From fc627d0b999edb8bb7c58f2efa7dcbe1ccb83e7d Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 26 Jan 2017 23:44:31 +0100 Subject: l 1 prism: remove obsolete nin stuff --- lass/2configs/buildbot-standalone.nix | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'lass/2configs') diff --git a/lass/2configs/buildbot-standalone.nix b/lass/2configs/buildbot-standalone.nix index 7057d0c3..c9e2928b 100644 --- a/lass/2configs/buildbot-standalone.nix +++ b/lass/2configs/buildbot-standalone.nix @@ -58,6 +58,11 @@ in { "NIX_REMOTE": "daemon", "dummy_secrets": "true", } + env_nin = { + "LOGNAME": "nin", + "NIX_REMOTE": "daemon", + "dummy_secrets": "true", + } env_shared = { "LOGNAME": "shared", "NIX_REMOTE": "daemon", @@ -126,6 +131,18 @@ in { ] ) + for i in [ "hiawatha", "onondaga" ]: + addShell(f,name="build-{}".format(i),env=env_nin, + command=nixshell + \ + ["mkdir -p /tmp/testbuild/$LOGNAME && touch /tmp/testbuild/$LOGNAME/.populate; \ + make \ + test \ + target=$LOGNAME@${config.krebs.build.host.name}/tmp/testbuild/$LOGNAME \ + method=build \ + system={}".format(i) + ] + ) + bu.append( util.BuilderConfig( name="build-hosts", -- cgit v1.2.3 From b4537403f85417937f08fba04d01fc5fb23bc3a4 Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 26 Jan 2017 23:44:57 +0100 Subject: l 2 git: remove nin from announced branches --- lass/2configs/git.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lass/2configs') diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix index d7ec39f2..bdd65ce0 100644 --- a/lass/2configs/git.nix +++ b/lass/2configs/git.nix @@ -57,7 +57,7 @@ let server = "ni.r"; verbose = config.krebs.build.host.name == "prism"; # TODO define branches in some kind of option per repo - branches = [ "master" "newest" "nin" ]; + branches = [ "master" "newest" ]; }; }; }; -- cgit v1.2.3 From 53015a63cb6fd3f20350c37a67e593e5c87cbc9c Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 26 Jan 2017 23:45:43 +0100 Subject: l 2 repo-sync: merge from onondaga --- lass/2configs/repo-sync.nix | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'lass/2configs') diff --git a/lass/2configs/repo-sync.nix b/lass/2configs/repo-sync.nix index 76576993..b1a26b17 100644 --- a/lass/2configs/repo-sync.nix +++ b/lass/2configs/repo-sync.nix @@ -44,6 +44,10 @@ let origin.url = "http://cgit.ni.r/${name}"; mirror.url = "${mirror}${name}"; }; + nin = { + origin.url = "http://cgit.onondaga.r/${name}"; + mirror.url = "${mirror}${name}"; + }; lassulus = { origin.url = "http://cgit.prism/${name}"; mirror.url = "${mirror}${name}"; -- cgit v1.2.3 From 97edec1f2dd9785d515fe99e031b38f8f379258a Mon Sep 17 00:00:00 2001 From: lassulus Date: Thu, 26 Jan 2017 23:59:54 +0100 Subject: l 2 fetchWallpaper: add maxTime of 10 secs --- lass/2configs/fetchWallpaper.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'lass/2configs') diff --git a/lass/2configs/fetchWallpaper.nix b/lass/2configs/fetchWallpaper.nix index cf084ea8..29f32199 100644 --- a/lass/2configs/fetchWallpaper.nix +++ b/lass/2configs/fetchWallpaper.nix @@ -7,6 +7,7 @@ in { enable = true; unitConfig.ConditionPathExists = "!/var/run/ppp0.pid"; url = "prism/wallpaper.png"; + maxTime = 10; }; systemd.services.fetchWallpaper = { after = [ "xmonad.service" ]; -- cgit v1.2.3 From ece8aa5ab92e8e59eb9fcfbbb2d2d0380bd1a5a6 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:54:44 +0100 Subject: l 2 hw tp-x220: remove broken sna acceleration --- lass/2configs/hw/tp-x220.nix | 7 ------- 1 file changed, 7 deletions(-) (limited to 'lass/2configs') diff --git a/lass/2configs/hw/tp-x220.nix b/lass/2configs/hw/tp-x220.nix index ec36fa96..d551cd44 100644 --- a/lass/2configs/hw/tp-x220.nix +++ b/lass/2configs/hw/tp-x220.nix @@ -47,12 +47,5 @@ with import ; pkgs.vaapiVdpau ]; - services.xserver = { - videoDriver = "intel"; - deviceSection = '' - Option "AccelMethod" "sna" - ''; - }; - security.rngd.enable = true; } -- cgit v1.2.3 From 26b3298f774f95806af7b253edeb3624c32cc9a1 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:55:46 +0100 Subject: l 2: remove deprecated MANPAGER declaration --- lass/2configs/default.nix | 1 - 1 file changed, 1 deletion(-) (limited to 'lass/2configs') diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index 911b7738..38f70c2b 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -98,7 +98,6 @@ with import ; # multiple-definition-problem when defining environment.variables.EDITOR environment.extraInit = '' EDITOR=vim - MANPAGER=most ''; nixpkgs.config.allowUnfree = true; -- cgit v1.2.3 From 1d2c058d78f9cb5d4a51dd2ffb1bfd4b09623055 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:56:43 +0100 Subject: l 2 monitoring: introduce {client,server}.nix --- lass/2configs/monitoring/client.nix | 32 ++++++++++++++++++++ lass/2configs/monitoring/server.nix | 59 +++++++++++++++++++++++++++++++++++++ 2 files changed, 91 insertions(+) create mode 100644 lass/2configs/monitoring/client.nix create mode 100644 lass/2configs/monitoring/server.nix (limited to 'lass/2configs') diff --git a/lass/2configs/monitoring/client.nix b/lass/2configs/monitoring/client.nix new file mode 100644 index 00000000..eebf2f2e --- /dev/null +++ b/lass/2configs/monitoring/client.nix @@ -0,0 +1,32 @@ +{pkgs, config, ...}: +with import ; +{ + lass.telegraf = { + enable = true; + outputs = '' + [outputs.influxdb] + urls = ["http://prism:8086"] + database = "all_data" + user_agent = "telegraf" + ''; + inputs = [ + '' + [cpu] + percpu = false + totalcpu = true + drop = ["cpu_time"] + '' + '' + [[inputs.mem]] + '' + '' + [[inputs.ping]] + urls = ["8.8.8.8"] + '' + ]; + }; + systemd.services.telegraf.path = with pkgs; [ + iputils + lm_sensors + ]; +} diff --git a/lass/2configs/monitoring/server.nix b/lass/2configs/monitoring/server.nix new file mode 100644 index 00000000..335820bc --- /dev/null +++ b/lass/2configs/monitoring/server.nix @@ -0,0 +1,59 @@ +{pkgs, config, ...}: +with import ; +{ + services.influxdb = { + enable = true; + }; + + services.influxdb.extraConfig = { + meta.hostname = config.krebs.build.host.name; + # meta.logging-enabled = true; + http.bind-address = ":8086"; + admin.bind-address = ":8083"; + monitoring = { + enabled = false; + # write-interval = "24h"; + }; + }; + + lass.kapacitor = + let + echoToIrc = pkgs.writeDash "echo_irc" '' + set -euf + data="$(${pkgs.jq}/bin/jq -r .message)" + export LOGNAME=prism-alarm + ${pkgs.irc-announce}/bin/irc-announce \ + irc.freenode.org 6667 prism-alarm \#krebs-bots "$data" >/dev/null + ''; + in { + enable = true; + alarms = { + test2 = '' + batch + |query(${"'''"} + SELECT mean("usage_user") AS mean + FROM "${config.lass.kapacitor.check_db}"."default"."cpu" + ${"'''"}) + .every(3m) + .period(1m) + .groupBy('host') + |alert() + .crit(lambda: "mean" > 90) + // Whenever we get an alert write it to a file. + .log('/tmp/alerts.log') + .exec('${echoToIrc}') + ''; + }; + }; + + krebs.iptables.tables.filter.INPUT.rules = [ + { predicate = "-p tcp -i retiolum --dport 8086"; target = "ACCEPT"; } + { predicate = "-p tcp -i retiolum --dport 3000"; target = "ACCEPT"; } + ]; + services.grafana = { + enable = true; + addr = "0.0.0.0"; + auth.anonymous.enable = true; + security = import ; # { AdminUser = ""; adminPassword = ""} + }; +} -- cgit v1.2.3 From 072a1adde199ac875d6a56a04f3948ae4f436663 Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 30 Jan 2017 22:58:54 +0100 Subject: l 2: enable monitoring on every host --- lass/2configs/default.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'lass/2configs') diff --git a/lass/2configs/default.nix b/lass/2configs/default.nix index 38f70c2b..d1810c00 100644 --- a/lass/2configs/default.nix +++ b/lass/2configs/default.nix @@ -9,6 +9,7 @@ with import ; ../2configs/mc.nix ../2configs/nixpkgs.nix ../2configs/vim.nix + ../2configs/monitoring/client.nix ./backups.nix { users.extraUsers = -- cgit v1.2.3 From 9bc0b9d8a2b5139fb694f1415fe3ef798d0e9980 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 00:33:22 +0100 Subject: l 2 nixpkgs: 3909827 -> 5fff5a9 --- lass/2configs/nixpkgs.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lass/2configs') diff --git a/lass/2configs/nixpkgs.nix b/lass/2configs/nixpkgs.nix index 27b7c243..4a1b0379 100644 --- a/lass/2configs/nixpkgs.nix +++ b/lass/2configs/nixpkgs.nix @@ -3,6 +3,6 @@ { krebs.build.source.nixpkgs.git = { url = https://github.com/nixos/nixpkgs; - ref = "39098270855c171f0824c09d071b606ae991ff87"; + ref = "5fff5a902594b34471b613eb2babcec923e1e1f1"; }; } -- cgit v1.2.3 From 9d0b47c3d9ab03bef348262b58fa0839c5f7d399 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 15:28:46 +0100 Subject: l 2 websites domsen: add joemisch.com to ubikmedia --- lass/2configs/websites/domsen.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'lass/2configs') diff --git a/lass/2configs/websites/domsen.nix b/lass/2configs/websites/domsen.nix index e79973a6..66fc681b 100644 --- a/lass/2configs/websites/domsen.nix +++ b/lass/2configs/websites/domsen.nix @@ -66,6 +66,7 @@ in { "karlaskop.ubikmedia.de" "nb.ubikmedia.de" "youthtube.ubikmedia.de" + "joemisch.com" ]) ]; -- cgit v1.2.3 From 8f98fde52310f21e5aceafb5fd1dfe1707227739 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 16:57:42 +0100 Subject: l 2: add bepasty.nix --- lass/2configs/bepasty.nix | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 lass/2configs/bepasty.nix (limited to 'lass/2configs') diff --git a/lass/2configs/bepasty.nix b/lass/2configs/bepasty.nix new file mode 100644 index 00000000..a3c6d0f2 --- /dev/null +++ b/lass/2configs/bepasty.nix @@ -0,0 +1,40 @@ +{ config, pkgs, ... }: +with import ; + +# secrets used: +# wildcard.krebsco.de.crt +# wildcard.krebsco.de.key +# bepasty-secret.nix <- contains single string + +with import ; +let + secKey = import ; + ext-dom = "paste.lassul.us" ; +in { + + services.nginx.enable = mkDefault true; + krebs.bepasty = { + enable = true; + serveNginx= true; + + servers = { + "paste.r" = { + nginx = { + serverAliases = [ "paste.retiolum" "paste.${config.krebs.build.host.name}" ]; + }; + defaultPermissions = "admin,list,create,read,delete"; + secretKey = secKey; + }; + + "${ext-dom}" = { + nginx = { + enableSSL = true; + forceSSL = true; + enableACME = true; + }; + defaultPermissions = "read"; + secretKey = secKey; + }; + }; + }; +} -- cgit v1.2.3 From 904d75b482e78ec2386e2e9cca4751b2bcdb8106 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 16:58:11 +0100 Subject: l 2 tests dummy-secrets: add bepasty-secret.nix --- lass/2configs/tests/dummy-secrets/bepasty-secret.nix | 1 + 1 file changed, 1 insertion(+) create mode 100644 lass/2configs/tests/dummy-secrets/bepasty-secret.nix (limited to 'lass/2configs') diff --git a/lass/2configs/tests/dummy-secrets/bepasty-secret.nix b/lass/2configs/tests/dummy-secrets/bepasty-secret.nix new file mode 100644 index 00000000..e16c76df --- /dev/null +++ b/lass/2configs/tests/dummy-secrets/bepasty-secret.nix @@ -0,0 +1 @@ +"" -- cgit v1.2.3 From 611c26439ebeec200f02d1344b6a668e64908fda Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 31 Jan 2017 17:30:25 +0100 Subject: l 2 tests dummy-secrets bepasty: fix assertion --- lass/2configs/tests/dummy-secrets/bepasty-secret.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lass/2configs') diff --git a/lass/2configs/tests/dummy-secrets/bepasty-secret.nix b/lass/2configs/tests/dummy-secrets/bepasty-secret.nix index e16c76df..6e08144d 100644 --- a/lass/2configs/tests/dummy-secrets/bepasty-secret.nix +++ b/lass/2configs/tests/dummy-secrets/bepasty-secret.nix @@ -1 +1 @@ -"" +"bla" -- cgit v1.2.3 From 93e79da6f929749a1b8c4735e38bd5ce8034a18b Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:22:10 +0100 Subject: l 2 downloading: add icarus to authorized_keys --- lass/2configs/downloading.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'lass/2configs') diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix index 27b6d22d..eb957501 100644 --- a/lass/2configs/downloading.nix +++ b/lass/2configs/downloading.nix @@ -16,6 +16,7 @@ with import ; lass.pubkey lass-shodan.pubkey lass-helios.pubkey + lass-icarus.pubkey makefu.pubkey ]; }; -- cgit v1.2.3 From 561d4f7bf52a48eca4f4a88c32b4621e5ef3425e Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:23:00 +0100 Subject: l 2 monitoring server: add collectdb support --- lass/2configs/monitoring/server.nix | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'lass/2configs') diff --git a/lass/2configs/monitoring/server.nix b/lass/2configs/monitoring/server.nix index 335820bc..2e1c15ca 100644 --- a/lass/2configs/monitoring/server.nix +++ b/lass/2configs/monitoring/server.nix @@ -14,6 +14,12 @@ with import ; enabled = false; # write-interval = "24h"; }; + collectd = [{ + enabled = true; + typesdb = "${pkgs.collectd}/share/collectd/types.db"; + database = "collectd_db"; + port = 25826; + }]; }; lass.kapacitor = @@ -49,6 +55,7 @@ with import ; krebs.iptables.tables.filter.INPUT.rules = [ { predicate = "-p tcp -i retiolum --dport 8086"; target = "ACCEPT"; } { predicate = "-p tcp -i retiolum --dport 3000"; target = "ACCEPT"; } + { predicate = "-p udp -i retiolum --dport 25826"; target = "ACCEPT"; } ]; services.grafana = { enable = true; -- cgit v1.2.3 From 10b97adc5fb76d7558280f865381f61662cc19c4 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:24:21 +0100 Subject: l 2 monitoring client: add more telegraf defaults --- lass/2configs/monitoring/client.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'lass/2configs') diff --git a/lass/2configs/monitoring/client.nix b/lass/2configs/monitoring/client.nix index eebf2f2e..fc2c2ff4 100644 --- a/lass/2configs/monitoring/client.nix +++ b/lass/2configs/monitoring/client.nix @@ -3,10 +3,13 @@ with import ; { lass.telegraf = { enable = true; + interval = "1s"; + + outputs = '' [outputs.influxdb] urls = ["http://prism:8086"] - database = "all_data" + database = "telegraf_db" user_agent = "telegraf" ''; inputs = [ -- cgit v1.2.3 From 8daef993dcb6149a02c72a4895d6e808a6c6a8d4 Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 3 Feb 2017 00:24:39 +0100 Subject: l 2 monitoring client: add collectd config --- lass/2configs/monitoring/client.nix | 59 +++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) (limited to 'lass/2configs') diff --git a/lass/2configs/monitoring/client.nix b/lass/2configs/monitoring/client.nix index fc2c2ff4..e879d696 100644 --- a/lass/2configs/monitoring/client.nix +++ b/lass/2configs/monitoring/client.nix @@ -26,10 +26,69 @@ with import ; [[inputs.ping]] urls = ["8.8.8.8"] '' + '' + [[inputs.net]] + '' + '' + [[inputs.dns_query]] + servers = ["8.8.8.8"] + '' ]; }; systemd.services.telegraf.path = with pkgs; [ iputils lm_sensors ]; + + services.collectd = { + enable = true; + autoLoadPlugin = true; + extraConfig = '' + Hostname ${config.krebs.build.host.name} + LoadPlugin load + LoadPlugin disk + LoadPlugin memory + Interval 30.0 + + LoadPlugin interface + + Interface "*Link" + Interface "lo" + Interface "vboxnet*" + Interface "virbr*" + IgnoreSelected true + + + LoadPlugin df + + MountPoint "/nix/store" + FSType "tmpfs" + FSType "binfmt_misc" + FSType "debugfs" + FSType "mqueue" + FSType "hugetlbfs" + FSType "systemd-1" + FSType "cgroup" + FSType "securityfs" + FSType "ramfs" + FSType "proc" + FSType "devpts" + FSType "devtmpfs" + MountPoint "/var/lib/docker/devicemapper" + IgnoreSelected true + + + LoadPlugin cpu + + ReportByCpu true + ReportByState true + ValuesPercentage true + + + LoadPlugin network + + Server "prism" "25826" + + ''; + }; } -- cgit v1.2.3