From 9919cb25912dfcc50881239f95494dd2f8e7b858 Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 5 Nov 2020 22:14:09 +0100 Subject: puyak.r: initrd bootstrapping via tor --- krebs/2configs/tor/initrd.nix | 50 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 krebs/2configs/tor/initrd.nix (limited to 'krebs/2configs') diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix new file mode 100644 index 00000000..cb6008f7 --- /dev/null +++ b/krebs/2configs/tor/initrd.nix @@ -0,0 +1,50 @@ +{config, pkgs, ... }: +## unlock command: +# (brain hosts/puyak/luks-ssd;echo) | ssh root@$(brain krebs-secrets/puyak/initrd/hostname) 'cat > /crypt-ramfs/passphrase' +{ + boot.initrd.network.enable = true; + boot.initrd.network.ssh = { + enable = true; + port = 22; + authorizedKeys = [ + config.krebs.users.jeschli-brauerei.pubkey + config.krebs.users.lass.pubkey + config.krebs.users.lass-mors.pubkey + config.krebs.users.makefu.pubkey + config.krebs.users.tv.pubkey + ]; + hostECDSAKey = ; + }; + boot.initrd.availableKernelModules = [ "e1000e" ]; + + boot.initrd.secrets = { + "/etc/tor/onion/bootup" = ; + }; + + boot.initrd.extraUtilsCommands = '' + copy_bin_and_libs ${pkgs.tor}/bin/tor + ''; + + # start tor during boot process + boot.initrd.network.postCommands = let + torRc = (pkgs.writeText "tor.rc" '' + DataDirectory /etc/tor + SOCKSPort 127.0.0.1:9050 IsolateDestAddr + SOCKSPort 127.0.0.1:9063 + HiddenServiceDir /etc/tor/onion/bootup + HiddenServicePort 22 127.0.0.1:22 + ''); + in '' + echo "tor: preparing onion folder" + # have to do this otherwise tor does not want to start + chmod -R 700 /etc/tor + + echo "make sure localhost is up" + ip a a 127.0.0.1/8 dev lo + ip link set lo up + + echo "tor: starting tor" + tor -f ${torRc} --verify-config + tor -f ${torRc} & + ''; +} -- cgit v1.2.3 From 5e6f56889580d4e2924491a7f471d7994b35212f Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 12 Nov 2020 10:28:14 +0100 Subject: puyak,wolf: add documentation for imports update share --- krebs/2configs/shack/share.nix | 3 +++ 1 file changed, 3 insertions(+) (limited to 'krebs/2configs') diff --git a/krebs/2configs/shack/share.nix b/krebs/2configs/shack/share.nix index 465d6ef6..d8d65d30 100644 --- a/krebs/2configs/shack/share.nix +++ b/krebs/2configs/shack/share.nix @@ -37,6 +37,9 @@ # for legacy systems client min protocol = NT1 server min protocol = NT1 + workgroup = WORKGROUP + server string = ${config.networking.hostName} + netbios name = ${config.networking.hostName} ''; }; } -- cgit v1.2.3 From a84ec5151b0c8824bfab226c8ebd0a32fbd20ddd Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 16 Nov 2020 22:25:22 +0100 Subject: tor/initrd: use hostKeys instead of hostECDSAKey --- krebs/2configs/tor/initrd.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs/2configs') diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix index cb6008f7..41158822 100644 --- a/krebs/2configs/tor/initrd.nix +++ b/krebs/2configs/tor/initrd.nix @@ -13,7 +13,7 @@ config.krebs.users.makefu.pubkey config.krebs.users.tv.pubkey ]; - hostECDSAKey = ; + hostKeys = [ ]; }; boot.initrd.availableKernelModules = [ "e1000e" ]; -- cgit v1.2.3 From 1183d847285093b9bd2cb6b8c40701473d0d081c Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 16 Nov 2020 22:41:11 +0100 Subject: shack/gitlab-runner: use upstream gitlab module --- krebs/2configs/shack/gitlab-runner.nix | 62 +++++++++++++++++++++++----------- 1 file changed, 43 insertions(+), 19 deletions(-) (limited to 'krebs/2configs') diff --git a/krebs/2configs/shack/gitlab-runner.nix b/krebs/2configs/shack/gitlab-runner.nix index bd391851..ecb06457 100644 --- a/krebs/2configs/shack/gitlab-runner.nix +++ b/krebs/2configs/shack/gitlab-runner.nix @@ -1,24 +1,48 @@ -{ pkgs, ... }: -let - runner-src = builtins.fetchTarball { - url = "https://gitlab.com/arianvp/nixos-gitlab-runner/-/archive/master/nixos-gitlab-runner-master.tar.gz"; - sha256 = "1s0fy5ny2ygcfvx35xws8xz5ih4z4kdfqlq3r6byxpylw7r52fyi"; - }; -in +{ pkgs,lib, ... }: { - imports = [ - "${runner-src}/gitlab-runner.nix" - ]; - services.gitlab-runner2 = { + services.gitlab-runner = { enable = true; - ## registrationConfigurationFile contains: - # CI_SERVER_URL= - # REGISTRATION_TOKEN= - # RUNNER_TAG_LIST=nix,shacklan - # RUNNER_NAME=stockholm-runner-$name - registrationConfigFile = ; - #gracefulTermination = true; + services= { + # runner for building in docker via host's nix-daemon + # nix store will be readable in runner, might be insecure + nix = with lib;{ + # File should contain at least these two variables: + # `CI_SERVER_URL` + # `REGISTRATION_TOKEN` + registrationConfigFile = toString ; + dockerImage = "alpine"; + dockerVolumes = [ + "/nix/store:/nix/store:ro" + "/nix/var/nix/db:/nix/var/nix/db:ro" + "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro" + ]; + dockerDisableCache = true; + preBuildScript = pkgs.writeScript "setup-container" '' + mkdir -p -m 0755 /nix/var/log/nix/drvs + mkdir -p -m 0755 /nix/var/nix/gcroots + mkdir -p -m 0755 /nix/var/nix/profiles + mkdir -p -m 0755 /nix/var/nix/temproots + mkdir -p -m 0755 /nix/var/nix/userpool + mkdir -p -m 1777 /nix/var/nix/gcroots/per-user + mkdir -p -m 1777 /nix/var/nix/profiles/per-user + mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root + mkdir -p -m 0700 "$HOME/.nix-defexpr" + . ${pkgs.nix}/etc/profile.d/nix.sh + ${pkgs.nix}/bin/nix-env -i ${concatStringsSep " " (with pkgs; [ nix cacert git openssh ])} + ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable + ${pkgs.nix}/bin/nix-channel --update nixpkgs + ''; + environmentVariables = { + ENV = "/etc/profile"; + USER = "root"; + NIX_REMOTE = "daemon"; + PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin"; + NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"; + }; + tagList = [ "nix" "shacklan" ]; + }; + }; }; - systemd.services.gitlab-runner2.restartIfChanged = false; + systemd.services.gitlab-runner.restartIfChanged = false; systemd.services.docker.restartIfChanged = false; } -- cgit v1.2.3 From 53d23391b8d0094cd35ce687a1123a8714b78b65 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 16 Nov 2020 23:09:30 +0100 Subject: gitlab-runner-shackspace: replaced by shack/gitlab-runner --- krebs/2configs/gitlab-runner-shackspace.nix | 33 ----------------------------- 1 file changed, 33 deletions(-) delete mode 100644 krebs/2configs/gitlab-runner-shackspace.nix (limited to 'krebs/2configs') diff --git a/krebs/2configs/gitlab-runner-shackspace.nix b/krebs/2configs/gitlab-runner-shackspace.nix deleted file mode 100644 index f4247b6d..00000000 --- a/krebs/2configs/gitlab-runner-shackspace.nix +++ /dev/null @@ -1,33 +0,0 @@ -{ config, pkgs, ... }: -let - url = "https://git.shackspace.de/"; - # generate token from CI-token via: - ## gitlab-runner register - ## cat /etc/gitlab-runner/config.toml - token = import ; -in { - systemd.services.gitlab-runner.path = [ - "/run/wrappers" # /run/wrappers/bin/su - "/" # /bin/sh - ]; - systemd.services.gitlab-runner.serviceConfig.PrivateTmp = true; - virtualisation.docker.enable = true; - services.gitlab-runner = { - enable = true; - # configFile, configOptions and gracefulTimeout not yet in stable - # gracefulTimeout = "120min"; - configFile = pkgs.writeText "gitlab-runner.cfg" '' - concurrent = 1 - check_interval = 0 - - [[runners]] - name = "krebs-shell" - url = "${url}" - token = "${token}" - executor = "shell" - shell = "sh" - environment = ["PATH=/bin:/run/wrappers/bin:/etc/per-user/gitlab-runner/bin:/etc/per-user-pkgs/gitlab-runner/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"] - [runners.cache] - ''; - }; -} -- cgit v1.2.3 From 299039549272f6c4df6d182de5fb6579b1e474c3 Mon Sep 17 00:00:00 2001 From: makefu Date: Tue, 17 Nov 2020 09:41:39 +0100 Subject: tor/initrd: fix typo in secrets-path --- krebs/2configs/tor/initrd.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs/2configs') diff --git a/krebs/2configs/tor/initrd.nix b/krebs/2configs/tor/initrd.nix index 41158822..98ed039b 100644 --- a/krebs/2configs/tor/initrd.nix +++ b/krebs/2configs/tor/initrd.nix @@ -13,7 +13,7 @@ config.krebs.users.makefu.pubkey config.krebs.users.tv.pubkey ]; - hostKeys = [ ]; + hostKeys = [ ]; }; boot.initrd.availableKernelModules = [ "e1000e" ]; -- cgit v1.2.3