From c40c6ead1ec8f632ea85c788a4009d6aad646dbf Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 18 Sep 2017 00:04:06 +0200 Subject: l websites lassul.us: use enableACME --- lass/2configs/websites/lassulus.nix | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) (limited to 'lass') diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix index 93b817c3..d37dd530 100644 --- a/lass/2configs/websites/lassulus.nix +++ b/lass/2configs/websites/lassulus.nix @@ -14,14 +14,6 @@ in { security.acme = { certs."lassul.us" = { - email = "lass@lassul.us"; - webroot = "/var/lib/acme/acme-challenges"; - plugins = [ - "account_key.json" - "key.pem" - "fullchain.pem" - "full.pem" - ]; allowKeysForGroup = true; group = "lasscert"; }; @@ -71,13 +63,11 @@ in { ]; services.nginx.virtualHosts."lassul.us" = { + enableACME = true; serverAliases = [ "lassul.us" ]; locations."/".extraConfig = '' root /srv/http/lassul.us; ''; - locations."/.well-known/acme-challenge".extraConfig = '' - root /var/lib/acme/challenges/lassul.us/; - ''; locations."= /retiolum-hosts.tar.bz2".extraConfig = '' alias ${config.krebs.tinc.retiolum.hostsArchive}; ''; -- cgit v1.2.3 From 7e30bd3d1c9ebd7aefde3b00f086806b7a2b287e Mon Sep 17 00:00:00 2001 From: lassulus Date: Mon, 18 Sep 2017 15:04:25 +0200 Subject: l vim: fetchgit -> fetchFromGitHub we need this to clone git repos when our key is not authenticated to github.com --- lass/2configs/vim.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'lass') diff --git a/lass/2configs/vim.nix b/lass/2configs/vim.nix index 29800dbe..7f36fcd9 100644 --- a/lass/2configs/vim.nix +++ b/lass/2configs/vim.nix @@ -106,9 +106,10 @@ let pkgs.vimPlugins.undotree (pkgs.vimUtils.buildVimPlugin { name = "file-line-1.0"; - src = pkgs.fetchgit { - url = git://github.com/bogado/file-line; - rev = "refs/tags/1.0"; + src = pkgs.fetchFromGitHub { + owner = "bogado"; + repo = "file-line"; + rev = "1.0"; sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0"; }; }) -- cgit v1.2.3 From 1f341a2e5e4a6215213bd239a519f13aa732f4e1 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 19 Sep 2017 10:06:48 +0200 Subject: l dishfire.r: open port 993 (for tinc) --- lass/1systems/dishfire/config.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'lass') diff --git a/lass/1systems/dishfire/config.nix b/lass/1systems/dishfire/config.nix index 416edeb8..25e8759b 100644 --- a/lass/1systems/dishfire/config.nix +++ b/lass/1systems/dishfire/config.nix @@ -88,6 +88,7 @@ }; krebs.iptables.tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport smtp"; target = "ACCEPT"; } + { predicate = "-p tcp --dport 993"; target = "ACCEPT"; } ]; } ]; -- cgit v1.2.3 From ca89d9a176cdbda04bacecf809bf2346a615891e Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 19 Sep 2017 11:42:50 +0200 Subject: l git: use repo.admins --- lass/2configs/git.nix | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) (limited to 'lass') diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix index 7bce93ae..3991acad 100644 --- a/lass/2configs/git.nix +++ b/lass/2configs/git.nix @@ -14,7 +14,7 @@ let root-desc = "keep calm and engage"; }; }; - repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) repos; + repos = repos; rules = rules; }; @@ -87,8 +87,8 @@ let public = true; }; - make-restricted-repo = name: { collaborators ? [], announce ? false, hooks ? {}, ... }: { - inherit collaborators name; + make-restricted-repo = name: { admins ? [], collaborators ? [], announce ? false, hooks ? {}, ... }: { + inherit admins collaborators name; public = false; hooks = optionalAttrs announce { post-receive = pkgs.git-hooks.irc-announce { @@ -111,15 +111,20 @@ let repo = [ repo ]; perm = push "refs/*" [ non-fast-forward create delete merge ]; } ++ - optional repo.public { - user = attrValues config.krebs.users; + optional (length (repo.admins or []) > 0) { + user = repo.admins; repo = [ repo ]; - perm = fetch; + perm = push "refs/*" [ non-fast-forward create delete merge ]; } ++ optional (length (repo.collaborators or []) > 0) { user = repo.collaborators; repo = [ repo ]; perm = fetch; + } ++ + optional repo.public { + user = attrValues config.krebs.users; + repo = [ repo ]; + perm = fetch; }; in out -- cgit v1.2.3 From 79c5b963555dd617d88584cb5250f9744ff2a402 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 19 Sep 2017 11:45:33 +0200 Subject: l: use the same font everywhere --- lass/2configs/baseX.nix | 6 ++++++ lass/2configs/xresources.nix | 4 ++-- lass/5pkgs/default.nix | 4 ++-- lass/5pkgs/xmonad-lass.nix | 17 +++++++++++------ 4 files changed, 21 insertions(+), 10 deletions(-) (limited to 'lass') diff --git a/lass/2configs/baseX.nix b/lass/2configs/baseX.nix index 3a99e65a..0e0273dc 100644 --- a/lass/2configs/baseX.nix +++ b/lass/2configs/baseX.nix @@ -27,6 +27,12 @@ in { lass ALL= (root) NOPASSWD:SETENV: ${pkgs.sshuttle}/bin/.sshuttle-wrapped ''; } + { #font magic + options.lass.myFont = mkOption { + type = types.str; + default = "-schumacher-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1"; + }; + } ]; users.extraUsers.mainUser.extraGroups = [ "audio" "video" ]; diff --git a/lass/2configs/xresources.nix b/lass/2configs/xresources.nix index 2fbc3167..adbcd353 100644 --- a/lass/2configs/xresources.nix +++ b/lass/2configs/xresources.nix @@ -8,8 +8,8 @@ let URxvt*scrollBar: false URxvt*urgentOnBell: true URxvt*SaveLines: 4096 - URxvt*font: -*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1 - URxvt*boldFont: -*-clean-*-*-*-*-*-*-*-*-*-*-iso10646-1 + URxvt*font: ${config.lass.myFont} + URxvt*boldFont: ${config.lass.myFont} ! ref https://github.com/muennich/urxvt-perls URxvt.perl-lib: ${pkgs.urxvt_perls}/lib/urxvt/perl diff --git a/lass/5pkgs/default.nix b/lass/5pkgs/default.nix index 6e6ba56f..a339d3bf 100644 --- a/lass/5pkgs/default.nix +++ b/lass/5pkgs/default.nix @@ -1,4 +1,4 @@ -{ pkgs, ... }@args: +{ config, pkgs, ... }@args: { nixpkgs.config.packageOverrides = rec { @@ -20,7 +20,7 @@ rs = pkgs.callPackage ./rs/default.nix {}; urban = pkgs.callPackage ./urban/default.nix {}; xml2json = pkgs.callPackage ./xml2json/default.nix {}; - xmonad-lass = import ./xmonad-lass.nix { inherit pkgs; }; + xmonad-lass = import ./xmonad-lass.nix { inherit config pkgs; }; yt-next = pkgs.callPackage ./yt-next/default.nix {}; }; } diff --git a/lass/5pkgs/xmonad-lass.nix b/lass/5pkgs/xmonad-lass.nix index 67a1dc78..db439192 100644 --- a/lass/5pkgs/xmonad-lass.nix +++ b/lass/5pkgs/xmonad-lass.nix @@ -1,4 +1,4 @@ -{ pkgs, ... }: +{ config, pkgs, ... }: pkgs.writeHaskell "xmonad-lass" { executables.xmonad = { extra-depends = [ @@ -40,7 +40,7 @@ import XMonad.Hooks.UrgencyHook (SpawnUrgencyHook(..), withUrgencyHook) import XMonad.Layout.FixedColumn (FixedColumn(..)) import XMonad.Layout.Minimize (minimize, minimizeWindow, MinimizeMsg(RestoreNextMinimizedWin)) import XMonad.Layout.NoBorders (smartBorders) -import XMonad.Prompt (autoComplete, searchPredicate, XPConfig) +import XMonad.Prompt (autoComplete, font, searchPredicate, XPConfig) import XMonad.Prompt.Window (windowPromptGoto, windowPromptBringCopy) import XMonad.Util.EZConfig (additionalKeysP) import XMonad.Layout.SimpleFloat (simpleFloat) @@ -51,7 +51,7 @@ urxvtcPath :: FilePath urxvtcPath = "${pkgs.rxvt_unicode}/bin/urxvtc" myFont :: String -myFont = "-schumacher-*-*-*-*-*-*-*-*-*-*-*-iso10646-*" +myFont = "${config.lass.myFont}" main :: IO () main = getArgs >>= \case @@ -107,8 +107,8 @@ myKeyMap = , ("M4-C-k", spawn "${pkgs.xorg.xkill}/bin/xkill") , ("M4-a", focusUrgent) - , ("M4-S-r", renameWorkspace def) - , ("M4-S-a", addWorkspacePrompt def) + , ("M4-S-r", renameWorkspace myXPConfig) + , ("M4-S-a", addWorkspacePrompt myXPConfig) , ("M4-S-", removeEmptyWorkspace) , ("M4-S-c", kill1) , ("M4-", toggleWS) @@ -141,8 +141,13 @@ forkFile :: FilePath -> [String] -> Maybe [(String, String)] -> X () forkFile path args env = xfork (executeFile path False args env) >> return () +myXPConfig :: XPConfig +myXPConfig = def + { font = myFont + } + autoXPConfig :: XPConfig -autoXPConfig = def +autoXPConfig = myXPConfig { autoComplete = Just 5000 } -- cgit v1.2.3 From c83cd3492a180e41c071e31ae8e4225b5c2083fc Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 19 Sep 2017 11:46:29 +0200 Subject: l: add dpass + bindings --- lass/5pkgs/default.nix | 1 + lass/5pkgs/dpass/default.nix | 12 ++++++++++++ lass/5pkgs/xmonad-lass.nix | 1 + 3 files changed, 14 insertions(+) create mode 100644 lass/5pkgs/dpass/default.nix (limited to 'lass') diff --git a/lass/5pkgs/default.nix b/lass/5pkgs/default.nix index a339d3bf..46633ba1 100644 --- a/lass/5pkgs/default.nix +++ b/lass/5pkgs/default.nix @@ -3,6 +3,7 @@ { nixpkgs.config.packageOverrides = rec { acronym = pkgs.callPackage ./acronym/default.nix {}; + dpass = pkgs.callPackage ./dpass {}; ejabberd = pkgs.callPackage ./ejabberd { erlang = pkgs.erlangR16; }; diff --git a/lass/5pkgs/dpass/default.nix b/lass/5pkgs/dpass/default.nix new file mode 100644 index 00000000..7e75d50c --- /dev/null +++ b/lass/5pkgs/dpass/default.nix @@ -0,0 +1,12 @@ +{ pass, writeOut, writeDash, ... }: + +writeOut "dsco-pass" { + "/bin/dpass".link = writeDash "dpass" '' + PASSWORD_STORE_DIR=$HOME/.dpasswordstore \ + exec ${pass}/bin/pass $@ + ''; + "/bin/dpassmenu".link = writeDash "dpassmenu" '' + PASSWORD_STORE_DIR=$HOME/.dpasswordstore \ + exec ${pass}/bin/passmenu $@ + ''; +} diff --git a/lass/5pkgs/xmonad-lass.nix b/lass/5pkgs/xmonad-lass.nix index db439192..bf737dc5 100644 --- a/lass/5pkgs/xmonad-lass.nix +++ b/lass/5pkgs/xmonad-lass.nix @@ -99,6 +99,7 @@ myKeyMap = , ("M4-C-p", spawn "${pkgs.scrot}/bin/scrot ~/public_html/scrot.png") , ("M4-p", spawn "${pkgs.pass}/bin/passmenu --type") , ("M4-o", spawn "${pkgs.brain}/bin/brainmenu --type") + , ("M4-i", spawn "${pkgs.dpass}/bin/dpassmenu --type") , ("", spawn "${pkgs.pulseaudioLight.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ +4%") , ("", spawn "${pkgs.pulseaudioLight.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ -4%") , ("", spawn "${pkgs.xorg.xbacklight}/bin/xbacklight -time 0 -dec 1%") -- cgit v1.2.3 From 2d1160c0623461ea94d2f573d114909b64ab2b4d Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 19 Sep 2017 11:51:22 +0200 Subject: l retiolum: open configured tinc port --- lass/1systems/dishfire/config.nix | 1 - lass/2configs/retiolum.nix | 10 ++++++---- 2 files changed, 6 insertions(+), 5 deletions(-) (limited to 'lass') diff --git a/lass/1systems/dishfire/config.nix b/lass/1systems/dishfire/config.nix index 25e8759b..416edeb8 100644 --- a/lass/1systems/dishfire/config.nix +++ b/lass/1systems/dishfire/config.nix @@ -88,7 +88,6 @@ }; krebs.iptables.tables.filter.INPUT.rules = [ { predicate = "-p tcp --dport smtp"; target = "ACCEPT"; } - { predicate = "-p tcp --dport 993"; target = "ACCEPT"; } ]; } ]; diff --git a/lass/2configs/retiolum.nix b/lass/2configs/retiolum.nix index e7779f53..fb76c573 100644 --- a/lass/2configs/retiolum.nix +++ b/lass/2configs/retiolum.nix @@ -1,12 +1,14 @@ -{ pkgs, ... }: +{ config, pkgs, ... }: { krebs.iptables = { tables = { - filter.INPUT.rules = [ - { predicate = "-p tcp --dport tinc"; target = "ACCEPT"; } - { predicate = "-p udp --dport tinc"; target = "ACCEPT"; } + filter.INPUT.rules = let + tincport = toString config.krebs.build.host.nets.retiolum.tinc.port; + in [ + { predicate = "-p tcp --dport ${tincport}"; target = "ACCEPT"; } + { predicate = "-p udp --dport ${tincport}"; target = "ACCEPT"; } ]; }; }; -- cgit v1.2.3 From e822f88199f11fe75e2a38a0e5f9806a8c9ba5cf Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 19 Sep 2017 12:34:43 +0200 Subject: l: add helios.r config + source --- lass/1systems/helios/config.nix | 86 +++++++++++++++++++++++++++++++++++++++++ lass/1systems/helios/source.nix | 4 ++ 2 files changed, 90 insertions(+) create mode 100644 lass/1systems/helios/config.nix create mode 100644 lass/1systems/helios/source.nix (limited to 'lass') diff --git a/lass/1systems/helios/config.nix b/lass/1systems/helios/config.nix new file mode 100644 index 00000000..89949bcb --- /dev/null +++ b/lass/1systems/helios/config.nix @@ -0,0 +1,86 @@ +with import ; +{ config, lib, pkgs, ... }: + +{ + imports = [ + + + + + + + + + { # automatic hardware detection + boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ]; + boot.kernelModules = [ "kvm-intel" ]; + + fileSystems."/" = + { device = "/dev/pool/root"; + fsType = "btrfs"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/1F60-17C6"; + fsType = "vfat"; + }; + + fileSystems."/home" = + { device = "/dev/pool/home"; + fsType = "btrfs"; + }; + + nix.maxJobs = lib.mkDefault 8; + powerManagement.cpuFreqGovernor = "powersave"; + } + { # crypto stuff + boot.initrd.luks = { + cryptoModules = [ "aes" "sha512" "sha1" "xts" ]; + devices = [{ + name = "luksroot"; + device = "/dev/nvme0n1p3"; + }]; + }; + } + { + services.xserver.dpi = 200; + fonts.fontconfig.dpi = 200; + lass.myFont = "-schumacher-clean-*-*-*-*-26-*-*-*-*-*-iso10646-1"; + } + ]; + krebs.build.host = config.krebs.hosts.helios; + + krebs.git.rules = [ + { + user = [ config.krebs.users.lass-helios ]; + repo = [ config.krebs.git.repos.stockholm ]; + perm = with git; push "refs/heads/*" [ fast-forward non-fast-forward create delete merge ]; + } + ]; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + networking.wireless.enable = true; + hardware.enableRedistributableFirmware = true; + + environment.systemPackages = with pkgs; [ + vim + rxvt_unicode + git + rsync + hashPassword + thunderbird + dpass + ]; + + users.users = { + root.openssh.authorizedKeys.keys = [ + config.krebs.users.lass-helios.pubkey + ]; + }; + + programs.ssh.startAgent = lib.mkForce true; + +} diff --git a/lass/1systems/helios/source.nix b/lass/1systems/helios/source.nix new file mode 100644 index 00000000..bfe4dca4 --- /dev/null +++ b/lass/1systems/helios/source.nix @@ -0,0 +1,4 @@ +import { + name = "helios"; + secure = true; +} -- cgit v1.2.3