From b002e799b4f06d4840ad888ff857cd06bb33ec1c Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 19 Apr 2019 13:58:38 +0200 Subject: krebs.permown: fix typo in PrivateTmp --- krebs/3modules/permown.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/3modules/permown.nix b/krebs/3modules/permown.nix index 63adb2236..fe293810c 100644 --- a/krebs/3modules/permown.nix +++ b/krebs/3modules/permown.nix @@ -88,7 +88,7 @@ with import ; fi done < "$paths" ''; - PrivateTemp = true; + PrivateTmp = true; Restart = "always"; RestartSec = 10; UMask = plan.umask; -- cgit v1.2.3 From 5fbe320b9173b1ef0725a79548f34f967ad16130 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 19 Apr 2019 16:32:00 +0200 Subject: krebs.shadow: init --- krebs/3modules/default.nix | 1 + krebs/3modules/shadow.nix | 79 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 80 insertions(+) create mode 100644 krebs/3modules/shadow.nix (limited to 'krebs') diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 4d40f3856..fddb6a314 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -49,6 +49,7 @@ let ./rtorrent.nix ./secret.nix ./setuid.nix + ./shadow.nix ./syncthing.nix ./tinc.nix ./tinc_graphs.nix diff --git a/krebs/3modules/shadow.nix b/krebs/3modules/shadow.nix new file mode 100644 index 000000000..cff66492d --- /dev/null +++ b/krebs/3modules/shadow.nix @@ -0,0 +1,79 @@ +with import ; +{ config, pkgs, ... }: let + + cfg = config.krebs.shadow; + + mergeShadowsJq = pkgs.writeJq "merge-shadows.jq" '' + def fields_3_to_9: ["1", "", "", "", "", "", ""]; + + def read_value: + split(":") | + if length == 9 then + if .[2:] == fields_3_to_9 then + . + else + error("unrecognized field contents") + end + elif length == 2 then + if .[1] | test("^\\$6\\$") then + . + fields_3_to_9 + else + error("unrecognized hashed password") + end + else + error("unexpected field count: expected 9 or 2, got \(length)") + end; + + def write_value: + join(":"); + + split("\n") | + map(select(length > 0) | read_value) | + + reverse | + unique_by(.[0]) | + map(write_value) | + sort | + + join("\n") + ''; + +in { + + options.krebs.shadow = { + enable = mkEnableOption "krebs.shadow" // { + default = cfg.overridesFile != null; + }; + overridesFile = mkOption { + apply = x: if typeOf x == "path" then toString x else x; + default = null; + description = '' + Path to a file containing additional shadow entries, used for adding + encrypted passwords which should not be placed into the Nix store. + + The overrides file may contain either regular shadow(5) entries like: + + <login-name>:<hashed-password>:1:::::: + + Or shortened entries only containing login name and password like: + + <login-name>:<hashed-password> + ''; + type = types.nullOr (types.either types.path types.absolute-pathname); + }; + }; + + config = let + in mkIf cfg.enable { + system.activationScripts.users-tv = stringAfter [ "users" ] /* sh */ '' + ( + set -efu + umask 77 + ${pkgs.jq}/bin/jq -Rrs -f ${mergeShadowsJq} \ + /etc/shadow ${cfg.overridesFile} > /etc/shadow~ + ${pkgs.coreutils}/bin/mv /etc/shadow /etc/shadow- + ${pkgs.coreutils}/bin/mv /etc/shadow~ /etc/shadow + ) + ''; + }; +} -- cgit v1.2.3 From 3e5ec99203fa26c43a29e2bee2b3ea5ded1d0594 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 23 Apr 2019 13:15:57 +0200 Subject: flameshot-once: 1.1.0 -> 1.2.0 --- krebs/5pkgs/haskell/flameshot-once.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'krebs') diff --git a/krebs/5pkgs/haskell/flameshot-once.nix b/krebs/5pkgs/haskell/flameshot-once.nix index 89b95ca07..5b369362e 100644 --- a/krebs/5pkgs/haskell/flameshot-once.nix +++ b/krebs/5pkgs/haskell/flameshot-once.nix @@ -4,11 +4,11 @@ }: mkDerivation { pname = "flameshot-once"; - version = "1.1.0"; + version = "1.2.0"; src = fetchgit { url = "https://cgit.krebsco.de/flameshot-once"; - sha256 = "158ha1yyj3p3mdjjga62j91ml83nhrsg34xbg3dir5cb399j8pxx"; - rev = "9d688b6ffad14912bd1afe42555747cb3d213d95"; + sha256 = "01c11dk8ss37awfn9xqsgx668dcrf4kvzfxlq7ycnqsnpbjjvm0a"; + rev = "cebaefa37095e74ad2253c4e2f9d9ab390f88737"; fetchSubmodules = true; }; isLibrary = false; -- cgit v1.2.3 From d7ca88168c56caf2e64cc1091d24dbb73ffd5864 Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 23 Apr 2019 13:17:01 +0200 Subject: flameshot-once: fix _file in profile module --- krebs/5pkgs/simple/flameshot-once/profile.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'krebs') diff --git a/krebs/5pkgs/simple/flameshot-once/profile.nix b/krebs/5pkgs/simple/flameshot-once/profile.nix index 7373da00a..c5dc5d851 100644 --- a/krebs/5pkgs/simple/flameshot-once/profile.nix +++ b/krebs/5pkgs/simple/flameshot-once/profile.nix @@ -29,7 +29,7 @@ let eval = evalModules { modules = singleton { - _file = toString ./config.nix; + _file = toString ./profile.nix; imports = singleton config; options = { buttons = mkOption { -- cgit v1.2.3 From 46172b7f016e53144a9be7fefd3cecdf54dd4bab Mon Sep 17 00:00:00 2001 From: tv Date: Tue, 23 Apr 2019 13:22:50 +0200 Subject: flameshot-once: make timeout configurable --- krebs/5pkgs/simple/flameshot-once/profile.nix | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'krebs') diff --git a/krebs/5pkgs/simple/flameshot-once/profile.nix b/krebs/5pkgs/simple/flameshot-once/profile.nix index c5dc5d851..8ea8a850c 100644 --- a/krebs/5pkgs/simple/flameshot-once/profile.nix +++ b/krebs/5pkgs/simple/flameshot-once/profile.nix @@ -77,6 +77,14 @@ let default = false; type = types.bool; }; + timeout = mkOption { + default = 100; + description = '' + Maximum time in milliseconds allowed for the flameshot daemon to + react. + ''; + type = types.positive; + }; }; }; }; @@ -125,5 +133,6 @@ in pkgs.writeDash "flameshot.profile" '' export FLAMESHOT_CAPTURE_PATH=${cfg.savePath} + export FLAMESHOT_ONCE_TIMEOUT=${toString cfg.timeout} export XDG_CONFIG_HOME=${XDG_CONFIG_HOME} '' -- cgit v1.2.3