From 271c7843120dc079c6507fc2d7d08fff9105e3a5 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 25 Feb 2016 13:45:23 +0100 Subject: tv: sudoers env_keep += SSH_CLIENT --- tv/2configs/default.nix | 1 + 1 file changed, 1 insertion(+) (limited to 'tv/2configs') diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 5a1e90bc4..9b83997bb 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -49,6 +49,7 @@ with config.krebs.lib; } { security.sudo.extraConfig = '' + Defaults env_keep+="SSH_CLIENT" Defaults mailto="${config.krebs.users.tv.mail}" Defaults !lecture ''; -- cgit v1.2.3 From 186708147fd96d87134e4b0ab1f8c0577eab7376 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 27 Feb 2016 12:10:57 +0100 Subject: tv vim: simplify extra-runtimepath generation --- tv/2configs/vim.nix | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) (limited to 'tv/2configs') diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index b0c26e50e..6e2059484 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -13,21 +13,17 @@ let environment.variables.VIMINIT = ":so /etc/vimrc"; }; - extra-runtimepath = let - inherit (pkgs.vimUtils) buildVimPlugin rtpPath; - fromVimPlugins = pkgs: concatStringsSep "," - (mapAttrsToList (name: pkg: "${pkg}/${rtpPath}/${name}") pkgs); - in fromVimPlugins { - inherit (pkgs.vimPlugins) undotree; - file-line = buildVimPlugin { + extra-runtimepath = concatMapStringsSep "," (pkg: "${pkg.rtp}") [ + pkgs.vimPlugins.undotree + (pkgs.vimUtils.buildVimPlugin { name = "file-line-1.0"; src = pkgs.fetchgit { url = git://github.com/bogado/file-line; rev = "refs/tags/1.0"; sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0"; }; - }; - }; + }) + ]; dirs = { backupdir = "$HOME/.cache/vim/backup"; -- cgit v1.2.3 From cc395214f58e4ac1d95e9855d4cf4784fa75d17e Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 27 Feb 2016 12:39:29 +0100 Subject: tv nixpkgs: 77f8f35 -> 40c586b --- tv/2configs/default.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'tv/2configs') diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 9b83997bb..02b3b61cf 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -14,8 +14,7 @@ with config.krebs.lib; stockholm = "/home/tv/stockholm"; nixpkgs = { url = https://github.com/NixOS/nixpkgs; - rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; - dev = "/home/tv/nixpkgs"; + rev = "40c586b7ce2c559374df435f46d673baf711c543"; }; } // optionalAttrs config.krebs.build.host.secure { secrets-master = "/home/tv/secrets/master"; -- cgit v1.2.3 From 7cff3c0650acc6c1c07d578faa9bb35ff61266bc Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 27 Feb 2016 13:10:21 +0100 Subject: tv sendmail: setuid in exim-* --- tv/2configs/default.nix | 6 ------ tv/2configs/exim-retiolum.nix | 4 ++++ tv/2configs/exim-smarthost.nix | 4 ++++ 3 files changed, 8 insertions(+), 6 deletions(-) (limited to 'tv/2configs') diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 02b3b61cf..1e0da8da4 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -177,12 +177,6 @@ with config.krebs.lib; tv.iptables.input-internet-accept-new-tcp = singleton "ssh"; } - { - # TODO: exim - security.setuidPrograms = [ - "sendmail" # for sudo - ]; - } { environment.systemPackages = [ pkgs.get diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix index 9197a3c30..dbe83dcf1 100644 --- a/tv/2configs/exim-retiolum.nix +++ b/tv/2configs/exim-retiolum.nix @@ -4,5 +4,9 @@ with config.krebs.lib; { krebs.exim-retiolum.enable = true; + krebs.setuid.sendmail = { + filename = "${pkgs.exim}/bin/exim"; + mode = "4111"; + }; tv.iptables.input-retiolum-accept-new-tcp = singleton "smtp"; } diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix index 75dd9b42f..3ea010524 100644 --- a/tv/2configs/exim-smarthost.nix +++ b/tv/2configs/exim-smarthost.nix @@ -40,5 +40,9 @@ with config.krebs.lib; { from = "mirko"; to = "mv"; } ]; }; + krebs.setuid.sendmail = { + filename = "${pkgs.exim}/bin/exim"; + mode = "4111"; + }; tv.iptables.input-internet-accept-new-tcp = singleton "smtp"; } -- cgit v1.2.3 From 94154606cb011a53bfd81b52dbc60cbdf416371e Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 27 Feb 2016 15:13:10 +0100 Subject: tv wu-binary-cache: init --- tv/2configs/wu-binary-cache/client.nix | 7 +++++++ tv/2configs/wu-binary-cache/default.nix | 25 +++++++++++++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 tv/2configs/wu-binary-cache/client.nix create mode 100644 tv/2configs/wu-binary-cache/default.nix (limited to 'tv/2configs') diff --git a/tv/2configs/wu-binary-cache/client.nix b/tv/2configs/wu-binary-cache/client.nix new file mode 100644 index 000000000..9634c21d4 --- /dev/null +++ b/tv/2configs/wu-binary-cache/client.nix @@ -0,0 +1,7 @@ +_: +{ + nix = { + binaryCaches = ["http://cache.wu.gg23"]; + binaryCachePublicKeys = ["cache.wu-1:cdhA201O2R2Ect463vhJFmhpMaNyT/tOvzYvtceT9q8="]; + }; +} diff --git a/tv/2configs/wu-binary-cache/default.nix b/tv/2configs/wu-binary-cache/default.nix new file mode 100644 index 000000000..6fcac21af --- /dev/null +++ b/tv/2configs/wu-binary-cache/default.nix @@ -0,0 +1,25 @@ +{ config, lib, pkgs, ... }: with config.krebs.lib; +{ + services.nix-serve = assert config.krebs.build.host.name == "wu"; { + enable = true; + secretKeyFile = config.krebs.secret.files.nix-serve-key.path; + }; + systemd.services.nix-serve = { + requires = ["secret.service"]; + after = ["secret.service"]; + }; + krebs.secret.files.nix-serve-key = { + path = "/run/secret/nix-serve.key"; + owner.name = "nix-serve"; + source-path = toString + "/nix-serve.key"; + }; + krebs.nginx = { + enable = true; + servers.nix-serve = { + server-names = [ "cache.wu.gg23" ]; + locations = singleton (nameValuePair "/" '' + proxy_pass http://localhost:${toString config.services.nix-serve.port}; + ''); + }; + }; +} -- cgit v1.2.3 From 35d7bc99463590c54e55b39e2bca5cb9083e9e76 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 27 Feb 2016 15:13:44 +0100 Subject: tv: nix.requireSignedBinaryCaches = true --- tv/2configs/default.nix | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'tv/2configs') diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 1e0da8da4..0a3e40a5c 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -54,15 +54,14 @@ with config.krebs.lib; ''; time.timeZone = "Europe/Berlin"; } + { # TODO check if both are required: nix.chrootDirs = [ "/etc/protocols" pkgs.iana_etc.outPath ]; - nix.trustedBinaryCaches = [ - "https://cache.nixos.org" - "http://cache.nixos.org" - "http://hydra.nixos.org" - ]; + nix.requireSignedBinaryCaches = true; + + nix.binaryCaches = ["https://cache.nixos.org"]; nix.useChroot = true; } -- cgit v1.2.3