systems/shodan/config.nix | 2 --
 2 files changed, 3 deletions(-)

diff --git a/lass/1systems/icarus/config.nix b/lass/1systems/icarus/config.nix
index 8332e7c5..609da601 100644
--- a/lass/1systems/icarus/config.nix
+++ b/lass/1systems/icarus/config.nix
@@ -19,7 +19,6 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/syncthing.nix>
     <stockholm/lass/2configs/nfs-dl.nix>
     #<stockholm/lass/2configs/prism-share.nix>
-    <stockholm/lass/2configs/ssh-cryptsetup.nix>
     <stockholm/lass/2configs/network-manager.nix>
     <stockholm/lass/2configs/home-media.nix>
   ];
diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix
index e41c9bd1..9e01396b 100644
--- a/lass/1systems/shodan/config.nix
+++ b/lass/1systems/shodan/config.nix
@@ -15,8 +15,6 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/bitcoin.nix>
     <stockholm/lass/2configs/backup.nix>
     <stockholm/lass/2configs/blue-host.nix>
-    <stockholm/lass/2configs/green-host.nix>
-    <stockholm/lass/2configs/ssh-cryptsetup.nix>
     <stockholm/lass/2configs/nfs-dl.nix>
     <stockholm/lass/2configs/gg23.nix>
     <stockholm/lass/2configs/hass>
-- 
cgit v1.2.3


From 39f58ebd9a9b69ea11ec6fb432391ce661249dc2 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 27 Oct 2020 20:36:32 +0100
Subject: l domsen: remove obsolete nextcloud nginx

---
 lass/2configs/websites/domsen.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix
index a177a022..0714d937 100644
--- a/lass/2configs/websites/domsen.nix
+++ b/lass/2configs/websites/domsen.nix
@@ -97,7 +97,6 @@ in {
       overwriteProtocol = "https";
     };
     https = true;
-    nginx.enable = true;
   };
   services.nginx.virtualHosts."o.xanf.org" = {
     enableACME = true;
-- 
cgit v1.2.3


From fbbee5daca66332179e1efed442764b26718cfbe Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 27 Oct 2020 20:38:44 +0100
Subject: l websites: fix acme issues

---
 lass/2configs/websites/lassulus.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix
index 74585a6f..17df7131 100644
--- a/lass/2configs/websites/lassulus.nix
+++ b/lass/2configs/websites/lassulus.nix
@@ -16,7 +16,6 @@ in {
     email = "acme@lassul.us";
     acceptTerms = true;
     certs."lassul.us" = {
-      allowKeysForGroup = true;
       group = "lasscert";
     };
   };
@@ -78,7 +77,6 @@ in {
     email = "lassulus@lassul.us";
     webroot = "/var/lib/acme/acme-challenge";
     group = "nginx";
-    user = "nginx";
   };
 
 
-- 
cgit v1.2.3


From 239ff32905f60d6ef55e2fdb55fececd549da0b3 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 3 Nov 2020 18:57:46 +0100
Subject: reaktor2: 0.3.0 -> 0.4.0

---
 krebs/5pkgs/haskell/reaktor2/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/krebs/5pkgs/haskell/reaktor2/default.nix b/krebs/5pkgs/haskell/reaktor2/default.nix
index ae242efe..6a48f865 100644
--- a/krebs/5pkgs/haskell/reaktor2/default.nix
+++ b/krebs/5pkgs/haskell/reaktor2/default.nix
@@ -6,13 +6,13 @@
 , time, transformers, unagi-chan, unix, unordered-containers
 , vector, wai, warp
 }:
-mkDerivation {
+mkDerivation rec {
   pname = "reaktor2";
-  version = "0.3.0";
+  version = "0.4.0";
   src = fetchgit {
     url = "https://cgit.krebsco.de/reaktor2";
-    sha256 = "02hqpq8wcfd6rvi8qk10zy3f3lrzzqnjwqal4cbvksjn3vahz36h";
-    rev = "a6893c00f78a8acd0a4bfe7da87ab6889eabcf21";
+    sha256 = "0bnn23hjl57y0a5rf3h8kq078dziby7il7fandz5wh6s4i3psicp";
+    rev = "v${version}";
     fetchSubmodules = true;
   };
   isLibrary = false;
-- 
cgit v1.2.3


From bd1c82c769dea90c1171988a57fb71f715447379 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 3 Nov 2020 20:19:15 +0100
Subject: krebs: activate nscd again

---
 krebs/2configs/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/krebs/2configs/default.nix b/krebs/2configs/default.nix
index 3442272e..f56f6045 100644
--- a/krebs/2configs/default.nix
+++ b/krebs/2configs/default.nix
@@ -43,7 +43,6 @@ with import <stockholm/lib>;
     ];
   };
   services.cron.enable = false;
-  services.nscd.enable = false;
   services.ntp.enable = false;
 
   users.mutableUsers = false;
-- 
cgit v1.2.3


From 88b343292bf15269d1df3dd23198fa90c97ef485 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 3 Nov 2020 20:40:28 +0100
Subject: github-hosts-sync: fix deprecated user definition

---
 krebs/3modules/github-hosts-sync.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix
index 0b7d5609..7d618ebf 100644
--- a/krebs/3modules/github-hosts-sync.nix
+++ b/krebs/3modules/github-hosts-sync.nix
@@ -62,8 +62,8 @@ let
       };
     };
 
-    users.extraUsers = singleton {
-      inherit (user) name uid;
+    users.users.${user.name} = {
+      inherit (user) uid;
       home = cfg.dataDir;
     };
   };
-- 
cgit v1.2.3


From 975138fc175e4d559e271beed52e8bf2ced47393 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 3 Nov 2020 20:56:36 +0100
Subject: reaktor2: disable stockholm issue cause lentil is broken

---
 krebs/2configs/reaktor2.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/2configs/reaktor2.nix b/krebs/2configs/reaktor2.nix
index b80198b0..473028f9 100644
--- a/krebs/2configs/reaktor2.nix
+++ b/krebs/2configs/reaktor2.nix
@@ -95,7 +95,7 @@ let
         }
         hooks.sed
         (generators.command_hook {
-          inherit (commands) hello random-emoji nixos-version stockholm-issue;
+          inherit (commands) hello random-emoji nixos-version;
           tell = {
             filename =
               "${pkgs.Reaktor.src}/reaktor/commands/tell-on_privmsg";
-- 
cgit v1.2.3


From 4e08eb5dffbfc9707633b6d30e200bb993185db2 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Tue, 3 Nov 2020 22:59:13 +0100
Subject: puyak.r,wolf.r: move all services from wolf to puyak

---
 krebs/1systems/puyak/config.nix      | 79 +++++++++++++++++++++++++++++++++++-
 krebs/1systems/wolf/config.nix       | 76 ----------------------------------
 makefu/2configs/urlwatch/default.nix |  1 +
 3 files changed, 79 insertions(+), 77 deletions(-)

diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix
index 08a3392b..fb7d01e7 100644
--- a/krebs/1systems/puyak/config.nix
+++ b/krebs/1systems/puyak/config.nix
@@ -13,13 +13,90 @@
     <stockholm/krebs/2configs/ircd.nix>
     <stockholm/krebs/2configs/news.nix>
     <stockholm/krebs/2configs/news-spam.nix>
+    ###   shackspace
+    # handle the worlddomination map via coap
+    <stockholm/krebs/2configs/shack/worlddomination.nix>
     <stockholm/krebs/2configs/shack/ssh-keys.nix>
+
+    # drivedroid.shack for shackphone
+    <stockholm/krebs/2configs/shack/drivedroid.nix>
+    # <stockholm/krebs/2configs/shack/nix-cacher.nix>
+    # Say if muell will be collected
+    <stockholm/krebs/2configs/shack/muell_caller.nix>
+    # provide muellshack api
+    <stockholm/krebs/2configs/shack/muellshack.nix>
+    # provide light control api
+    <stockholm/krebs/2configs/shack/node-light.nix>
+    # light.shack web-ui
+    <stockholm/krebs/2configs/shack/light.shack.nix>
+    # send mail if muell was not handled
+    <stockholm/krebs/2configs/shack/muell_mail.nix>
+    # send mail if muell was not handled
+    <stockholm/krebs/2configs/shack/s3-power.nix>
+    # powerraw usb serial to mqtt and raw socket
+    <stockholm/krebs/2configs/shack/powerraw.nix>
+
+    { # do not log to /var/spool/log
+      services.nginx.appendHttpConfig = ''
+          map $request_method $loggable {
+            default 1;
+            GET 0;
+          }
+          log_format vhost '$host $remote_addr - $remote_user '
+                     '[$time_local] "$request" $status '
+                     '$body_bytes_sent "$http_referer" '
+                     '"$http_user_agent"';
+          error_log stderr;
+          access_log syslog:server=unix:/dev/log vhost;
+      '';
+      services.journald.rateLimitBurst = 10000;
+    }
+
+    # create samba share for anonymous usage with the laser and 3d printer pc
+    <stockholm/krebs/2configs/shack/share.nix>
+
+    # mobile.lounge.mpd.shack
+    <stockholm/krebs/2configs/shack/mobile.mpd.nix>
+
+    # hass.shack
+    <stockholm/krebs/2configs/shack/glados>
+
+    # connect to git.shackspace.de as group runner for rz
+    <stockholm/krebs/2configs/shack/gitlab-runner.nix>
+
+    # Statistics collection and visualization
+    # <stockholm/krebs/2configs/shack/graphite.nix> # graphiteApi is broken and unused(hopefully)
+    ## Collect data from mqtt.shack and store in graphite database
+    <stockholm/krebs/2configs/shack/mqtt_sub.nix>
+    ## Collect radioactive data and put into graphite
+    <stockholm/krebs/2configs/shack/radioactive.nix>
+    ## mqtt.shack
+    <stockholm/krebs/2configs/shack/mqtt.nix>
+    ## influx.shack
+    <stockholm/krebs/2configs/shack/influx.nix>
+
+    ## Collect local statistics via collectd and send to collectd
+    <stockholm/krebs/2configs/stats/shack-client.nix>
+    <stockholm/krebs/2configs/stats/shack-debugging.nix>
+
+    <stockholm/krebs/2configs/shack/netbox.nix>
+    # prometheus.shack
+    #<stockholm/krebs/2configs/shack/prometheus/server.nix>
+    <stockholm/krebs/2configs/shack/prometheus/node.nix>
+    #<stockholm/krebs/2configs/shack/prometheus/unifi.nix>
+    # grafana.shack
+    <stockholm/krebs/2configs/shack/grafana.nix>
+
+    # shackdns.shack
+    # replacement for leases.shack and shackles.shack
+    <stockholm/krebs/2configs/shack/shackDNS.nix>
+
+    # monitoring: prometheus.shack
     <stockholm/krebs/2configs/shack/prometheus/node.nix>
     <stockholm/krebs/2configs/shack/prometheus/server.nix>
     <stockholm/krebs/2configs/shack/prometheus/blackbox.nix>
     <stockholm/krebs/2configs/shack/prometheus/unifi.nix>
     <stockholm/krebs/2configs/shack/prometheus/alertmanager-telegram.nix>
-    <stockholm/krebs/2configs/shack/gitlab-runner.nix>
 
     ## Collect local statistics via collectd and send to collectd
     <stockholm/krebs/2configs/stats/shack-client.nix>
diff --git a/krebs/1systems/wolf/config.nix b/krebs/1systems/wolf/config.nix
index 0160f9eb..eff09630 100644
--- a/krebs/1systems/wolf/config.nix
+++ b/krebs/1systems/wolf/config.nix
@@ -14,82 +14,6 @@ in
     <stockholm/krebs/2configs/binary-cache/nixos.nix>
     <stockholm/krebs/2configs/binary-cache/prism.nix>
 
-    # handle the worlddomination map via coap
-    <stockholm/krebs/2configs/shack/worlddomination.nix>
-    <stockholm/krebs/2configs/shack/ssh-keys.nix>
-
-    # drivedroid.shack for shackphone
-    <stockholm/krebs/2configs/shack/drivedroid.nix>
-    # <stockholm/krebs/2configs/shack/nix-cacher.nix>
-    # Say if muell will be collected
-    <stockholm/krebs/2configs/shack/muell_caller.nix>
-    # provide muellshack api
-    <stockholm/krebs/2configs/shack/muellshack.nix>
-    # provide light control api
-    <stockholm/krebs/2configs/shack/node-light.nix>
-    # light.shack web-ui
-    <stockholm/krebs/2configs/shack/light.shack.nix>
-    # send mail if muell was not handled
-    <stockholm/krebs/2configs/shack/muell_mail.nix>
-    # send mail if muell was not handled
-    <stockholm/krebs/2configs/shack/s3-power.nix>
-    # powerraw usb serial to mqtt and raw socket
-    <stockholm/krebs/2configs/shack/powerraw.nix>
-
-    { # do not log to /var/spool/log
-      services.nginx.appendHttpConfig = ''
-          map $request_method $loggable {
-            default 1;
-            GET 0;
-          }
-          log_format vhost '$host $remote_addr - $remote_user '
-                     '[$time_local] "$request" $status '
-                     '$body_bytes_sent "$http_referer" '
-                     '"$http_user_agent"';
-          error_log stderr;
-          access_log syslog:server=unix:/dev/log vhost;
-      '';
-      services.journald.rateLimitBurst = 10000;
-    }
-
-    # create samba share for anonymous usage with the laser and 3d printer pc
-    <stockholm/krebs/2configs/shack/share.nix>
-
-    # mobile.lounge.mpd.shack
-    <stockholm/krebs/2configs/shack/mobile.mpd.nix>
-
-    # hass.shack
-    <stockholm/krebs/2configs/shack/glados>
-
-    # connect to git.shackspace.de as group runner for rz
-    <stockholm/krebs/2configs/shack/gitlab-runner.nix>
-
-    # Statistics collection and visualization
-    # <stockholm/krebs/2configs/shack/graphite.nix> # graphiteApi is broken and unused(hopefully)
-    ## Collect data from mqtt.shack and store in graphite database
-    <stockholm/krebs/2configs/shack/mqtt_sub.nix>
-    ## Collect radioactive data and put into graphite
-    <stockholm/krebs/2configs/shack/radioactive.nix>
-    ## mqtt.shack
-    <stockholm/krebs/2configs/shack/mqtt.nix>
-    ## influx.shack
-    <stockholm/krebs/2configs/shack/influx.nix>
-
-    ## Collect local statistics via collectd and send to collectd
-    <stockholm/krebs/2configs/stats/shack-client.nix>
-    <stockholm/krebs/2configs/stats/shack-debugging.nix>
-
-    <stockholm/krebs/2configs/shack/netbox.nix>
-    # prometheus.shack
-    #<stockholm/krebs/2configs/shack/prometheus/server.nix>
-    <stockholm/krebs/2configs/shack/prometheus/node.nix>
-    #<stockholm/krebs/2configs/shack/prometheus/unifi.nix>
-    # grafana.shack
-    <stockholm/krebs/2configs/shack/grafana.nix>
-
-    # shackdns.shack
-    # replacement for leases.shack and shackles.shack
-    <stockholm/krebs/2configs/shack/shackDNS.nix>
 
     # misc
     <stockholm/krebs/2configs/save-diskspace.nix>
diff --git a/makefu/2configs/urlwatch/default.nix b/makefu/2configs/urlwatch/default.nix
index 838c2627..5b059a3b 100644
--- a/makefu/2configs/urlwatch/default.nix
+++ b/makefu/2configs/urlwatch/default.nix
@@ -34,6 +34,7 @@ in {
       https://pypi.python.org/simple/pyserial/
       https://pypi.python.org/simple/semantic_version/
       # weird shit
+      https://www.zigbee2mqtt.io/information/supported_adapters.html
       http://ftp.debian.org/debian/pool/main/a/apt-cacher-ng/
       https://erdgeist.org/gitweb/opentracker/info/refs?service=git-upload-pack
 
-- 
cgit v1.2.3


From fd0a2c3c309fd4d86d0c8b4e4472bf828954fd1f Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 4 Nov 2020 08:51:34 +0100
Subject: wolf.r: re-add shack ssh keys

---
 krebs/1systems/wolf/config.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/krebs/1systems/wolf/config.nix b/krebs/1systems/wolf/config.nix
index eff09630..0c95f4d1 100644
--- a/krebs/1systems/wolf/config.nix
+++ b/krebs/1systems/wolf/config.nix
@@ -14,9 +14,13 @@ in
     <stockholm/krebs/2configs/binary-cache/nixos.nix>
     <stockholm/krebs/2configs/binary-cache/prism.nix>
 
+    #### shackspace services
+    <stockholm/krebs/2configs/shack/share.nix>
 
     # misc
+    <stockholm/krebs/2configs/shack/ssh-keys.nix>
     <stockholm/krebs/2configs/save-diskspace.nix>
+    <stockholm/krebs/2configs/shack/prometheus/node.nix>
 
   ];
   # use your own binary cache, fallback use cache.nixos.org (which is used by
-- 
cgit v1.2.3


From 696f6a534a7e193fa726692bcdeb968a68b61612 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 4 Nov 2020 23:01:50 +0100
Subject: puyak.r: cleanup imports

---
 krebs/1systems/puyak/config.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix
index fb7d01e7..827f984d 100644
--- a/krebs/1systems/puyak/config.nix
+++ b/krebs/1systems/puyak/config.nix
@@ -79,11 +79,9 @@
     <stockholm/krebs/2configs/stats/shack-client.nix>
     <stockholm/krebs/2configs/stats/shack-debugging.nix>
 
-    <stockholm/krebs/2configs/shack/netbox.nix>
-    # prometheus.shack
-    #<stockholm/krebs/2configs/shack/prometheus/server.nix>
-    <stockholm/krebs/2configs/shack/prometheus/node.nix>
-    #<stockholm/krebs/2configs/shack/prometheus/unifi.nix>
+    ## netbox.shack: Netbox is disabled as nobody seems to be using it anyway
+    # <stockholm/krebs/2configs/shack/netbox.nix>
+
     # grafana.shack
     <stockholm/krebs/2configs/shack/grafana.nix>
 
-- 
cgit v1.2.3


From a23066a27e0c7c448912d71d0ece0c92420b3671 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 5 Nov 2020 10:30:05 +0100
Subject: ma minimal: keep nscd enabled

---
 makefu/2configs/minimal.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/makefu/2configs/minimal.nix b/makefu/2configs/minimal.nix
index 78a9dcfa..445e6c57 100644
--- a/makefu/2configs/minimal.nix
+++ b/makefu/2configs/minimal.nix
@@ -82,5 +82,4 @@
     "net.ipv6.conf.default.use_tempaddr" = 2;
   };
 
-  services.nscd.enable = false;
 }
-- 
cgit v1.2.3


From 4bd6d7a13c982b87f0792bc346ab2e9293f4adff Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Thu, 5 Nov 2020 12:00:42 +0100
Subject: nscd-fix: RIP

---
 krebs/1systems/hotdog/config.nix |  1 -
 krebs/2configs/nscd-fix.nix      | 24 ------------------------
 lass/2configs/default.nix        |  1 -
 3 files changed, 26 deletions(-)
 delete mode 100644 krebs/2configs/nscd-fix.nix

diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix
index bb84b187..c0fa3828 100644
--- a/krebs/1systems/hotdog/config.nix
+++ b/krebs/1systems/hotdog/config.nix
@@ -12,7 +12,6 @@
     <stockholm/krebs/2configs/buildbot-stockholm.nix>
     <stockholm/krebs/2configs/binary-cache/nixos.nix>
     <stockholm/krebs/2configs/ircd.nix>
-    <stockholm/krebs/2configs/nscd-fix.nix>
     <stockholm/krebs/2configs/reaktor2.nix>
     <stockholm/krebs/2configs/wiki.nix>
   ];
diff --git a/krebs/2configs/nscd-fix.nix b/krebs/2configs/nscd-fix.nix
deleted file mode 100644
index 8e5909e7..00000000
--- a/krebs/2configs/nscd-fix.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-with import <stockholm/lib>;
-{ pkgs, ... }: let
-
-  enable = versionOlderThan "19.03";
-
-  versionOlderThan = v:
-    compareVersions
-      (versions.majorMinor version)
-      (versions.majorMinor v)
-      == -1;
-
-  warning = ''
-    Using custom services.nscd.config because
-    https://github.com/NixOS/nixpkgs/pull/50316
-  '';
-
-in
-  optionalAttrs enable (trace warning {
-    services.nscd.enable = mkForce true;
-    services.nscd.config = mkForce (readFile (pkgs.fetchurl {
-      url = https://raw.githubusercontent.com/arianvp/nixpkgs/1d5f4cb/nixos/modules/services/system/nscd.conf;
-      sha256 = "1jlddk38lyynjn51zx3xi1nc29ahajyh0qg48qbq6dqlsrn3wxqs";
-    }));
-  })
diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix
index f59988b7..babcb51d 100644
--- a/lass/2configs/default.nix
+++ b/lass/2configs/default.nix
@@ -2,7 +2,6 @@ with import <stockholm/lib>;
 { config, pkgs, ... }:
 {
   imports = [
-    <stockholm/krebs/2configs/nscd-fix.nix>
     ./binary-cache/client.nix
     ./backup.nix
     ./gc.nix
-- 
cgit v1.2.3


From 27cf7317f21cba168b18b52fed45cba94a633db8 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Thu, 5 Nov 2020 12:14:53 +0100
Subject: alertmanager-bot-telegram: modSha -> vendorSha

---
 krebs/5pkgs/simple/alertmanager-bot-telegram/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/5pkgs/simple/alertmanager-bot-telegram/default.nix b/krebs/5pkgs/simple/alertmanager-bot-telegram/default.nix
index f0e22140..a8440745 100644
--- a/krebs/5pkgs/simple/alertmanager-bot-telegram/default.nix
+++ b/krebs/5pkgs/simple/alertmanager-bot-telegram/default.nix
@@ -11,7 +11,7 @@ buildGoModule rec {
     sha256 = "09cciml1j8x76jpm2v5v6h2q6j1fkhsz1kswslmx8wl4wk40xgp4";
   };
 
-  modSha256 = "0nlnxkpcna7g7qslyz5i1619paw4jkb1ma4fgpsgvgx1spwrjm8h";
+  vendorSha256 = "0nlnxkpcna7g7qslyz5i1619paw4jkb1ma4fgpsgvgx1spwrjm8h";
   postInstall = ''
     install -D ./default.tmpl $out/templates/default.tmpl
   '';
-- 
cgit v1.2.3


From b12308aba18b523ea6f819bd9de98d7346ec19be Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Thu, 5 Nov 2020 13:20:33 +0100
Subject: ma minimal: activate nscd again

---
 makefu/2configs/minimal.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/makefu/2configs/minimal.nix b/makefu/2configs/minimal.nix
index 78a9dcfa..d4feb998 100644
--- a/makefu/2configs/minimal.nix
+++ b/makefu/2configs/minimal.nix
@@ -81,6 +81,4 @@
     "net.ipv6.conf.all.use_tempaddr" = 2;
     "net.ipv6.conf.default.use_tempaddr" = 2;
   };
-
-  services.nscd.enable = false;
 }
-- 
cgit v1.2.3


From f36fd9b46ffe1898792b59709efffcce43d468e2 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Thu, 5 Nov 2020 16:38:42 +0100
Subject: jeschli: disable most hosts in ci

---
 krebs/3modules/jeschli/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/krebs/3modules/jeschli/default.nix b/krebs/3modules/jeschli/default.nix
index 75d7eda6..390f7585 100644
--- a/krebs/3modules/jeschli/default.nix
+++ b/krebs/3modules/jeschli/default.nix
@@ -12,6 +12,7 @@ with import <stockholm/lib>;
 in {
   hosts = mapAttrs hostDefaults {
     brauerei = {
+      ci = false;
       nets = {
         retiolum = {
           ip4.addr = "10.243.27.29";
@@ -93,6 +94,7 @@ in {
     };
 
     bolide = {
+      ci = false;
       nets = {
         retiolum = {
           ip4.addr = "10.243.27.31";
@@ -130,6 +132,7 @@ in {
     };
 
     reagenzglas = {
+      ci = false;
       nets = {
         retiolum = {
           ip4.addr = "10.243.27.32";
-- 
cgit v1.2.3


From 34ac9e7143658b4edfcfc3a8930614005a30bf90 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Thu, 5 Nov 2020 16:56:27 +0100
Subject: filebitch.r: fix luks devices syntax

---
 .../1systems/filebitch/hardware-configuration.nix  | 28 ++++++++++------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/krebs/1systems/filebitch/hardware-configuration.nix b/krebs/1systems/filebitch/hardware-configuration.nix
index 574618e3..1e7fa787 100644
--- a/krebs/1systems/filebitch/hardware-configuration.nix
+++ b/krebs/1systems/filebitch/hardware-configuration.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 let
   byid = dev: "/dev/disk/by-id/" + dev;
-  keyFile = byid "usb-SMI_USB_DISK_AA08061700009650-0:0"; 
+  keyFile = byid "usb-SMI_USB_DISK_AA08061700009650-0:0";
 in
 {
   imports =
@@ -19,7 +19,7 @@ in
   boot.tmpOnTmpfs = true;
 
 
-  boot.initrd.availableKernelModules = [ 
+  boot.initrd.availableKernelModules = [
     "xhci_pci" "ahci" "ohci_pci" "ehci_pci" "usb_storage" "usbhid" "sd_mod"
     "raid456"
     "usbhid"
@@ -77,20 +77,18 @@ in
 
   networking.hostId = "54d97450"; # required for zfs use
   boot.initrd.luks.devices = let
-        usbkey = name: device: {
-          inherit name device keyFile;
+        usbkey = device: {
+          inherit device keyFile;
           keyFileSize = 2048;
           preLVM = true;
         };
-  in [
-    ((usbkey "swap" (byid "ata-INTEL_SSDSA2M080G2GC_CVPO013300WD080BGN-part2"))
-    // { allowDiscards = true; } )
-    ((usbkey "root" (byid "ata-INTEL_SSDSA2M080G2GC_CVPO013300WD080BGN-part3"))
-    // { allowDiscards = true; } )
-    (usbkey "125" "/dev/md125")
-    (usbkey "126" "/dev/md126")
-    (usbkey "127" "/dev/md127")
-  ];
-
-
+  in {
+    swap = ((usbkey (byid "ata-INTEL_SSDSA2M080G2GC_CVPO013300WD080BGN-part2"))
+      // { allowDiscards = true; } );
+    root = ((usbkey (byid "ata-INTEL_SSDSA2M080G2GC_CVPO013300WD080BGN-part3"))
+      // { allowDiscards = true; } );
+    md125 = usbkey "/dev/md125";
+    md126 = usbkey "/dev/md126";
+    md127 = usbkey "/dev/md127";
+  };
 }
-- 
cgit v1.2.3


From 9919cb25912dfcc50881239f95494dd2f8e7b858 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 5 Nov 2020 22:14:09 +0100
Subject: puyak.r: initrd bootstrapping via tor

---
 krebs/1systems/puyak/config.nix |  6 +++++
 krebs/2configs/tor/initrd.nix   | 50 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)
 create mode 100644 krebs/2configs/tor/initrd.nix

diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix
index 827f984d..3357964e 100644
--- a/krebs/1systems/puyak/config.nix
+++ b/krebs/1systems/puyak/config.nix
@@ -7,12 +7,18 @@
     <stockholm/krebs/2configs/secret-passwords.nix>
     <stockholm/krebs/2configs/hw/x220.nix>
 
+
+    ## initrd unlocking
+    # (brain hosts/puyak/luks-ssd;echo)  | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
+    <stockholm/krebs/2configs/tor/initrd.nix>
+
     <stockholm/krebs/2configs/binary-cache/nixos.nix>
     <stockholm/krebs/2configs/binary-cache/prism.nix>
     <stockholm/krebs/2configs/go.nix>
     <stockholm/krebs/2configs/ircd.nix>
     <stockholm/krebs/2configs/news.nix>
     <stockholm/krebs/2configs/news-spam.nix>
+
     ###   shackspace
     # handle the worlddomination map via coap
     <stockholm/krebs/2configs/shack/worlddomination.nix>
diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix
new file mode 100644
index 00000000..cb6008f7
--- /dev/null
+++ b/krebs/2configs/tor/initrd.nix
@@ -0,0 +1,50 @@
+{config, pkgs, ... }:
+## unlock command:
+# (brain hosts/puyak/luks-ssd;echo)  | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
+{
+  boot.initrd.network.enable = true;
+  boot.initrd.network.ssh = {
+    enable = true;
+    port = 22;
+    authorizedKeys = [
+      config.krebs.users.jeschli-brauerei.pubkey
+      config.krebs.users.lass.pubkey
+      config.krebs.users.lass-mors.pubkey
+      config.krebs.users.makefu.pubkey
+      config.krebs.users.tv.pubkey
+    ];
+    hostECDSAKey = <secrets/initrd/host_ecdsa_key>;
+  };
+  boot.initrd.availableKernelModules = [ "e1000e" ];
+
+  boot.initrd.secrets = {
+    "/etc/tor/onion/bootup" = <secrets/initrd>;
+  };
+
+  boot.initrd.extraUtilsCommands = ''
+    copy_bin_and_libs ${pkgs.tor}/bin/tor
+  '';
+
+  # start tor during boot process
+  boot.initrd.network.postCommands = let
+    torRc = (pkgs.writeText "tor.rc" ''
+      DataDirectory /etc/tor
+      SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+      SOCKSPort 127.0.0.1:9063
+      HiddenServiceDir /etc/tor/onion/bootup
+      HiddenServicePort 22 127.0.0.1:22
+    '');
+  in ''
+    echo "tor: preparing onion folder"
+    # have to do this otherwise tor does not want to start
+    chmod -R 700 /etc/tor
+
+    echo "make sure localhost is up"
+    ip a a 127.0.0.1/8 dev lo
+    ip link set lo up
+
+    echo "tor: starting tor"
+    tor -f ${torRc} --verify-config
+    tor -f ${torRc} &
+  '';
+}
-- 
cgit v1.2.3


From 430dad522cfc6d19329c323e009f47dc0cdc9250 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 5 Nov 2020 22:25:24 +0100
Subject: krebs dummy-secrets: add initrd

---
 krebs/0tests/data/secrets/initrd/host_ecdsa.pub        | 0
 krebs/0tests/data/secrets/initrd/host_ecdsa_key        | 0
 krebs/0tests/data/secrets/initrd/hostname              | 0
 krebs/0tests/data/secrets/initrd/hs_ed25519_public_key | 0
 krebs/0tests/data/secrets/initrd/hs_ed25519_secret_key | 0
 5 files changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 krebs/0tests/data/secrets/initrd/host_ecdsa.pub
 create mode 100644 krebs/0tests/data/secrets/initrd/host_ecdsa_key
 create mode 100644 krebs/0tests/data/secrets/initrd/hostname
 create mode 100644 krebs/0tests/data/secrets/initrd/hs_ed25519_public_key
 create mode 100644 krebs/0tests/data/secrets/initrd/hs_ed25519_secret_key

diff --git a/krebs/0tests/data/secrets/initrd/host_ecdsa.pub b/krebs/0tests/data/secrets/initrd/host_ecdsa.pub
new file mode 100644
index 00000000..e69de29b
diff --git a/krebs/0tests/data/secrets/initrd/host_ecdsa_key b/krebs/0tests/data/secrets/initrd/host_ecdsa_key
new file mode 100644
index 00000000..e69de29b
diff --git a/krebs/0tests/data/secrets/initrd/hostname b/krebs/0tests/data/secrets/initrd/hostname
new file mode 100644
index 00000000..e69de29b
diff --git a/krebs/0tests/data/secrets/initrd/hs_ed25519_public_key b/krebs/0tests/data/secrets/initrd/hs_ed25519_public_key
new file mode 100644
index 00000000..e69de29b
diff --git a/krebs/0tests/data/secrets/initrd/hs_ed25519_secret_key b/krebs/0tests/data/secrets/initrd/hs_ed25519_secret_key
new file mode 100644
index 00000000..e69de29b
-- 
cgit v1.2.3


From 32b9762495f44c0869f623c569fcb1cbea03c486 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Wed, 11 Nov 2020 18:12:22 +0100
Subject: l: delete legacy secrets

---
 lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem    | 0
 lass/2configs/tests/dummy-secrets/dcsovpn/cert.key  | 0
 lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem  | 0
 lass/2configs/tests/dummy-secrets/dcsovpn/login.txt | 0
 4 files changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem
 delete mode 100644 lass/2configs/tests/dummy-secrets/dcsovpn/cert.key
 delete mode 100644 lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem
 delete mode 100644 lass/2configs/tests/dummy-secrets/dcsovpn/login.txt

diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem b/lass/2configs/tests/dummy-secrets/dcsovpn/ca.pem
deleted file mode 100644
index e69de29b..00000000
diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/cert.key b/lass/2configs/tests/dummy-secrets/dcsovpn/cert.key
deleted file mode 100644
index e69de29b..00000000
diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem b/lass/2configs/tests/dummy-secrets/dcsovpn/cert.pem
deleted file mode 100644
index e69de29b..00000000
diff --git a/lass/2configs/tests/dummy-secrets/dcsovpn/login.txt b/lass/2configs/tests/dummy-secrets/dcsovpn/login.txt
deleted file mode 100644
index e69de29b..00000000
-- 
cgit v1.2.3


From 2408e07fd303eb74648c785b84cca3fa82a490f5 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Thu, 12 Nov 2020 22:54:33 +0100
Subject: nixpkgs: 13d0c31 -> 896270d

---
 krebs/nixpkgs.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index 72f85ab3..68d95020 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
 {
   "url": "https://github.com/NixOS/nixpkgs",
-  "rev": "13d0c311e3ae923a00f734b43fd1d35b47d8943a",
-  "date": "2020-10-27T08:58:28+01:00",
-  "sha256": "0izp5y55whbdaf26w3zy2xvkjvlll39lib1ifvb61ps9gmvlqn39",
+  "rev": "896270d629efd47d14972e96f4fbb79fc9f45c80",
+  "date": "2020-11-10T22:42:32+01:00",
+  "sha256": "0xmjjayg19wm6cn88sh724mrsdj6mgrql6r3zc0g4x9bx4y342p7",
   "fetchSubmodules": false
 }
-- 
cgit v1.2.3


From 5e6f56889580d4e2924491a7f471d7994b35212f Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 12 Nov 2020 10:28:14 +0100
Subject: puyak,wolf: add documentation for imports

update share
---
 krebs/1systems/puyak/config.nix | 20 ++++++++++++--------
 krebs/1systems/wolf/config.nix  |  4 +++-
 krebs/2configs/shack/share.nix  |  3 +++
 3 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix
index 3357964e..0cadc3a1 100644
--- a/krebs/1systems/puyak/config.nix
+++ b/krebs/1systems/puyak/config.nix
@@ -27,20 +27,24 @@
     # drivedroid.shack for shackphone
     <stockholm/krebs/2configs/shack/drivedroid.nix>
     # <stockholm/krebs/2configs/shack/nix-cacher.nix>
+
     # Say if muell will be collected
     <stockholm/krebs/2configs/shack/muell_caller.nix>
-    # provide muellshack api
+    # provide muellshack api: muell.shack
     <stockholm/krebs/2configs/shack/muellshack.nix>
-    # provide light control api
-    <stockholm/krebs/2configs/shack/node-light.nix>
-    # light.shack web-ui
-    <stockholm/krebs/2configs/shack/light.shack.nix>
     # send mail if muell was not handled
     <stockholm/krebs/2configs/shack/muell_mail.nix>
-    # send mail if muell was not handled
-    <stockholm/krebs/2configs/shack/s3-power.nix>
+
+    # provide light control api
+    <stockholm/krebs/2configs/shack/node-light.nix> # light.shack lounge.light.shack power.light.shack openhab.shack lightapi.shack
+    # light.shack web-ui
+    <stockholm/krebs/2configs/shack/light.shack.nix> #light.shack
+
     # powerraw usb serial to mqtt and raw socket
-    <stockholm/krebs/2configs/shack/powerraw.nix>
+    <stockholm/krebs/2configs/shack/powerraw.nix> # powerraw.shack standby.shack
+    # send power stats to s3
+    <stockholm/krebs/2configs/shack/s3-power.nix> # powerraw.shack must be available
+
 
     { # do not log to /var/spool/log
       services.nginx.appendHttpConfig = ''
diff --git a/krebs/1systems/wolf/config.nix b/krebs/1systems/wolf/config.nix
index 0c95f4d1..25e7c5f0 100644
--- a/krebs/1systems/wolf/config.nix
+++ b/krebs/1systems/wolf/config.nix
@@ -15,8 +15,10 @@ in
     <stockholm/krebs/2configs/binary-cache/prism.nix>
 
     #### shackspace services
-    <stockholm/krebs/2configs/shack/share.nix>
+    <stockholm/krebs/2configs/shack/share.nix> # wolf.shack
 
+    # gitlab runner
+    <stockholm/krebs/2configs/shack/gitlab-runner.nix>
     # misc
     <stockholm/krebs/2configs/shack/ssh-keys.nix>
     <stockholm/krebs/2configs/save-diskspace.nix>
diff --git a/krebs/2configs/shack/share.nix b/krebs/2configs/shack/share.nix
index 465d6ef6..d8d65d30 100644
--- a/krebs/2configs/shack/share.nix
+++ b/krebs/2configs/shack/share.nix
@@ -37,6 +37,9 @@
       # for legacy systems
       client min protocol = NT1
       server min protocol = NT1
+      workgroup = WORKGROUP
+      server string = ${config.networking.hostName}
+      netbios name = ${config.networking.hostName}
     '';
   };
 }
-- 
cgit v1.2.3


From 3fdd49c0d4cafd6dcfcbffeb41441986a6331d8e Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 21:22:52 +0100
Subject: ma omo.r: enable direct connect to gum share

---
 makefu/1systems/omo/config.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/makefu/1systems/omo/config.nix b/makefu/1systems/omo/config.nix
index dd89b405..cbe97e28 100644
--- a/makefu/1systems/omo/config.nix
+++ b/makefu/1systems/omo/config.nix
@@ -47,6 +47,7 @@ in {
       # <stockholm/makefu/2configs/legacy_only.nix>
 
       <stockholm/makefu/2configs/share/omo.nix>
+      <stockholm/makefu/2configs/share/gum-client.nix>
       <stockholm/makefu/2configs/dcpp/airdcpp.nix>
       { krebs.airdcpp.dcpp.shares = let
           d = path: "/media/cryptX/${path}";
-- 
cgit v1.2.3


From 94b6aea2cd6af0454577bf3ba69cfdfd130f928b Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 21:31:17 +0100
Subject: ma bureautomation/kalauerbot: enterprise restart after 12h

---
 makefu/2configs/bureautomation/kalauerbot.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/makefu/2configs/bureautomation/kalauerbot.nix b/makefu/2configs/bureautomation/kalauerbot.nix
index d61b8885..ff045e2f 100644
--- a/makefu/2configs/bureautomation/kalauerbot.nix
+++ b/makefu/2configs/bureautomation/kalauerbot.nix
@@ -12,6 +12,9 @@
       WorkingDirectory = "/var/lib/kalauerbot";
       ExecStart = "${pkgs.kalauerbot}/bin/kalauerbot";
       PrivateTmp = true;
+
+      Restart = "always";
+      RuntimeMaxSec = "12h";
     };
   };
 }
-- 
cgit v1.2.3


From 4fb678f03f381b6bd0cda10a3c161dab8be5ed00 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 21:31:58 +0100
Subject: ma printer: use extraconfig for magicolor, new netconfig for lan
 devices

---
 makefu/2configs/printer.nix | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/makefu/2configs/printer.nix b/makefu/2configs/printer.nix
index d297483b..6fd1c185 100644
--- a/makefu/2configs/printer.nix
+++ b/makefu/2configs/printer.nix
@@ -21,16 +21,20 @@ in {
   hardware.sane = {
     enable = true;
     extraBackends = [ ];
+    netConf =
+      # drucker.lan SCX-3205W
+      ''
+        192.168.1.6''
+      # uhrenkind.shack magicolor 1690mf
+    + ''
+        10.42.20.30'';
 
     # $ scanimage -p --format=jpg --mode=Gray --source="Automatic Document Feeder" -v --batch="lol%d.jpg" --resolution=150
 
     # requires 'sane-extra', scan via:
-    #extraConfig."magicolor" = ''
-    #  net 10.42.20.30 0x2098
-    #''; # 10.42.20.30: uhrenkind.shack magicolor 1690mf
-    extraConfig."xerox_mfp" = ''
-      tcp 192.168.1.5
-    ''; #home printer SCX-3205W
+    extraConfig."magicolor" = ''
+      net 10.42.20.30 0x2098
+    ''; # 10.42.20.30: uhrenkind.shack magicolor 1690mf
   };
   state = [ "/var/lib/cups" ];
 }
-- 
cgit v1.2.3


From 9323f9141ddd9824eacc8f718aa3ba49ea57b852 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 21:32:27 +0100
Subject: ma remote-build: enable gum for arm6l cross-build

---
 makefu/2configs/remote-build/gum.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/makefu/2configs/remote-build/gum.nix b/makefu/2configs/remote-build/gum.nix
index 98e2e58b..39e90f1b 100644
--- a/makefu/2configs/remote-build/gum.nix
+++ b/makefu/2configs/remote-build/gum.nix
@@ -10,6 +10,14 @@
         system = "x86_64-linux";
         supportedFeatures = [ ];
       }
+      {
+        hostName = "gum.krebsco.de";
+        maxJobs = 8;
+        sshKey = toString <secrets/id_nixBuild>;
+        sshUser = "nixBuild";
+        system = "armv6l-linux";
+        supportedFeatures = [ ];
+      }
     ];
   };
 }
-- 
cgit v1.2.3


From 29c4df2d2228956b65f435cb1358d2f577119217 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 21:33:58 +0100
Subject: ma share/omo: set workgroup and netbios name

---
 makefu/2configs/share/omo.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/makefu/2configs/share/omo.nix b/makefu/2configs/share/omo.nix
index 732dc203..1a488e69 100644
--- a/makefu/2configs/share/omo.nix
+++ b/makefu/2configs/share/omo.nix
@@ -82,6 +82,9 @@ in {
       printing = bsd
       printcap name = /dev/null
       disable spoolss = yes
+      workgroup = WORKGROUP
+      server string = ${config.networking.hostName}
+      netbios name = ${config.networking.hostName}
     '';
   };
 }
-- 
cgit v1.2.3


From b033dfd615db0334684f699731aa0064fcedf6e8 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 21:35:30 +0100
Subject: ma urlwatch: watch zigbee2mqtt supported adapters

---
 makefu/2configs/urlwatch/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/makefu/2configs/urlwatch/default.nix b/makefu/2configs/urlwatch/default.nix
index 5b059a3b..ecd03710 100644
--- a/makefu/2configs/urlwatch/default.nix
+++ b/makefu/2configs/urlwatch/default.nix
@@ -34,7 +34,9 @@ in {
       https://pypi.python.org/simple/pyserial/
       https://pypi.python.org/simple/semantic_version/
       # weird shit
-      https://www.zigbee2mqtt.io/information/supported_adapters.html
+      { url = "https://www.zigbee2mqtt.io/information/supported_adapters.html";
+        filter = "html2text";
+      }
       http://ftp.debian.org/debian/pool/main/a/apt-cacher-ng/
       https://erdgeist.org/gitweb/opentracker/info/refs?service=git-upload-pack
 
-- 
cgit v1.2.3


From a1ab1cde34c13cc0a1c78eee28835e22cdcc1794 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 21:36:10 +0100
Subject: ma wireguard/server: add workaround for failing tunnel behind nat

---
 makefu/2configs/wireguard/server.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/makefu/2configs/wireguard/server.nix b/makefu/2configs/wireguard/server.nix
index ae10f34a..1b81cf57 100644
--- a/makefu/2configs/wireguard/server.nix
+++ b/makefu/2configs/wireguard/server.nix
@@ -54,4 +54,10 @@ in { # wireguard server
     }
     ];
   };
+  # TODO: this issue is related to the router which connects to the host but is
+  # unable to re-connect once restarted
+  systemd.services.wireguard-wg0.serviceConfig = {
+    Restart = "always";
+    RuntimeMaxSec = "12h";
+  };
 }
-- 
cgit v1.2.3


From c743b9e53c4dfe2a39409c8bd01f373ce86b8e06 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 21:37:03 +0100
Subject: ma pkgs.droidcam: init software + kernel module

---
 makefu/2configs/hw/droidcam.nix          |  7 ++++
 makefu/5pkgs/droidcam/default.nix        | 55 ++++++++++++++++++++++++++++++++
 makefu/5pkgs/v4l2loopback-dc/default.nix | 36 +++++++++++++++++++++
 3 files changed, 98 insertions(+)
 create mode 100644 makefu/2configs/hw/droidcam.nix
 create mode 100644 makefu/5pkgs/droidcam/default.nix
 create mode 100644 makefu/5pkgs/v4l2loopback-dc/default.nix

diff --git a/makefu/2configs/hw/droidcam.nix b/makefu/2configs/hw/droidcam.nix
new file mode 100644
index 00000000..c638123b
--- /dev/null
+++ b/makefu/2configs/hw/droidcam.nix
@@ -0,0 +1,7 @@
+{ pkgs, config, ... }: 
+{
+  boot.extraModprobeConfig = "options v4l2loopback_dc width=640 height=480";
+  boot.extraModulePackages = [
+    (pkgs.callPackage  ../../5pkgs/v4l2loopback-dc { kernel = config.boot.kernelPackages.kernel; })
+  ];
+}
diff --git a/makefu/5pkgs/droidcam/default.nix b/makefu/5pkgs/droidcam/default.nix
new file mode 100644
index 00000000..d30fb01a
--- /dev/null
+++ b/makefu/5pkgs/droidcam/default.nix
@@ -0,0 +1,55 @@
+{ stdenv, fetchFromGitHub
+, pkg-config
+, alsaLib
+, libjpeg_turbo
+, ffmpeg
+, libusbmuxd
+, speex
+, gtk3
+, libappindicator-gtk3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "droidcam";
+  version = "1.6";
+
+  src = fetchFromGitHub {
+    owner = "aramg";
+    repo = "droidcam";
+    rev = "v${version}";
+    sha256 = "1d9qpnmqa3pfwsrpjnxdz76ipk4w37bbxyrazchh4vslnfc886fx";
+  };
+
+  sourceRoot = "source/linux";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    alsaLib
+    libjpeg_turbo
+    ffmpeg
+    libusbmuxd
+    speex
+    gtk3
+    libappindicator-gtk3
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    make JPEG_DIR="" JPEG_INCLUDE="" JPEG_LIB="" JPEG="$(pkg-config --libs --cflags libturbojpeg)"
+  '';
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 "droidcam" "$out/bin/droidcam"
+    install -Dm755 "droidcam-cli" "$out/bin/droidcam-cli"
+    install -Dm644 icon2.png "$out/share/pixmaps/droidcam.png"
+    install -Dm644 README.md "$out/share/licenses/droidcam/LICENSE"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A kernel module to create V4L2 loopback devices";
+    homepage = "https://github.com/aramg/droidcam";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.makefu ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/makefu/5pkgs/v4l2loopback-dc/default.nix b/makefu/5pkgs/v4l2loopback-dc/default.nix
new file mode 100644
index 00000000..2bb9d3d0
--- /dev/null
+++ b/makefu/5pkgs/v4l2loopback-dc/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, kernel, kmod }:
+
+stdenv.mkDerivation rec {
+  name = "v4l2loopback-dc-${version}-${kernel.version}";
+  version = "1.6";
+
+  src = fetchFromGitHub {
+    owner = "aramg";
+    repo = "droidcam";
+    rev = "v${version}";
+    sha256 = "1d9qpnmqa3pfwsrpjnxdz76ipk4w37bbxyrazchh4vslnfc886fx";
+  };
+
+  sourceRoot = "source/linux/v4l2loopback";
+
+  buildTargets = "v4l2loopback-dc";
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  buildInputs = [ kmod ];
+
+
+  makeFlags = [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=$(out)"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "A kernel module to create V4L2 loopback devices";
+    homepage = "https://github.com/aramg/droidcam";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.makefu ];
+    platforms = platforms.linux;
+  };
+}
-- 
cgit v1.2.3


From e824baec5ed0f42b6002632295ab241e9c7a80c7 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 21:37:51 +0100
Subject: ma pkgs.kalauerbot: use patched matrix-client

---
 makefu/5pkgs/kalauerbot/badsync.patch | 14 ++++++++++++++
 makefu/5pkgs/kalauerbot/default.nix   |  7 ++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 makefu/5pkgs/kalauerbot/badsync.patch

diff --git a/makefu/5pkgs/kalauerbot/badsync.patch b/makefu/5pkgs/kalauerbot/badsync.patch
new file mode 100644
index 00000000..842129b9
--- /dev/null
+++ b/makefu/5pkgs/kalauerbot/badsync.patch
@@ -0,0 +1,14 @@
+diff --git a/matrix_client/client.py b/matrix_client/client.py
+index af0e08f..f848c4f 100644
+--- a/matrix_client/client.py
++++ b/matrix_client/client.py
+@@ -471,7 +471,7 @@ class MatrixClient(object):
+         self._sync(timeout_ms)
+ 
+     def listen_forever(self, timeout_ms=30000, exception_handler=None,
+-                       bad_sync_timeout=5):
++                       bad_sync_timeout=61):
+         """ Keep listening for events forever.
+ 
+         Args:
+
diff --git a/makefu/5pkgs/kalauerbot/default.nix b/makefu/5pkgs/kalauerbot/default.nix
index 2cecbc3f..ee90fdee 100644
--- a/makefu/5pkgs/kalauerbot/default.nix
+++ b/makefu/5pkgs/kalauerbot/default.nix
@@ -8,7 +8,12 @@ rev = "08d98aa";
     sha256 = "017hh61smgq4zsxd10brgwmykwgwabgllxjs31xayvs1hnqmkv2v";
   };
   propagatedBuildInputs = with python3.pkgs;[
-    (callPackage ./python-matrixbot.nix {})
+     (callPackage ./python-matrixbot.nix {
+      matrix-client = (stdenv.lib.overrideDerivation matrix-client (self: {
+      patches = [ ./badsync.patch ];
+    }));
+    })
+
     (stdenv.lib.overrideDerivation googletrans (self: {
       patches = [ ./translate.patch ];
     }))
-- 
cgit v1.2.3


From c1b9374cf81e3e3a30f128d333ce36f43453e7b4 Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Mon, 16 Nov 2020 22:01:25 +0100
Subject: nixpkgs: 896270d -> f41c0fc

---
 krebs/nixpkgs.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index 68d95020..b2108776 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
 {
   "url": "https://github.com/NixOS/nixpkgs",
-  "rev": "896270d629efd47d14972e96f4fbb79fc9f45c80",
-  "date": "2020-11-10T22:42:32+01:00",
-  "sha256": "0xmjjayg19wm6cn88sh724mrsdj6mgrql6r3zc0g4x9bx4y342p7",
+  "rev": "f41c0fc7d8e49d94220f74495d4d702922df2a67",
+  "date": "2020-11-15T21:38:00-06:00",
+  "sha256": "01wim7ayn69y056q28ifw2f0mdypidpc0z15dda54aj5yy5vai09",
   "fetchSubmodules": false
 }
-- 
cgit v1.2.3


From d1b32e88cbc5fb42e659331660c223284ac0426e Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 22:15:04 +0100
Subject: ma sdev.r: disable torbrowser

---
 makefu/1systems/sdev/config.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/makefu/1systems/sdev/config.nix b/makefu/1systems/sdev/config.nix
index e3c59e18..d02c3034 100644
--- a/makefu/1systems/sdev/config.nix
+++ b/makefu/1systems/sdev/config.nix
@@ -37,10 +37,11 @@
     passwdqc-utils
     gnupg
     populate
-    (pkgs.writeScriptBin "tor-browser" ''
-      #! /bin/sh
-      TOR_SKIP_LAUNCH=1 ${torbrowser}/bin/tor-browser
-    '')
+    # 20.09: torbrowser is broken
+    #(pkgs.writeScriptBin "tor-browser" ''
+    #  #! /bin/sh
+    #  TOR_SKIP_LAUNCH=1 ${torbrowser}/bin/tor-browser
+    #'')
   ];
 
   networking.firewall.allowedTCPPorts = [
-- 
cgit v1.2.3


From fcd6ae942df9f61120fc995f7889ec26e4bfb0ba Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 22:21:50 +0100
Subject: ma secrets/initrd: add new openssh_host_ecdsa_key

---
 krebs/0tests/data/secrets/initrd/openssh_host_ecdsa_key | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 krebs/0tests/data/secrets/initrd/openssh_host_ecdsa_key

diff --git a/krebs/0tests/data/secrets/initrd/openssh_host_ecdsa_key b/krebs/0tests/data/secrets/initrd/openssh_host_ecdsa_key
new file mode 100644
index 00000000..e69de29b
-- 
cgit v1.2.3


From a84ec5151b0c8824bfab226c8ebd0a32fbd20ddd Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 22:25:22 +0100
Subject: tor/initrd: use hostKeys instead of hostECDSAKey

---
 krebs/2configs/tor/initrd.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix
index cb6008f7..41158822 100644
--- a/krebs/2configs/tor/initrd.nix
+++ b/krebs/2configs/tor/initrd.nix
@@ -13,7 +13,7 @@
       config.krebs.users.makefu.pubkey
       config.krebs.users.tv.pubkey
     ];
-    hostECDSAKey = <secrets/initrd/host_ecdsa_key>;
+    hostKeys = [ <secrets/initrd/opensshhost_ecdsa_key> ];
   };
   boot.initrd.availableKernelModules = [ "e1000e" ];
 
-- 
cgit v1.2.3


From 1183d847285093b9bd2cb6b8c40701473d0d081c Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 22:41:11 +0100
Subject: shack/gitlab-runner: use upstream gitlab module

---
 krebs/2configs/shack/gitlab-runner.nix | 62 +++++++++++++++++++++++-----------
 1 file changed, 43 insertions(+), 19 deletions(-)

diff --git a/krebs/2configs/shack/gitlab-runner.nix b/krebs/2configs/shack/gitlab-runner.nix
index bd391851..ecb06457 100644
--- a/krebs/2configs/shack/gitlab-runner.nix
+++ b/krebs/2configs/shack/gitlab-runner.nix
@@ -1,24 +1,48 @@
-{ pkgs, ... }:
-let
-  runner-src = builtins.fetchTarball {
-    url = "https://gitlab.com/arianvp/nixos-gitlab-runner/-/archive/master/nixos-gitlab-runner-master.tar.gz";
-    sha256 = "1s0fy5ny2ygcfvx35xws8xz5ih4z4kdfqlq3r6byxpylw7r52fyi";
-  };
-in
+{ pkgs,lib, ... }:
 {
-  imports = [
-    "${runner-src}/gitlab-runner.nix"
-  ];
-  services.gitlab-runner2 = {
+  services.gitlab-runner = {
     enable = true;
-    ## registrationConfigurationFile contains:
-    # CI_SERVER_URL=<CI server URL>
-    # REGISTRATION_TOKEN=<registration secret>
-    # RUNNER_TAG_LIST=nix,shacklan
-    # RUNNER_NAME=stockholm-runner-$name
-    registrationConfigFile = <secrets/shackspace-gitlab-ci>;
-    #gracefulTermination = true;
+    services= {
+      # runner for building in docker via host's nix-daemon
+      # nix store will be readable in runner, might be insecure
+      nix = with lib;{
+        # File should contain at least these two variables:
+        # `CI_SERVER_URL`
+        # `REGISTRATION_TOKEN`
+        registrationConfigFile = toString <secrets/shackspace-gitlab-ci>;
+        dockerImage = "alpine";
+        dockerVolumes = [
+          "/nix/store:/nix/store:ro"
+          "/nix/var/nix/db:/nix/var/nix/db:ro"
+          "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+        ];
+        dockerDisableCache = true;
+        preBuildScript = pkgs.writeScript "setup-container" ''
+          mkdir -p -m 0755 /nix/var/log/nix/drvs
+          mkdir -p -m 0755 /nix/var/nix/gcroots
+          mkdir -p -m 0755 /nix/var/nix/profiles
+          mkdir -p -m 0755 /nix/var/nix/temproots
+          mkdir -p -m 0755 /nix/var/nix/userpool
+          mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+          mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+          mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+          mkdir -p -m 0700 "$HOME/.nix-defexpr"
+          . ${pkgs.nix}/etc/profile.d/nix.sh
+          ${pkgs.nix}/bin/nix-env -i ${concatStringsSep " " (with pkgs; [ nix cacert git openssh ])}
+          ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
+          ${pkgs.nix}/bin/nix-channel --update nixpkgs
+        '';
+        environmentVariables = {
+          ENV = "/etc/profile";
+          USER = "root";
+          NIX_REMOTE = "daemon";
+          PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+          NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
+        };
+        tagList = [ "nix" "shacklan" ];
+      };
+    };
   };
-  systemd.services.gitlab-runner2.restartIfChanged = false;
+  systemd.services.gitlab-runner.restartIfChanged = false;
   systemd.services.docker.restartIfChanged = false;
 }
-- 
cgit v1.2.3


From 414358df3cb25d004600628bd62be88c412f30d4 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 22:41:58 +0100
Subject: ma pkgs.navi: rip

---
 makefu/5pkgs/navi/default.nix | 37 -------------------------------------
 1 file changed, 37 deletions(-)
 delete mode 100644 makefu/5pkgs/navi/default.nix

diff --git a/makefu/5pkgs/navi/default.nix b/makefu/5pkgs/navi/default.nix
deleted file mode 100644
index 1e8274f8..00000000
--- a/makefu/5pkgs/navi/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-# via https://git.ingolf-wagner.de/palo/nixos-config/src/master/pkgs/navi/default.nix
-
-{ rustPlatform, fetchFromGitHub, stdenv, fzf, makeWrapper, openssl, pkgconfig }:
-
-rustPlatform.buildRustPackage rec {
-  pname = "navi";
-  version = "2.1.1";
-
-  src = fetchFromGitHub {
-    owner = "denisidoro";
-    repo = "navi";
-    rev = "v${version}";
-    #rev = "${version}";
-    sha256 = "1195f7c3ij2mkv0k1h9fwn6jkyjb01w0p6mj2xc39w5f6i0c0hwp";
-  };
-
-  cargoSha256 = "0ks25w0dncaiw3ma05r8jrng3cczancrynnpgdksbvgz49lg3wjw";
-
-  postInstall = ''
-    mkdir -p $out/share/navi/
-    mv shell $out/share/navi/
-
-    wrapProgram "$out/bin/navi" \
-      --suffix "PATH" : "${fzf}/bin"
-  '';
-  buildInputs = [ openssl ];
-  nativeBuildInputs = [ makeWrapper pkgconfig ];
-
-  meta = with stdenv.lib; {
-    description = "An interactive cheatsheet tool for the command-line";
-    homepage = "https://github.com/denisidoro/navi";
-    license = licenses.asl20;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ mrVanDalo ];
-  };
-}
-
-- 
cgit v1.2.3


From 53d23391b8d0094cd35ce687a1123a8714b78b65 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 16 Nov 2020 23:09:30 +0100
Subject: gitlab-runner-shackspace: replaced by shack/gitlab-runner

---
 krebs/2configs/gitlab-runner-shackspace.nix | 33 -----------------------------
 1 file changed, 33 deletions(-)
 delete mode 100644 krebs/2configs/gitlab-runner-shackspace.nix

diff --git a/krebs/2configs/gitlab-runner-shackspace.nix b/krebs/2configs/gitlab-runner-shackspace.nix
deleted file mode 100644
index f4247b6d..00000000
--- a/krebs/2configs/gitlab-runner-shackspace.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ config, pkgs, ... }:
-let
-  url = "https://git.shackspace.de/";
-  # generate token from CI-token via:
-  ## gitlab-runner register
-  ## cat /etc/gitlab-runner/config.toml
-  token = import <secrets/shackspace-gitlab-ci-token.nix> ;
-in {
-  systemd.services.gitlab-runner.path = [
-    "/run/wrappers" # /run/wrappers/bin/su
-    "/" # /bin/sh
-  ];
-  systemd.services.gitlab-runner.serviceConfig.PrivateTmp = true;
-  virtualisation.docker.enable = true;
-  services.gitlab-runner = {
-    enable = true;
-    # configFile, configOptions and gracefulTimeout not yet in stable
-    # gracefulTimeout = "120min";
-    configFile = pkgs.writeText "gitlab-runner.cfg" ''
-      concurrent = 1
-      check_interval = 0
-
-      [[runners]]
-        name = "krebs-shell"
-        url = "${url}"
-        token = "${token}"
-        executor = "shell"
-        shell = "sh"
-        environment = ["PATH=/bin:/run/wrappers/bin:/etc/per-user/gitlab-runner/bin:/etc/per-user-pkgs/gitlab-runner/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"]
-        [runners.cache]
-    '';
-  };
-}
-- 
cgit v1.2.3


From 1fec69ac6b2ce44a9bc17ccffe8d4f1ed9e73fa6 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Tue, 17 Nov 2020 08:58:38 +0100
Subject: ma krops: bump home-manager

---
 makefu/krops.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/makefu/krops.nix b/makefu/krops.nix
index 213af049..2fa050e9 100644
--- a/makefu/krops.nix
+++ b/makefu/krops.nix
@@ -77,7 +77,7 @@
     (lib.mkIf ( host-src.home-manager ) {
       home-manager.git = {
         url = https://github.com/rycee/home-manager;
-        ref = "cb17f1e";
+        ref = "63f299b";
       };
     })
   ];
-- 
cgit v1.2.3


From 299039549272f6c4df6d182de5fb6579b1e474c3 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Tue, 17 Nov 2020 09:41:39 +0100
Subject: tor/initrd: fix typo in secrets-path

---
 krebs/2configs/tor/initrd.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix
index 41158822..98ed039b 100644
--- a/krebs/2configs/tor/initrd.nix
+++ b/krebs/2configs/tor/initrd.nix
@@ -13,7 +13,7 @@
       config.krebs.users.makefu.pubkey
       config.krebs.users.tv.pubkey
     ];
-    hostKeys = [ <secrets/initrd/opensshhost_ecdsa_key> ];
+    hostKeys = [ <secrets/initrd/openssh_host_ecdsa_key> ];
   };
   boot.initrd.availableKernelModules = [ "e1000e" ];
 
-- 
cgit v1.2.3


From 2fce838d369dfe4dfffc19830272daaba95e2dea Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Tue, 17 Nov 2020 19:09:55 +0100
Subject: tv: disable ci for all systems

---
 krebs/3modules/tv/default.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index 6a09cc83..756caa03 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -32,7 +32,7 @@ in {
   };
   hosts = ma