From b002e799b4f06d4840ad888ff857cd06bb33ec1c Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 19 Apr 2019 13:58:38 +0200 Subject: krebs.permown: fix typo in PrivateTmp --- krebs/3modules/permown.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/3modules/permown.nix b/krebs/3modules/permown.nix index 63adb2236..fe293810c 100644 --- a/krebs/3modules/permown.nix +++ b/krebs/3modules/permown.nix @@ -88,7 +88,7 @@ with import ; fi done < "$paths" ''; - PrivateTemp = true; + PrivateTmp = true; Restart = "always"; RestartSec = 10; UMask = plan.umask; -- cgit v1.2.3 From 5fbe320b9173b1ef0725a79548f34f967ad16130 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 19 Apr 2019 16:32:00 +0200 Subject: krebs.shadow: init --- krebs/3modules/default.nix | 1 + krebs/3modules/shadow.nix | 79 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 80 insertions(+) create mode 100644 krebs/3modules/shadow.nix (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 4d40f3856..fddb6a314 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -49,6 +49,7 @@ let ./rtorrent.nix ./secret.nix ./setuid.nix + ./shadow.nix ./syncthing.nix ./tinc.nix ./tinc_graphs.nix diff --git a/krebs/3modules/shadow.nix b/krebs/3modules/shadow.nix new file mode 100644 index 000000000..cff66492d --- /dev/null +++ b/krebs/3modules/shadow.nix @@ -0,0 +1,79 @@ +with import ; +{ config, pkgs, ... }: let + + cfg = config.krebs.shadow; + + mergeShadowsJq = pkgs.writeJq "merge-shadows.jq" '' + def fields_3_to_9: ["1", "", "", "", "", "", ""]; + + def read_value: + split(":") | + if length == 9 then + if .[2:] == fields_3_to_9 then + . + else + error("unrecognized field contents") + end + elif length == 2 then + if .[1] | test("^\\$6\\$") then + . + fields_3_to_9 + else + error("unrecognized hashed password") + end + else + error("unexpected field count: expected 9 or 2, got \(length)") + end; + + def write_value: + join(":"); + + split("\n") | + map(select(length > 0) | read_value) | + + reverse | + unique_by(.[0]) | + map(write_value) | + sort | + + join("\n") + ''; + +in { + + options.krebs.shadow = { + enable = mkEnableOption "krebs.shadow" // { + default = cfg.overridesFile != null; + }; + overridesFile = mkOption { + apply = x: if typeOf x == "path" then toString x else x; + default = null; + description = '' + Path to a file containing additional shadow entries, used for adding + encrypted passwords which should not be placed into the Nix store. + + The overrides file may contain either regular shadow(5) entries like: + + <login-name>:<hashed-password>:1:::::: + + Or shortened entries only containing login name and password like: + + <login-name>:<hashed-password> + ''; + type = types.nullOr (types.either types.path types.absolute-pathname); + }; + }; + + config = let + in mkIf cfg.enable { + system.activationScripts.users-tv = stringAfter [ "users" ] /* sh */ '' + ( + set -efu + umask 77 + ${pkgs.jq}/bin/jq -Rrs -f ${mergeShadowsJq} \ + /etc/shadow ${cfg.overridesFile} > /etc/shadow~ + ${pkgs.coreutils}/bin/mv /etc/shadow /etc/shadow- + ${pkgs.coreutils}/bin/mv /etc/shadow~ /etc/shadow + ) + ''; + }; +} -- cgit v1.2.3 From 3e5ec99203fa26c43a29e2bee2b3ea5ded1d0594 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 23 Apr 2019 13:15:57 +0200 Subject: flameshot-once: 1.1.0 -> 1.2.0 --- krebs/5pkgs/haskell/flameshot-once.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'krebs') diff --git a/krebs/5pkgs/haskell/flameshot-once.nix b/krebs/5pkgs/haskell/flameshot-once.nix index 89b95ca07..5b369362e 100644 --- a/krebs/5pkgs/haskell/flameshot-once.nix +++ b/krebs/5pkgs/haskell/flameshot-once.nix @@ -4,11 +4,11 @@ }: mkDerivation { pname = "flameshot-once"; - version = "1.1.0"; + version = "1.2.0"; src = fetchgit { url = "https://cgit.krebsco.de/flameshot-once"; - sha256 = "158ha1yyj3p3mdjjga62j91ml83nhrsg34xbg3dir5cb399j8pxx"; - rev = "9d688b6ffad14912bd1afe42555747cb3d213d95"; + sha256 = "01c11dk8ss37awfn9xqsgx668dcrf4kvzfxlq7ycnqsnpbjjvm0a"; + rev = "cebaefa37095e74ad2253c4e2f9d9ab390f88737"; fetchSubmodules = true; }; isLibrary = false; -- cgit v1.2.3 From d7ca88168c56caf2e64cc1091d24dbb73ffd5864 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 23 Apr 2019 13:17:01 +0200 Subject: flameshot-once: fix _file in profile module --- krebs/5pkgs/simple/flameshot-once/profile.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/5pkgs/simple/flameshot-once/profile.nix b/krebs/5pkgs/simple/flameshot-once/profile.nix index 7373da00a..c5dc5d851 100644 --- a/krebs/5pkgs/simple/flameshot-once/profile.nix +++ b/krebs/5pkgs/simple/flameshot-once/profile.nix @@ -29,7 +29,7 @@ let eval = evalModules { modules = singleton { - _file = toString ./config.nix; + _file = toString ./profile.nix; imports = singleton config; options = { buttons = mkOption { -- cgit v1.2.3 From 46172b7f016e53144a9be7fefd3cecdf54dd4bab Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 23 Apr 2019 13:22:50 +0200 Subject: flameshot-once: make timeout configurable --- krebs/5pkgs/simple/flameshot-once/profile.nix | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'krebs') diff --git a/krebs/5pkgs/simple/flameshot-once/profile.nix b/krebs/5pkgs/simple/flameshot-once/profile.nix index c5dc5d851..8ea8a850c 100644 --- a/krebs/5pkgs/simple/flameshot-once/profile.nix +++ b/krebs/5pkgs/simple/flameshot-once/profile.nix @@ -77,6 +77,14 @@ let default = false; type = types.bool; }; + timeout = mkOption { + default = 100; + description = '' + Maximum time in milliseconds allowed for the flameshot daemon to + react. + ''; + type = types.positive; + }; }; }; }; @@ -125,5 +133,6 @@ in pkgs.writeDash "flameshot.profile" '' export FLAMESHOT_CAPTURE_PATH=${cfg.savePath} + export FLAMESHOT_ONCE_TIMEOUT=${toString cfg.timeout} export XDG_CONFIG_HOME=${XDG_CONFIG_HOME} '' -- cgit v1.2.3 From d5c580daa1c1fd878dad9f08ea699bc531791a08 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 19 Apr 2019 16:14:53 +0200 Subject: init mb --- krebs/3modules/default.nix | 1 + krebs/3modules/mb/default.nix | 45 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 krebs/3modules/mb/default.nix (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 4d40f3856..8b77dea7c 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -102,6 +102,7 @@ let { krebs = import ./krebs { inherit config; }; } { krebs = import ./lass { inherit config; }; } { krebs = import ./makefu { inherit config; }; } + { krebs = import ./mb { inherit config; }; } { krebs = import ./external/palo.nix { inherit config; }; } { krebs = import ./tv { inherit config; }; } { diff --git a/krebs/3modules/mb/default.nix b/krebs/3modules/mb/default.nix new file mode 100644 index 000000000..4223fa5e0 --- /dev/null +++ b/krebs/3modules/mb/default.nix @@ -0,0 +1,45 @@ +with import ; +{ config, ... }: let + + hostDefaults = hostName: host: flip recursiveUpdate host { + ci = true; + monitoring = true; + owner = config.krebs.users.mb; + }; + +in { + hosts = mapAttrs hostDefaults { + orange = { + nets = { + retiolum = { + ip4.addr = "10.243.42.23"; + aliases = [ + "0r4n93.r" + ]; + tinc.pubkey = '' + -----BEGIN PUBLIC KEY----- + MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr7P0CkmC5HWnTdgGFzmA + zQuJzHSkSjcGgSkIt0pvqU6xi8P/d4eJlmeXeGTpH62JfM1xhEMpxMVd/4NOON2u + IlWnfu5bB763145IJwE0HmZziWjQXWRPAZMqYdQ5f2Pvmxv1yr3uBNzr8UlV6BjD + FXn8sCvikXttYzts9szlz5+pkY09qfiz48+DMzRBNO6JzXYQ9kPyS+TIXlGpN4Jp + C1TRF38eF2DTEZ58Yx8Z99dGrXVuqlSe77fehTQGxCckTpaZ0HS3XfZNa/cas8JY + /0RzH2n2AndnPirISDZ7r4ZIFuKAaivqaEkM8v7llI77URVB9ZJb/IqCrBzueAbt + V/5ts2HpfBAUhw0RoiH8ql+IQZsuSOpRUC2gUN8460V4SQkVtDcsVTENiD+NM5Mg + ImBv041CsW/rSJOilT2r/rWDN8RFnz/RrAQn+L31KXr81kg1TOLxO0ybs/eMJM3r + RnHFZPiiKdqPlA60g0AnzKXPR2JTszHIgHHoRUW16I1WJeuAJNjg0JDQ0JM7pZ27 + JEaCc7uR12TPiuExKaNEaxKZVY1J0hzxOzF2MFIbAMVz/3K2ycvvuLxKojqIAXxA + D+UtcOfJ62k2WnLXOEIZqFU0J2bvhxYUZOFS55wIn1UJF7hemD/LUFHBiWnuhwHk + TAEl8M851t+Zp3hZeJzgx2kCAwEAAQ== + -----END PUBLIC KEY----- + ''; + }; + }; + }; + }; + users = { + mb = { + mail = "mb0@codemonkey.cc"; + pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCHAdKGHP/De/GLEsPo5RBfbaiiitMw4Y/akOekJbImswT6Np2lzqno/WBJcfVs3D39wgPKNld4P/QZc5IwxC26q/PnBFu93KES0GqnlAqUNE63IOJ8UzNdyEqWggnRiLrBU+ZgyFZvmqp6NoSO4YEGEK4RZRMJM/GcAuQMj/nGjx2AHwPGZCkIRgz8/ctBOzX1/knZd3cOnNowH1wlqUKX6UcEzJdAVDQijHF1wl0Ri8tJKq9u8s/fw+1PSOpOHaeF1BALsXSKgeJDqUCTnZW5mAVUWJ86LvvyfCP4In9lhhLisbDm2cD96QaVvJyV6HfmegdSxZ1Phh+9Qz+3WhDJRedBTSKWfK/9j7VWSb+z/KV37q72W25ZfFMSay58LmCqn3v5fGt9qj4nlPw0By4baGLiGlA7xyvkJfdt8ZVPps5d2g6UprTbSA79lYN4qtWKq2Z9t317xch7Lix6EunQcoTkJ6QXEbDrAIk3zvkWr/CtpwEhNcSdWvQsua42dkD2oOI2F2IgFyYgOx9Iba2yj8A0TD2iqfYVhsJIYuk12QfeaR7ovQ6DhHlUxyQzeF6h0Y+I4AN6Sq/Mmj/cxfQoIaAEybUQMX+7KjFceIszT3JbGlz7DCxi7DMmNYuc7LELMRG3jNAOk+fW8u42Bhgc44tzvAondojerUGqCbUDw== mb0@codemonkey.cc"; + }; + }; +} -- cgit v1.2.3 From 7653f7d9f39a8b710f81b4341e0ab09289a60288 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 26 Apr 2019 19:46:16 +0200 Subject: mb orange: add more aliases --- krebs/3modules/mb/default.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'krebs') diff --git a/krebs/3modules/mb/default.nix b/krebs/3modules/mb/default.nix index 4223fa5e0..61be25262 100644 --- a/krebs/3modules/mb/default.nix +++ b/krebs/3modules/mb/default.nix @@ -14,6 +14,8 @@ in { retiolum = { ip4.addr = "10.243.42.23"; aliases = [ + "orange.r" + "or4ng3.r" "0r4n93.r" ]; tinc.pubkey = '' -- cgit v1.2.3 From 3dc61a8f2d525f7f6c1260ca97a918f78242cb1c Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 26 Apr 2019 20:11:30 +0200 Subject: mb: add p1nk.r --- krebs/3modules/mb/default.nix | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) (limited to 'krebs') diff --git a/krebs/3modules/mb/default.nix b/krebs/3modules/mb/default.nix index 61be25262..bd9d5059a 100644 --- a/krebs/3modules/mb/default.nix +++ b/krebs/3modules/mb/default.nix @@ -37,6 +37,32 @@ in { }; }; }; + p1nk = { + nets = { + retiolum = { + ip4.addr = "10.243.42.42"; + aliases = [ + "p1nk.r" + ]; + tinc.pubkey = '' + ----BEGIN PUBLIC KEY----- + MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5YVML71oW3iJrzZKuX48 + AKrGitO5zNvsAHOI8BVsGfZTyxAAZgG4OaDX45kr27K39NcBU43LdDD0I1yjNvGe + zAoL5MIiCPD/QR1kAvLmgpMUSqOVvrk+uoGLVt6dOGvxlOiG1AAaN0gA8Q0B/jZV + 4tZlBpZ7MX9xeK10wqVT56msN69P3EzKQn1uoVRrBxEnNvI1iqmmkgMLcrFVJFBQ + 888Uuw9Hx5MO7ES/ATe8mt0zReUGvn91jYVVsPpmAopWnjCol271gflY0RomFXKy + XaIuvbeF+3otF0+MNqJfm4IsAKJjvl92pjVX0f0eBCSPCYR7D1EtgQrqflLkZKZ8 + jBGDlgpsFWt/Omz1BYcuGZU/djM4+SNxr4YRYMi3lMix3s2PmHvm304I7eEEBlC9 + qy1jq/sLaf8mHJrF6Htl7W5WS/Famkwv/VreI92iHrhsmIDiX7OIbXzYDCxT/PQa + 6uCm/3jIbcHG/ZHZ12H6thkafK0Aoe009+p1n+5Y7V2oNvYe3KzZTnCN5t6z1QHZ + V5iypsd6lNDzlodjleTgGK8FmHGRPRdq1wb3eOLE8mWZj7ygDT50FwaC8FzAcHgC + bLN/zlHvCbYmk9IJhktO3B6wtMrZl60+XCpb5rTulM94RirifFYsnTIDJApI11yb + 3AYi5dQXHjab/lvj6917xa0CAwEAAQ== + -----END PUBLIC KEY----- + ''; + }; + }; + }; }; users = { mb = { -- cgit v1.2.3 From c483c69ba183772bfd2e5a2972bfd7cbc550fba3 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sat, 27 Apr 2019 12:11:25 +0200 Subject: nixpkgs: 8ea36d7 -> cf3e277 --- krebs/nixpkgs.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'krebs') diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json index d5ca0e21f..0bc3abf9c 100644 --- a/krebs/nixpkgs.json +++ b/krebs/nixpkgs.json @@ -1,7 +1,7 @@ { "url": "https://github.com/NixOS/nixpkgs-channels", - "rev": "8ea36d732567c80b2d11eb029e10400fe85ca786", - "date": "2019-04-18T22:37:03+01:00", - "sha256": "1d59i55qwqd76n2d0hr1si26q333ydizkd91h8lfczb00xnr5pqn", + "rev": "cf3e277dd0bd710af0df667e9364f4bd80c72713", + "date": "2019-04-24T23:55:21+02:00", + "sha256": "1abyadl3sxf67yi65758hq6hf2j07afgp1fmkk7kd94dadx6r6f4", "fetchSubmodules": false } -- cgit v1.2.3 From 710609af31b72abf805370f3fe322daa41c1a55b Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 28 Apr 2019 13:56:01 +0200 Subject: mb p1nk: fix tinc pubkey --- krebs/3modules/mb/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/3modules/mb/default.nix b/krebs/3modules/mb/default.nix index bd9d5059a..c98db4b27 100644 --- a/krebs/3modules/mb/default.nix +++ b/krebs/3modules/mb/default.nix @@ -45,7 +45,7 @@ in { "p1nk.r" ]; tinc.pubkey = '' - ----BEGIN PUBLIC KEY----- + -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5YVML71oW3iJrzZKuX48 AKrGitO5zNvsAHOI8BVsGfZTyxAAZgG4OaDX45kr27K39NcBU43LdDD0I1yjNvGe zAoL5MIiCPD/QR1kAvLmgpMUSqOVvrk+uoGLVt6dOGvxlOiG1AAaN0gA8Q0B/jZV -- cgit v1.2.3 From 18b98333d4c6cdafef7dcb77c249eb106ed53521 Mon Sep 17 00:00:00 2001 From: lassulus Date: Sun, 28 Apr 2019 15:01:50 +0200 Subject: irc-announce: add _ to nick, for filtering --- krebs/5pkgs/simple/irc-announce/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/5pkgs/simple/irc-announce/default.nix b/krebs/5pkgs/simple/irc-announce/default.nix index e1f4919d5..b22e67535 100644 --- a/krebs/5pkgs/simple/irc-announce/default.nix +++ b/krebs/5pkgs/simple/irc-announce/default.nix @@ -15,7 +15,7 @@ pkgs.writeDashBin "irc-announce" '' IRC_SERVER=$1 IRC_PORT=$2 - IRC_NICK=$3$$ + IRC_NICK=$3_$$ IRC_CHANNEL=$4 message=$5 -- cgit v1.2.3 From 222160fc3a195415e859048bdef21f703154b3ee Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 30 Apr 2019 19:12:00 +0200 Subject: allow multiple hostKeys --- krebs/3modules/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 734d6c781..10a33d5d7 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -132,7 +132,7 @@ let services.openssh.hostKeys = let inherit (config.krebs.build.host.ssh) privkey; in - mkIf (privkey != null) (mkForce [privkey]); + mkIf (privkey != null) [privkey]; # TODO use imports for merging services.openssh.knownHosts = -- cgit v1.2.3