From b2303e081fb1ccc9a0b88f538736045fb2fba14f Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 5 Feb 2016 15:18:28 +0100 Subject: cd: use default upstream-nixpkgs --- tv/1systems/cd.nix | 5 ----- 1 file changed, 5 deletions(-) (limited to 'tv') diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index e42d5750..8297a56d 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -6,11 +6,6 @@ with lib; krebs.build.host = config.krebs.hosts.cd; krebs.build.target = "root@cd.internet"; - krebs.build.source.upstream-nixpkgs = { - url = https://github.com/NixOS/nixpkgs; - rev = "b7ff030"; - }; - imports = [ ../2configs/hw/CAC-Developer-2.nix ../2configs/fs/CAC-CentOS-7-64bit.nix -- cgit v1.2.3 From 29746aec06b7d42d3c87245f6f14f048234251e4 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 6 Feb 2016 18:54:01 +0100 Subject: krebs.{backup.plans,hosts,users}.*.name: add default value --- tv/2configs/backup.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tv') diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix index ce937a74..f4d36855 100644 --- a/tv/2configs/backup.nix +++ b/tv/2configs/backup.nix @@ -1,7 +1,7 @@ { config, lib, ... }: with lib; { - krebs.backup.plans = addNames { + krebs.backup.plans = { wu-home-xu = { method = "push"; src = { host = config.krebs.hosts.wu; path = "/home"; }; -- cgit v1.2.3 From 02c1f8d2703aa03e41adcd5aec0d3ec402bbb367 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 03:09:14 +0100 Subject: tv: accept internet echo requests --- tv/2configs/default.nix | 1 + tv/3modules/iptables.nix | 27 +++++++++++++++------------ 2 files changed, 16 insertions(+), 12 deletions(-) (limited to 'tv') diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 57c4620c..52d85f85 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -165,6 +165,7 @@ with lib; { tv.iptables.enable = true; + tv.iptables.accept-echo-request = "internet"; } { diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix index cbf49f57..9d5b5d07 100644 --- a/tv/3modules/iptables.nix +++ b/tv/3modules/iptables.nix @@ -13,6 +13,11 @@ let api = { enable = mkEnableOption "tv.iptables"; + accept-echo-request = mkOption { + type = with types; nullOr (enum ["internet" "retiolum"]); + default = "retiolum"; + }; + input-internet-accept-new-tcp = mkOption { type = with types; listOf (either int str); default = []; @@ -49,10 +54,14 @@ let }; - accept-new-tcp = port: - "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT"; - - rules = iptables-version: + rules = iptables-version: let + accept-echo-request = { + ip4tables = "-p icmp -m icmp --icmp-type echo-request -j ACCEPT"; + ip6tables = "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT"; + }."ip${toString iptables-version}tables"; + accept-new-tcp = port: + "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT"; + in pkgs.writeText "tv-iptables-rules${toString iptables-version}" '' *nat :PREROUTING ACCEPT [0:0] @@ -76,18 +85,12 @@ let "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT" "-i lo -j ACCEPT" ] + ++ optional (cfg.accept-echo-request == "internet") accept-echo-request ++ map accept-new-tcp (unique (map toString cfg.input-internet-accept-new-tcp)) ++ ["-i retiolum -j Retiolum"] )} ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([] - ++ { - ip4tables = [ - "-p icmp -m icmp --icmp-type echo-request -j ACCEPT" - ]; - ip6tables = [ - "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT" - ]; - }."ip${toString iptables-version}tables" + ++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request ++ map accept-new-tcp (unique (map toString cfg.input-retiolum-accept-new-tcp)) ++ { ip4tables = [ -- cgit v1.2.3 From 949f466cf78ba2e76002012715172e5d5d394006 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 05:17:07 +0100 Subject: tv: s/_/-/g in usernames --- tv/2configs/git.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tv') diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix index b8180085..85fd7253 100644 --- a/tv/2configs/git.nix +++ b/tv/2configs/git.nix @@ -90,7 +90,7 @@ let with git // config.krebs.users; repo: singleton { - user = [ tv tv_xu ]; + user = [ tv tv-xu ]; repo = [ repo ]; perm = push "refs/*" [ non-fast-forward create delete merge ]; } ++ -- cgit v1.2.3 From b819d6c452605af66282c14e25907793a4b77c65 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 07:47:29 +0100 Subject: tv vim: add file-line plugin --- tv/2configs/vim.nix | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) (limited to 'tv') diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index 23f90af0..9f702cd4 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -13,9 +13,21 @@ let environment.variables.VIMINIT = ":so /etc/vimrc"; }; - extra-runtimepath = concatStringsSep "," [ - "${pkgs.vimPlugins.undotree}/share/vim-plugins/undotree" - ]; + extra-runtimepath = let + inherit (pkgs.vimUtils) buildVimPlugin rtpPath; + fromVimPlugins = pkgs: concatStringsSep "," + (mapAttrsToList (name: pkg: "${pkg}/${rtpPath}/${name}") pkgs); + in fromVimPlugins { + inherit (pkgs.vimPlugins) undotree; + file-line = buildVimPlugin { + name = "file-line-1.0"; + src = pkgs.fetchgit { + url = git://github.com/bogado/file-line; + rev = "refs/tags/1.0"; + sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0"; + }; + }; + }; dirs = { backupdir = "$HOME/.cache/vim/backup"; -- cgit v1.2.3 From 698296eb8c986127e0fb195a51b3adf3f31eeedf Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 07:50:17 +0100 Subject: tv vim: restore original umask --- tv/2configs/vim.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'tv') diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index 9f702cd4..8a6299a3 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -47,9 +47,10 @@ let vim = pkgs.writeScriptBin "vim" '' #! ${pkgs.dash}/bin/dash set -f + umask=$(umask) umask 0077 ${concatStringsSep "\n" (map (x: "mkdir -p ${x}") mkdirs)} - umask 0022 + umask "$umask" exec ${pkgs.vim}/bin/vim "$@" ''; -- cgit v1.2.3 From ee5a1ddffe51117862f7e2669f3939dd165d5686 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 7 Feb 2016 08:09:07 +0100 Subject: tv vim: simplify wrapper --- tv/2configs/vim.nix | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) (limited to 'tv') diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix index 8a6299a3..69a880da 100644 --- a/tv/2configs/vim.nix +++ b/tv/2configs/vim.nix @@ -44,13 +44,9 @@ let alldirs = attrValues dirs ++ map dirOf (attrValues files); in unique (sort lessThan alldirs); - vim = pkgs.writeScriptBin "vim" '' - #! ${pkgs.dash}/bin/dash - set -f - umask=$(umask) - umask 0077 - ${concatStringsSep "\n" (map (x: "mkdir -p ${x}") mkdirs)} - umask "$umask" + vim = pkgs.writeDashBin "vim" '' + set -efu + (umask 0077; exec ${pkgs.coreutils}/bin/mkdir -p ${toString mkdirs}) exec ${pkgs.vim}/bin/vim "$@" ''; -- cgit v1.2.3 From 5a10c4beb56d052b816682058becedf7b8eacaaa Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 00:25:35 +0100 Subject: =?UTF-8?q?tv=20backup:=20xu:/home=20=E2=86=92=20wu:/bku/xu-home?= =?UTF-8?q?=20@=2006:00?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- tv/2configs/backup.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'tv') diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix index f4d36855..6c90709a 100644 --- a/tv/2configs/backup.nix +++ b/tv/2configs/backup.nix @@ -14,5 +14,17 @@ with lib; yearly = { format = "%Y"; }; }; }; + xu-home-wu = { + method = "push"; + src = { host = config.krebs.hosts.xu; path = "/home"; }; + dst = { host = config.krebs.hosts.wu; path = "/bku/xu-home"; }; + startAt = "06:00"; + snapshots = { + daily = { format = "%Y-%m-%d"; retain = 7; }; + weekly = { format = "%YW%W"; retain = 4; }; + monthly = { format = "%Y-%m"; retain = 12; }; + yearly = { format = "%Y"; }; + }; + }; }; } -- cgit v1.2.3 From d98578e3e190463a341a94f2cc778ef886f9252d Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 01:07:03 +0100 Subject: rm krebs.build.target --- tv/1systems/cd.nix | 1 - tv/1systems/mkdir.nix | 1 - tv/1systems/rmdir.nix | 2 -- tv/2configs/default.nix | 1 - 4 files changed, 5 deletions(-) (limited to 'tv') diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix index 8297a56d..b96548d6 100644 --- a/tv/1systems/cd.nix +++ b/tv/1systems/cd.nix @@ -4,7 +4,6 @@ with lib; { krebs.build.host = config.krebs.hosts.cd; - krebs.build.target = "root@cd.internet"; imports = [ ../2configs/hw/CAC-Developer-2.nix diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix index 79e5f73b..2010dcd5 100644 --- a/tv/1systems/mkdir.nix +++ b/tv/1systems/mkdir.nix @@ -17,7 +17,6 @@ in { krebs.build.host = config.krebs.hosts.mkdir; - krebs.build.target = "root@${primary-addr4}"; imports = [ ../2configs/hw/CAC-Developer-1.nix diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix index 6fd79c59..4005b5e6 100644 --- a/tv/1systems/rmdir.nix +++ b/tv/1systems/rmdir.nix @@ -18,8 +18,6 @@ in { krebs.build.host = config.krebs.hosts.rmdir; - krebs.build.target = "root@rmdir.internet"; - imports = [ ../2configs/hw/CAC-Developer-1.nix ../2configs/fs/CAC-CentOS-7-64bit.nix diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix index 52d85f85..b5639af5 100644 --- a/tv/2configs/default.nix +++ b/tv/2configs/default.nix @@ -7,7 +7,6 @@ with lib; krebs.build = { user = config.krebs.users.tv; - target = mkDefault "root@${config.krebs.build.host.name}"; source = mapAttrs (_: mkDefault) ({ nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix"; nixpkgs = symlink:stockholm/nixpkgs; -- cgit v1.2.3 From 356bb8e0d3f9add02e177a3bdfa9314e1369748e Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 02:19:38 +0100 Subject: tv.iptables: redirect 11423 locally too --- tv/3modules/iptables.nix | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) (limited to 'tv') diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix index 9d5b5d07..a4ebef44 100644 --- a/tv/3modules/iptables.nix +++ b/tv/3modules/iptables.nix @@ -68,12 +68,13 @@ let :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] - ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") ([] - ++ [ - "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0" - "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22" - ] - )} + ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") [ + "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0" + "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22" + ]} + ${concatMapStringsSep "\n" (rule: "-A OUTPUT ${rule}") [ + "-o lo -p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22" + ]} COMMIT *filter :INPUT DROP [0:0] -- cgit v1.2.3 From 42d2d5de77590e7d6c421a3f7d80126f34646750 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 03:40:41 +0100 Subject: tv.iptables: inline startScript and use SyslogIdentifier --- tv/3modules/iptables.nix | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) (limited to 'tv') diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix index a4ebef44..4924db4f 100644 --- a/tv/3modules/iptables.nix +++ b/tv/3modules/iptables.nix @@ -48,7 +48,12 @@ let Type = "simple"; RemainAfterExit = true; Restart = "always"; - ExecStart = "@${startScript} tv-iptables_start"; + SyslogIdentifier = "tv-iptables_start"; + ExecStart = pkgs.writeDash "tv-iptables_start" '' + set -euf + iptables-restore < ${rules 4} + ip6tables-restore < ${rules 6} + ''; }; }; }; @@ -108,16 +113,7 @@ let )} COMMIT ''; - - startScript = pkgs.writeScript "tv-iptables_start" '' - #! /bin/sh - set -euf - iptables-restore < ${rules 4} - ip6tables-restore < ${rules 6} - ''; - -in -out +in out #let # cfg = config.tv.iptables; -- cgit v1.2.3 From 49ed93662983e67a8bef8641b4d6282e5a59b2f5 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 8 Feb 2016 04:12:56 +0100 Subject: tv git: bump descs --- tv/2configs/git.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'tv') diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix index 3ee708e0..f248a8cb 100644 --- a/tv/2configs/git.nix +++ b/tv/2configs/git.nix @@ -7,8 +7,8 @@ let out = { krebs.git = { enable = true; - root-title = "public repositories at ${config.krebs.build.host.name}"; - root-desc = "keep calm and engage"; + root-title = "repositories at ${config.krebs.build.host.name}"; + root-desc = "mostly krebs"; repos = repos; rules = rules; }; @@ -21,7 +21,7 @@ let rules = concatMap make-rules (attrValues repos); public-repos = mapAttrs make-public-repo ({ - } // mapAttrValues (setAttr "section" "1. Miscellaneous") { + } // mapAttrValues (setAttr "section" "1. miscellaneous") { cac-api = { desc = "CloudAtCost API command line interface"; }; @@ -37,7 +37,7 @@ let desc = "SoundCloud command line interface"; }; stockholm = { - desc = "take all the computers hostage, they'll love you!"; + desc = "NixOS configuration"; }; with-tmpdir = {}; } // mapAttrValues (setAttr "section" "2. Haskell libraries") { @@ -49,7 +49,7 @@ let web-routes-wai-custom = {}; xintmap = {}; xmonad-stockholm = {}; - } // mapAttrValues (setAttr "section" "3. Museum") { + } // mapAttrValues (setAttr "section" "3. museum") { cgserver = {}; crude-mail-setup = {}; dot-xmonad = {}; -- cgit v1.2.3 From 8b130a66287b829e7b6f9be0130df7231c7a6605 Mon Sep 17 00:00:00 2001 From: tv Date: Wed, 10 Feb 2016 19:06:32 +0100 Subject: krebs.nixpkgs.allowUnfreePredicate: init --- tv/1systems/wu.nix | 2 +- tv/2configs/hw/AO753.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'tv') diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix index 29e6de08..4ed13a0e 100644 --- a/tv/1systems/wu.nix +++ b/tv/1systems/wu.nix @@ -157,7 +157,7 @@ with lib; nixpkgs.config.chromium.enablePepperFlash = true; - nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name; + krebs.nixpkgs.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name; hardware.bumblebee.enable = true; hardware.bumblebee.group = "video"; hardware.enableAllFirmware = true; diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix index 72a40819..e7a2b923 100644 --- a/tv/2configs/hw/AO753.nix +++ b/tv/2configs/hw/AO753.nix @@ -41,5 +41,5 @@ with lib; HandleSuspendKey=ignore ''; - nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name; + krebs.nixpkgs.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name; } -- cgit v1.2.3 From 0cf6d065f43c66efadd0a364c3414e6ecdae0004 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 11 Feb 2016 03:47:26 +0100 Subject: *: turn 5pkgs into a(n optional) module --- tv/5pkgs/default.nix | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) (limited to 'tv') diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix index be10e91e..b520e1a3 100644 --- a/tv/5pkgs/default.nix +++ b/tv/5pkgs/default.nix @@ -1,22 +1,25 @@ { pkgs, ... }: { - cr = pkgs.writeScriptBin "cr" '' - #! /bin/sh - set -efu - export LC_TIME=de_DE.utf8 - exec ${pkgs.chromium}/bin/chromium \ - --ssl-version-min=tls1 \ - --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \ - --disk-cache-size=50000000 \ - "%@" - ''; - ejabberd = pkgs.callPackage ./ejabberd { - erlang = pkgs.erlangR16; + nixpkgs.config.packageOverrides = { + # TODO use XDG_RUNTIME_DIR? + cr = pkgs.writeScriptBin "cr" '' + #! /bin/sh + set -efu + export LC_TIME=de_DE.utf8 + exec ${pkgs.chromium}/bin/chromium \ + --ssl-version-min=tls1 \ + --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \ + --disk-cache-size=50000000 \ + "%@" + ''; + ejabberd = pkgs.callPackage ./ejabberd { + erlang = pkgs.erlangR16; + }; + ff = pkgs.callPackage ./ff {}; + viljetic-pages = pkgs.callPackage ./viljetic-pages {}; + xmonad-tv = + let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in + pkgs.haskellPackages.callPackage src {}; }; - ff = pkgs.callPackage ./ff {}; - viljetic-pages = pkgs.callPackage ./viljetic-pages {}; - xmonad-tv = - let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in - pkgs.haskellPackages.callPackage src {}; } -- cgit v1.2.3 From aeb179696aa515865690cd752592240ff7542c78 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 11 Feb 2016 16:09:15 +0100 Subject: tv x220: remove unused stuff --- tv/2configs/hw/x220.nix | 13 ------------- 1 file changed, 13 deletions(-) (limited to 'tv') diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix index 7cec670f..dac58086 100644 --- a/tv/2configs/hw/x220.nix +++ b/tv/2configs/hw/x220.nix @@ -5,18 +5,11 @@ ../smartd.nix ]; - boot.initrd.availableKernelModules = [ "ahci" ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.loader.gummiboot.enable = true; boot.loader.efi.canTouchEfiVariables = true; networking.wireless.enable = true; - #hardware.enableAllFirmware = true; - #zramSwap.enable = true; - #zramSwap.numDevices = 2; - hardware.trackpoint = { enable = true; sensitivity = 220; @@ -50,10 +43,4 @@ Option "AccelMethod" "sna" ''; }; - - #services.xserver.displayManager.sessionCommands ='' - # xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 8 1 - # xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 8 2 - # xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Axes" 6 7 4 5 - #''; } -- cgit v1.2.3 From 7a6c4452e10d590e9f357be1a8b2ad1ebb05a015 Mon Sep 17 00:00:00 2001 From: tv Date: Thu, 11 Feb 2016 17:30:56 +0100 Subject: tv x220: rm AccepMethod sna --- tv/2configs/hw/x220.nix | 3 --- 1 file changed, 3 deletions(-) (limited to 'tv') diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix index dac58086..9b3dd122 100644 --- a/tv/2configs/hw/x220.nix +++ b/tv/2configs/hw/x220.nix @@ -39,8 +39,5 @@ services.xserver = { videoDriver = "intel"; vaapiDrivers = [ pkgs.vaapiIntel pkgs.vaapiVdpau ]; - deviceSection = '' - Option "AccelMethod" "sna" - ''; }; } -- cgit v1.2.3