From e09559bb786c7cf639dc1428bbe2ed6ba7ced9fb Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 5 Jan 2016 21:47:55 +0100
Subject: krebs.backup.plans.*.{snapshots,startAt} += default

---
 tv/2configs/backup.nix | 21 ---------------------
 1 file changed, 21 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index 51d3bb8a..4b31bc84 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -4,20 +4,8 @@ with lib;
   krebs.backup.plans = addNames {
     xu-test-cd = {
       method = "push";
-
       src = { host = config.krebs.hosts.xu; path = "/tmp/xu-test"; };
       dst = { host = config.krebs.hosts.cd; path = "/tmp/backups/xu-test"; };
-
-      #startAt = "0,6,12,18:00";
-      startAt = "minutely";
-      snapshots = {
-        minutely = { format = "%Y-%m-%dT%H:%M"; retain =  5; };
-        hourly   = { format = "%Y-%m-%dT%H";    retain =  4; };
-        daily    = { format = "%Y-%m-%d";       retain =  7; };
-        weekly   = { format = "%YW%W";          retain =  4; };
-        monthly  = { format = "%Y-%m";          retain = 12; };
-        yearly   = { format = "%Y";                          };
-      };
     };
     #xu-test-wu = {
     #  method = "push";
@@ -27,15 +15,6 @@ with lib;
       method = "pull";
       src = { host = config.krebs.hosts.cd; path = "/tmp/cd-test"; };
       dst = { host = config.krebs.hosts.xu; path = "/tmp/backups/cd-test"; };
-      startAt = "minutely";
-      snapshots = {
-        minutely = { format = "%Y-%m-%dT%H:%M"; retain =  5; };
-        hourly   = { format = "%Y-%m-%dT%H";    retain =  4; };
-        daily    = { format = "%Y-%m-%d";       retain =  7; };
-        weekly   = { format = "%YW%W";          retain =  4; };
-        monthly  = { format = "%Y-%m";          retain = 12; };
-        yearly   = { format = "%Y";                          };
-      };
     };
 
   };
-- 
cgit v1.2.3


From b44615eebec6055f3b49a8170354ce4bb3213cb4 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 5 Jan 2016 22:35:05 +0100
Subject: =?UTF-8?q?tv=20backup:=20wu:/home=20=E2=86=92=20xu:/bku/wu-home?=
 =?UTF-8?q?=20@=2005:00?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tv/2configs/backup.nix | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index 4b31bc84..ce937a74 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -2,20 +2,17 @@
 with lib;
 {
   krebs.backup.plans = addNames {
-    xu-test-cd = {
+    wu-home-xu = {
       method = "push";
-      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-test"; };
-      dst = { host = config.krebs.hosts.cd; path = "/tmp/backups/xu-test"; };
+      src = { host = config.krebs.hosts.wu; path = "/home"; };
+      dst = { host = config.krebs.hosts.xu; path = "/bku/wu-home"; };
+      startAt = "05:00";
+      snapshots = {
+        daily    = { format = "%Y-%m-%d";    retain =  7; };
+        weekly   = { format = "%YW%W";       retain =  4; };
+        monthly  = { format = "%Y-%m";       retain = 12; };
+        yearly   = { format = "%Y";                       };
+      };
     };
-    #xu-test-wu = {
-    #  method = "push";
-    #  dst = { user = tv; host = wu; path = "/krebs/backup/xu-test"; };
-    #};
-    cd-test-xu = {
-      method = "pull";
-      src = { host = config.krebs.hosts.cd; path = "/tmp/cd-test"; };
-      dst = { host = config.krebs.hosts.xu; path = "/tmp/backups/cd-test"; };
-    };
-
   };
 }
-- 
cgit v1.2.3


From 417cb0a8736780568f9fa67ff32b7d47040ba5e3 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 14 Jan 2016 15:45:41 +0100
Subject: tv pulse: lol tmpfiles

No combination of systemd options could be identified to automatically restart
systemd-tmpfiles-setup.service whenever pulse.service gets started, so
deploying systemd.services.pulse to a running system will leave pulse.service
in a failed state.
---
 tv/2configs/pulse.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix
index 3db3532d..c12c3c53 100644
--- a/tv/2configs/pulse.nix
+++ b/tv/2configs/pulse.nix
@@ -35,11 +35,6 @@ let
 in
 
 {
-  systemd.tmpfiles.rules = [
-    "d ${runDir} 0750 pulse pulse - -"
-    "d ${runDir}/home 0700 pulse pulse - -"
-  ];
-
   system.activationScripts.pulseaudio-hack = ''
     ln -fns ${clientConf} /etc/pulse/client.conf
   '';
@@ -65,6 +60,12 @@ in
     };
     serviceConfig = {
       ExecStart = "${pkg}/bin/pulseaudio";
+      ExecStartPre = pkgs.writeScript "pulse-start" ''
+        #! /bin/sh
+        install -o pulse -g pulse -m 0750 -d ${runDir}
+        install -o pulse -g pulse -m 0700 -d ${runDir}/home
+      '';
+      PermissionsStartOnly = "true";
       User = "pulse";
     };
   };
-- 
cgit v1.2.3


From 7c97b64549913863498c4dca214cd9a890a0d00c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 14 Jan 2016 15:48:16 +0100
Subject: tv pulse: explain pulseaudio-hack

---
 tv/2configs/pulse.nix | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix
index c12c3c53..55ee8d8e 100644
--- a/tv/2configs/pulse.nix
+++ b/tv/2configs/pulse.nix
@@ -1,5 +1,6 @@
 { config, lib, pkgs, ... }:
 
+with lib;
 let
   pkg = pkgs.pulseaudioLight;
   runDir = "/run/pulse";
@@ -35,14 +36,13 @@ let
 in
 
 {
-  system.activationScripts.pulseaudio-hack = ''
-    ln -fns ${clientConf} /etc/pulse/client.conf
-  '';
-
   environment = {
     etc = {
       "asound.conf".source = alsaConf;
-      #"pulse/client.conf" = lib.mkForce { source = clientConf; };
+      # XXX mkForce is not strong enough (and neither is mkOverride) to create
+      # /etc/pulse/client.conf, see pulseaudio-hack below for a solution.
+      #"pulse/client.conf" = mkForce { source = clientConf; };
+      #"pulse/client.conf".source = mkForce clientConf;
       "pulse/default.pa".source = configFile;
     };
     systemPackages = [ pkg ];
@@ -51,12 +51,15 @@ in
   # Allow PulseAudio to get realtime priority using rtkit.
   security.rtkit.enable = true;
 
+  system.activationScripts.pulseaudio-hack = ''
+    ln -fns ${clientConf} /etc/pulse/client.conf
+  '';
+
   systemd.services.pulse = {
     wantedBy = [ "sound.target" ];
     before = [ "sound.target" ];
     environment = {
       PULSE_RUNTIME_PATH = "${runDir}/home";
-      #DISPLAY = ":${toString config.services.xserver.display}";
     };
     serviceConfig = {
       ExecStart = "${pkg}/bin/pulseaudio";
-- 
cgit v1.2.3


From f648c930fe2da2760b86c4bcf35b9e05803b8534 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 14 Jan 2016 15:51:41 +0100
Subject: tv: install pavucontrol only when xserver is enabled

---
 tv/2configs/pulse.nix           | 6 +++++-
 tv/2configs/xserver/default.nix | 1 -
 2 files changed, 5 insertions(+), 2 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix
index 55ee8d8e..e1894ca6 100644
--- a/tv/2configs/pulse.nix
+++ b/tv/2configs/pulse.nix
@@ -45,7 +45,11 @@ in
       #"pulse/client.conf".source = mkForce clientConf;
       "pulse/default.pa".source = configFile;
     };
-    systemPackages = [ pkg ];
+    systemPackages = [
+      pkg
+    ] ++ optionals config.services.xserver.enable [
+      pkgs.pavucontrol
+    ];
   };
 
   # Allow PulseAudio to get realtime priority using rtkit.
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index facde4e7..5cd17aa1 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -37,7 +37,6 @@ let
       pkgs.ff
       pkgs.gitAndTools.qgit
       pkgs.mpv
-      pkgs.pavucontrol
       pkgs.slock
       pkgs.sxiv
       pkgs.xsel
-- 
cgit v1.2.3


From 06906064662b4e8163bef70b5b02f1001bedba17 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 14 Jan 2016 15:53:33 +0100
Subject: nomic: use pulse and xserver

---
 tv/1systems/nomic.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'tv')

diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 0c6c935a..7bc7b70d 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -11,6 +11,8 @@ with lib;
     ../2configs/hw/AO753.nix
     #../2configs/consul-server.nix
     ../2configs/git.nix
+    ../2configs/pulse.nix
+    ../2configs/xserver
     {
       tv.iptables = {
         enable = true;
-- 
cgit v1.2.3


From df017132338d1c22adbc414a301e879035e5ba4f Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 14 Jan 2016 15:54:44 +0100
Subject: tv nixpkgs: c44a593 -> b7ff030

---
 tv/2configs/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index c300633b..17e260b5 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -11,7 +11,7 @@ with lib;
     source = {
       git.nixpkgs = {
         url = mkDefault https://github.com/NixOS/nixpkgs;
-        rev = mkDefault "c44a593aa43bba6a0708f6f36065a514a5110613";
+        rev = mkDefault "b7ff0301d6f26bd8419e888fd0e129f3dc8bd328";
         target-path = mkDefault "/var/src/nixpkgs";
       };
       dir.secrets = {
-- 
cgit v1.2.3


From 780ddec4ab268fbfd43ea9bf511ed4b3b0d35783 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 14 Jan 2016 16:31:48 +0100
Subject: tv ssh_config: UseRoaming=no

---
 tv/2configs/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 17e260b5..d3a1778f 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -142,7 +142,12 @@ with lib;
         '';
       };
 
-      programs.ssh.startAgent = false;
+      programs.ssh = {
+        extraConfig = ''
+          UseRoaming no
+        '';
+        startAgent = false;
+      };
     }
 
     {
-- 
cgit v1.2.3


From 3718289010117943a7ee79ef87c07d4a867215d8 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 14 Jan 2016 17:11:08 +0100
Subject: tv vim hs syn region String start: bump

---
 tv/2configs/vim.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 0537fa7d..bab94927 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -89,7 +89,7 @@ let
             \ | hi Normal ctermfg=White
 
     au BufRead,BufNewFile *.hs so ${pkgs.writeText "hs.vim" ''
-      syn region String start=+\[[^|]*|+ end=+|]+
+      syn region String start=+\[[[:alnum:]]*|+ end=+|]+
     ''}
 
     au BufRead,BufNewFile *.nix so ${pkgs.writeText "nix.vim" ''
-- 
cgit v1.2.3


From b523df7a6ce1099ac36ccec54f6df117aa573ea5 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 17 Jan 2016 21:31:36 +0100
Subject: lentil: RIP; upstream is good enough

---
 tv/1systems/wu.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 54ceb778..3bdf8d37 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -18,7 +18,7 @@ with lib;
         # stockholm
         gnumake
         hashPassword
-        lentil
+        haskellPackages.lentil
         parallel
         (pkgs.writeScriptBin "im" ''
           #! ${pkgs.bash}/bin/bash
-- 
cgit v1.2.3


From 14e45bda122bf73e70a2f8c822b88cf1b68f4f52 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 18 Jan 2016 00:48:00 +0100
Subject: tv ejabberd: init at 2.1.13

---
 tv/5pkgs/default.nix          |  3 +++
 tv/5pkgs/ejabberd/default.nix | 28 ++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 tv/5pkgs/ejabberd/default.nix

(limited to 'tv')

diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix
index 2108d972..be10e91e 100644
--- a/tv/5pkgs/default.nix
+++ b/tv/5pkgs/default.nix
@@ -11,6 +11,9 @@
         --disk-cache-size=50000000 \
         "%@"
   '';
+  ejabberd = pkgs.callPackage ./ejabberd {
+    erlang = pkgs.erlangR16;
+  };
   ff = pkgs.callPackage ./ff {};
   viljetic-pages = pkgs.callPackage ./viljetic-pages {};
   xmonad-tv =
diff --git a/tv/5pkgs/ejabberd/default.nix b/tv/5pkgs/ejabberd/default.nix
new file mode 100644
index 00000000..3a77c5cd
--- /dev/null
+++ b/tv/5pkgs/ejabberd/default.nix
@@ -0,0 +1,28 @@
+{stdenv, fetchurl, expat, erlang, zlib, openssl, pam, lib}:
+
+stdenv.mkDerivation rec {
+  version = "2.1.13";
+  name = "ejabberd-${version}";
+  src = fetchurl {
+    url = "http://www.process-one.net/downloads/ejabberd/${version}/${name}.tgz";
+    sha256 = "0vf8mfrx7vr3c5h3nfp3qcgwf2kmzq20rjv1h9sk3nimwir1q3d8";
+  };
+  buildInputs = [ expat erlang zlib openssl pam ];
+  patchPhase = ''
+    sed -i \
+      -e "s|erl \\\|${erlang}/bin/erl \\\|" \
+      -e 's|EXEC_CMD=\"sh -c\"|EXEC_CMD=\"${stdenv.shell} -c\"|' \
+      src/ejabberdctl.template
+  '';
+  preConfigure = ''
+    cd src
+  '';
+  configureFlags = ["--enable-pam"];
+
+  meta = {
+    description = "Open-source XMPP application server written in Erlang";
+    license = stdenv.lib.licenses.gpl2;
+    homepage = http://www.ejabberd.im;
+    maintainers = [ lib.maintainers.sander ];
+  };
+}
-- 
cgit v1.2.3


From 1a4437cb26a29400d33486d6c8a220a9e88f4132 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 28 Jan 2016 13:49:14 +0100
Subject: tv nixpkgs: b7ff030 -> 77f8f35

---
 tv/2configs/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index d3a1778f..dc55a433 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -11,7 +11,7 @@ with lib;
     source = {
       git.nixpkgs = {
         url = mkDefault https://github.com/NixOS/nixpkgs;
-        rev = mkDefault "b7ff0301d6f26bd8419e888fd0e129f3dc8bd328";
+        rev = mkDefault "77f8f35d57618c1ba456d968524f2fb2c3448295";
         target-path = mkDefault "/var/src/nixpkgs";
       };
       dir.secrets = {
-- 
cgit v1.2.3


From c3c4aac670cf0ac26340061cef1527b3d7f64386 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 03:00:48 +0100
Subject: make deploy2: deploy using nixos-rebuild switch

---
 tv/1systems/cd.nix      |  5 +++++
 tv/2configs/default.nix | 36 +++++++++++++++++-------------------
 2 files changed, 22 insertions(+), 19 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 8c2a9ae4..b69d7655 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -6,6 +6,11 @@ with lib;
   krebs.build.host = config.krebs.hosts.cd;
   krebs.build.target = "root@cd.internet";
 
+  krebs.build.source.upstream-nixpkgs = {
+    url = https://github.com/NixOS/nixpkgs;
+    rev = "b7ff030";
+  };
+
   imports = [
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index dc55a433..e7197c4c 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -8,20 +8,23 @@ with lib;
   krebs.build = {
     user = config.krebs.users.tv;
     target = mkDefault "root@${config.krebs.build.host.name}";
-    source = {
-      git.nixpkgs = {
-        url = mkDefault https://github.com/NixOS/nixpkgs;
-        rev = mkDefault "77f8f35d57618c1ba456d968524f2fb2c3448295";
-        target-path = mkDefault "/var/src/nixpkgs";
+    source-version = 2;
+    source = mapAttrs (_: mkDefault) ({
+      nixos-config = "symlink:stockholm-private/1systems/${config.krebs.build.host.name}.nix";
+      nixpkgs = symlink:stockholm-nixpkgs;
+      secrets = "/home/tv/secrets/${config.krebs.build.host.name}";
+      secrets-common = "/home/tv/secrets/common";
+      stockholm-krebs = "/home/tv/stockholm/krebs";
+      stockholm-nixpkgs = "/home/tv/stockholm/nixpkgs";
+      stockholm-private = "/home/tv/stockholm/tv";
+      upstream-nixpkgs = {
+        url = https://github.com/NixOS/nixpkgs;
+        rev = "77f8f35d57618c1ba456d968524f2fb2c3448295";
+        dev = "/home/tv/nixpkgs";
       };
-      dir.secrets = {
-        path = mkDefault "/home/tv/secrets/${config.krebs.build.host.name}";
-      };
-      dir.stockholm = {
-        path = mkDefault "/home/tv/stockholm";
-        target-path = mkDefault "/var/src/stockholm";
-      };
-    };
+    } // optionalAttrs config.krebs.build.host.secure {
+      secrets-master = "/home/tv/secrets/master";
+    });
   };
 
   networking.hostName = config.krebs.build.host.name;
@@ -98,12 +101,7 @@ with lib;
       };
 
       environment.variables = {
-        NIX_PATH =
-          with config.krebs.build.source; with dir; with git;
-          mkForce (concatStringsSep ":" [
-            "nixpkgs=${nixpkgs.target-path}"
-            "secrets=${stockholm.target-path}/null"
-          ]);
+        NIX_PATH = mkForce "/var/src";
       };
 
       programs.bash = {
-- 
cgit v1.2.3


From 36caa1771b5e3ca4e5c18531605b315311c34643 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 03:11:17 +0100
Subject: xu: use upstream lentil

---
 tv/1systems/xu.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 1f3e010a..e6894b55 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -21,7 +21,7 @@ with lib;
         # stockholm
         gnumake
         hashPassword
-        lentil
+        haskellPackages.lentil
         parallel
         (pkgs.writeScriptBin "im" ''
           #! ${pkgs.bash}/bin/bash
-- 
cgit v1.2.3


From 8217472e99ad5c9392a4da443dd2fe66343c8668 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 03:31:24 +0100
Subject: tv config: isUser root == true

---
 tv/2configs/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index e7197c4c..31007702 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -180,7 +180,8 @@ with lib;
     {
       systemd.tmpfiles.rules = let
         forUsers = flip map users;
-        isUser = { group, ... }: hasSuffix "users" group;
+        isUser = { name, group, ... }:
+          name == "root" || hasSuffix "users" group;
         users = filter isUser (mapAttrsToList (_: id) config.users.users);
       in forUsers (u: "d /run/xdg/${u.name} 0700 ${u.name} ${u.group} -");
       environment.variables.XDG_RUNTIME_DIR = "/run/xdg/$LOGNAME";
-- 
cgit v1.2.3


From f6a4131daecd6e5c1a0727adbcac43ba8530ec13 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:13:46 +0100
Subject: tv exim-retiolum: init

---
 tv/1systems/nomic.nix         | 7 +------
 tv/1systems/wu.nix            | 5 +----
 tv/1systems/xu.nix            | 8 +-------
 tv/2configs/exim-retiolum.nix | 5 +++++
 4 files changed, 8 insertions(+), 17 deletions(-)
 create mode 100644 tv/2configs/exim-retiolum.nix

(limited to 'tv')

diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 7bc7b70d..145e9b23 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -5,11 +5,9 @@ with lib;
 {
   krebs.build.host = config.krebs.hosts.nomic;
 
-  krebs.build.target = "root@nomic.gg23";
-
   imports = [
     ../2configs/hw/AO753.nix
-    #../2configs/consul-server.nix
+    ../2configs/exim-retiolum.nix
     ../2configs/git.nix
     ../2configs/pulse.nix
     ../2configs/xserver
@@ -24,9 +22,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.exim-retiolum.enable = true;
-    }
     {
       krebs.nginx = {
         enable = true;
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 3bdf8d37..47fdb209 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -7,7 +7,7 @@ with lib;
 
   imports = [
     ../2configs/hw/w110er.nix
-    #../2configs/consul-client.nix
+    ../2configs/exim-retiolum.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/pulse.nix
@@ -134,9 +134,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.exim-retiolum.enable = true;
-    }
     {
       krebs.nginx = {
         enable = true;
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index e6894b55..12c115eb 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -5,12 +5,9 @@ with lib;
 {
   krebs.build.host = config.krebs.hosts.xu;
 
-  krebs.build.source.git.nixpkgs.rev =
-    "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
-
   imports = [
     ../2configs/hw/x220.nix
-    #../2configs/consul-client.nix
+    ../2configs/exim-retiolum.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
     ../2configs/pulse.nix
@@ -135,9 +132,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.exim-retiolum.enable = true;
-    }
     {
       krebs.nginx = {
         enable = true;
diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
new file mode 100644
index 00000000..1af72c28
--- /dev/null
+++ b/tv/2configs/exim-retiolum.nix
@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  krebs.exim-retiolum.enable = true;
+}
-- 
cgit v1.2.3


From a7e1709a466cee24783e20b6219ef5112b00e8c9 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:18:07 +0100
Subject: tv nginx-public_html: init

---
 tv/1systems/nomic.nix             | 11 +----------
 tv/1systems/wu.nix                | 11 +----------
 tv/1systems/xu.nix                | 11 +----------
 tv/2configs/nginx-public_html.nix | 14 ++++++++++++++
 4 files changed, 17 insertions(+), 30 deletions(-)
 create mode 100644 tv/2configs/nginx-public_html.nix

(limited to 'tv')

diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 145e9b23..64fe5a63 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -9,6 +9,7 @@ with lib;
     ../2configs/hw/AO753.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
+    ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
     ../2configs/xserver
     {
@@ -22,16 +23,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.nginx = {
-        enable = true;
-        servers.default.locations = [
-          (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
-            alias /home/$1/public_html$2;
-          '')
-        ];
-      };
-    }
     {
       krebs.retiolum = {
         enable = true;
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 47fdb209..6dd05121 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -10,6 +10,7 @@ with lib;
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
+    ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
     ../2configs/xserver
     {
@@ -134,16 +135,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.nginx = {
-        enable = true;
-        servers.default.locations = [
-          (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
-            alias /home/$1/public_html$2;
-          '')
-        ];
-      };
-    }
     {
       krebs.retiolum = {
         enable = true;
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 12c115eb..40912958 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -10,6 +10,7 @@ with lib;
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
+    ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
     ../2configs/xserver
     {
@@ -132,16 +133,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.nginx = {
-        enable = true;
-        servers.default.locations = [
-          (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
-            alias /home/$1/public_html$2;
-          '')
-        ];
-      };
-    }
     {
       krebs.retiolum = {
         enable = true;
diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix
new file mode 100644
index 00000000..50c62391
--- /dev/null
+++ b/tv/2configs/nginx-public_html.nix
@@ -0,0 +1,14 @@
+{ lib, ... }:
+
+with lib;
+
+{
+  krebs.nginx = {
+    enable = true;
+    servers.default.locations = [
+      (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
+        alias /home/$1/public_html$2;
+      '')
+    ];
+  };
+}
-- 
cgit v1.2.3


From d6ded00d012d4fb2a2a0a824604b25dac35ee349 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:32:04 +0100
Subject: tv retiolum: init

---
 tv/1systems/cd.nix       | 11 +----------
 tv/1systems/nomic.nix    | 10 +---------
 tv/1systems/wu.nix       | 10 +---------
 tv/1systems/xu.nix       | 11 +----------
 tv/2configs/retiolum.nix | 16 ++++++++++++++++
 5 files changed, 20 insertions(+), 38 deletions(-)
 create mode 100644 tv/2configs/retiolum.nix

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index b69d7655..da44f507 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -17,6 +17,7 @@ with lib;
     #../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
+    ../2configs/retiolum.nix
     ../2configs/urlwatch.nix
     {
       imports = [ ../2configs/charybdis.nix ];
@@ -77,16 +78,6 @@ with lib;
         '');
       };
     }
-    {
-      krebs.retiolum = {
-        enable = true;
-        connectTo = [
-          "fastpoke"
-          "pigstarter"
-          "ire"
-        ];
-      };
-    }
   ];
 
   networking.interfaces.enp2s1.ip4 = [
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 64fe5a63..b7e77e97 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -11,6 +11,7 @@ with lib;
     ../2configs/git.nix
     ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
+    ../2configs/retiolum.nix
     ../2configs/xserver
     {
       tv.iptables = {
@@ -23,15 +24,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.retiolum = {
-        enable = true;
-        connectTo = [
-          "gum"
-          "pigstarter"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 6dd05121..f52bbc09 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -12,6 +12,7 @@ with lib;
     ../2configs/mail-client.nix
     ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
+    ../2configs/retiolum.nix
     ../2configs/xserver
     {
       environment.systemPackages = with pkgs; [
@@ -135,15 +136,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.retiolum = {
-        enable = true;
-        connectTo = [
-          "gum"
-          "pigstarter"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 40912958..54e16868 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -12,6 +12,7 @@ with lib;
     ../2configs/mail-client.nix
     ../2configs/nginx-public_html.nix
     ../2configs/pulse.nix
+    ../2configs/retiolum.nix
     ../2configs/xserver
     {
       environment.systemPackages = with pkgs; [
@@ -133,16 +134,6 @@ with lib;
         ];
       };
     }
-    {
-      krebs.retiolum = {
-        enable = true;
-        connectTo = [
-          "cd"
-          "gum"
-          "pigstarter"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix
new file mode 100644
index 00000000..91fe81d6
--- /dev/null
+++ b/tv/2configs/retiolum.nix
@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+
+with lib;
+
+{
+  krebs.retiolum = {
+    enable = true;
+    connectTo = filter (ne config.krebs.build.host.name) [
+      "gum"
+      "prism"
+      "echelon"
+      "cd"
+      "ire"
+    ];
+  };
+}
-- 
cgit v1.2.3


From bb1dbae8187601cea2ddfbdcdc9baa456bc5b4ab Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:40:25 +0100
Subject: tv: open ssh port by default

---
 tv/1systems/cd.nix      | 4 ----
 tv/1systems/nomic.nix   | 1 -
 tv/1systems/wu.nix      | 1 -
 tv/1systems/xu.nix      | 1 -
 tv/2configs/default.nix | 5 +++++
 5 files changed, 5 insertions(+), 7 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index da44f507..6db78ca8 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -41,7 +41,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "ssh"
           "tinc"
           "smtp"
           "xmpp-client"
@@ -58,10 +57,7 @@ with lib;
         "cgit.cd.krebsco.de"
         "cgit.cd.viljetic.de"
       ];
-    }
-    {
       # TODO make public_html also available to cd, cd.retiolum (AKA default)
-      tv.iptables.input-internet-accept-new-tcp = singleton "http";
       krebs.nginx.servers.public_html = {
         server-names = singleton "cd.viljetic.de";
         locations = singleton (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index b7e77e97..f176a5f2 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -17,7 +17,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "ssh"
           "http"
           "tinc"
           "smtp"
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index f52bbc09..16709052 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -129,7 +129,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "ssh"
           "http"
           "tinc"
           "smtp"
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 54e16868..c6f1a393 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -127,7 +127,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "ssh"
           "http"
           "tinc"
           "smtp"
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 31007702..abe9d3de 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -162,6 +162,10 @@ with lib;
       };
     }
 
+    {
+      tv.iptables.enable = true;
+    }
+
     {
       services.openssh = {
         enable = true;
@@ -169,6 +173,7 @@ with lib;
           { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
         ];
       };
+      tv.iptables.input-internet-accept-new-tcp = singleton "ssh";
     }
 
     {
-- 
cgit v1.2.3


From b172630f894362dc32cb6af7d5c9d44902ec5752 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:44:19 +0100
Subject: tv retiolum: open tinc port

---
 tv/1systems/cd.nix       | 1 -
 tv/1systems/nomic.nix    | 1 -
 tv/1systems/wu.nix       | 1 -
 tv/1systems/xu.nix       | 1 -
 tv/2configs/retiolum.nix | 1 +
 5 files changed, 1 insertion(+), 4 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 6db78ca8..783d23ca 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -41,7 +41,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "tinc"
           "smtp"
           "xmpp-client"
           "xmpp-server"
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index f176a5f2..6f2c4182 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -18,7 +18,6 @@ with lib;
         enable = true;
         input-internet-accept-new-tcp = [
           "http"
-          "tinc"
           "smtp"
         ];
       };
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 16709052..7635f616 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -130,7 +130,6 @@ with lib;
         enable = true;
         input-internet-accept-new-tcp = [
           "http"
-          "tinc"
           "smtp"
         ];
       };
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index c6f1a393..91b761d2 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -128,7 +128,6 @@ with lib;
         enable = true;
         input-internet-accept-new-tcp = [
           "http"
-          "tinc"
           "smtp"
         ];
       };
diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix
index 91fe81d6..d2bb9e6c 100644
--- a/tv/2configs/retiolum.nix
+++ b/tv/2configs/retiolum.nix
@@ -13,4 +13,5 @@ with lib;
       "ire"
     ];
   };
+  tv.iptables.input-internet-accept-new-tcp = singleton "tinc";
 }
-- 
cgit v1.2.3


From d85c70d1d669636fe2fcbb1179dca2c4aecb0802 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:46:33 +0100
Subject: tv nginx-public_html: open http port

---
 tv/1systems/nomic.nix             | 1 -
 tv/1systems/wu.nix                | 1 -
 tv/1systems/xu.nix                | 1 -
 tv/2configs/nginx-public_html.nix | 1 +
 4 files changed, 1 insertion(+), 3 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 6f2c4182..2b71a974 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -17,7 +17,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "http"
           "smtp"
         ];
       };
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 7635f616..a51e0e67 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -129,7 +129,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "http"
           "smtp"
         ];
       };
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 91b761d2..847b5724 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -127,7 +127,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "http"
           "smtp"
         ];
       };
diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix
index 50c62391..dc74f7f8 100644
--- a/tv/2configs/nginx-public_html.nix
+++ b/tv/2configs/nginx-public_html.nix
@@ -11,4 +11,5 @@ with lib;
       '')
     ];
   };
+  tv.iptables.input-internet-accept-new-tcp = singleton "http";
 }
-- 
cgit v1.2.3


From fe025213ea5c15012fd83f1064269a315a2d576a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:50:00 +0100
Subject: tv exim-retiolum: open smtp port to retiolum

---
 tv/1systems/nomic.nix         | 8 --------
 tv/1systems/wu.nix            | 8 --------
 tv/1systems/xu.nix            | 8 --------
 tv/2configs/exim-retiolum.nix | 5 ++++-
 4 files changed, 4 insertions(+), 25 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 2b71a974..37ef204c 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -13,14 +13,6 @@ with lib;
     ../2configs/pulse.nix
     ../2configs/retiolum.nix
     ../2configs/xserver
-    {
-      tv.iptables = {
-        enable = true;
-        input-internet-accept-new-tcp = [
-          "smtp"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index a51e0e67..aef8ca76 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -125,14 +125,6 @@ with lib;
         unison
       ];
     }
-    {
-      tv.iptables = {
-        enable = true;
-        input-internet-accept-new-tcp = [
-          "smtp"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 847b5724..31a8a3e9 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -123,14 +123,6 @@ with lib;
         unison
       ];
     }
-    {
-      tv.iptables = {
-        enable = true;
-        input-internet-accept-new-tcp = [
-          "smtp"
-        ];
-      };
-    }
   ];
 
   boot.initrd.luks = {
diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
index 1af72c28..aedf2582 100644
--- a/tv/2configs/exim-retiolum.nix
+++ b/tv/2configs/exim-retiolum.nix
@@ -1,5 +1,8 @@
-{ ... }:
+{ lib, ... }:
+
+with lib;
 
 {
   krebs.exim-retiolum.enable = true;
+  tv.iptables.input-retiolum-accept-new-tcp = singleton "smtp";
 }
-- 
cgit v1.2.3


From b58f37ce3833b7800c0a9ec83367dc888ea571b3 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:53:16 +0100
Subject: tv exim-smarthost: open smtp port

---
 tv/1systems/cd.nix             | 1 -
 tv/2configs/exim-smarthost.nix | 5 ++++-
 2 files changed, 4 insertions(+), 2 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 783d23ca..1d945760 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -41,7 +41,6 @@ with lib;
       tv.iptables = {
         enable = true;
         input-internet-accept-new-tcp = [
-          "smtp"
           "xmpp-client"
           "xmpp-server"
         ];
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index f5f63d28..bcfea782 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -1,4 +1,6 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
+
+with lib;
 
 {
   krebs.exim-smarthost = {
@@ -34,4 +36,5 @@
       { from = "mirko"; to = "mv"; }
     ];
   };
+  tv.iptables.input-internet-accept-new-tcp = singleton "smtp";
 }
-- 
cgit v1.2.3


From 0c1a2d11b18c73ddc7fdb429e0d09dcffa3906f8 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 1 Feb 2016 17:56:10 +0100
Subject: cd: redistribute iptable rules

---
 tv/1systems/cd.nix | 20 +++++---------------
 1 file changed, 5 insertions(+), 15 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 1d945760..27e94aef 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -31,6 +31,10 @@ with lib;
         enable = true;
         hosts = [ "jabber.viljetic.de" ];
       };
+      tv.iptables.input-internet-accept-new-tcp = [
+        "xmpp-client"
+        "xmpp-server"
+      ];
     }
     {
       krebs.github-hosts-sync.enable = true;
@@ -38,19 +42,6 @@ with lib;
         singleton config.krebs.github-hosts-sync.port;
     }
     {
-      tv.iptables = {
-        enable = true;
-        input-internet-accept-new-tcp = [
-          "xmpp-client"
-          "xmpp-server"
-        ];
-        input-retiolum-accept-new-tcp = [
-          "http"
-        ];
-      };
-    }
-    {
-      tv.iptables.input-internet-accept-new-tcp = singleton "http";
       krebs.nginx.servers.cgit.server-names = [
         "cgit.cd.krebsco.de"
         "cgit.cd.viljetic.de"
@@ -62,8 +53,6 @@ with lib;
           alias /home/$1/public_html$2;
         '');
       };
-    }
-    {
       krebs.nginx.servers.viljetic = {
         server-names = singleton "viljetic.de";
         # TODO directly set root (instead via location)
@@ -71,6 +60,7 @@ with lib;
           root ${pkgs.viljetic-pages};
         '');
       };
+      tv.iptables.input-internet-accept-new-tcp = singleton "http";
     }
   ];
 
-- 
cgit v1.2.3


From 7dbfc126fb329a67d68b32803e866ba9f0e7b2f0 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 15:34:22 +0100
Subject: tv git public-repos += with-tmpdir

---
 tv/2configs/git.nix | 1 +
 1 file changed, 1 insertion(+)

(limited to 'tv')

diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index 800deff1..5e0f95c1 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -39,6 +39,7 @@ let
     stockholm = {
       desc = "take all the computers hostage, they'll love you!";
     };
+    with-tmpdir = {};
   } // mapAttrValues (setAttr "section" "2. Haskell libraries") {
     blessings = {};
     mime = {};
-- 
cgit v1.2.3


From 03e5d03c129190451e1431fac6aae70f745812f9 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 19:17:19 +0100
Subject: tv config: use null for dummy secrets

---
 tv/2configs/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index abe9d3de..777cd4ea 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -12,6 +12,7 @@ with lib;
     source = mapAttrs (_: mkDefault) ({
       nixos-config = "symlink:stockholm-private/1systems/${config.krebs.build.host.name}.nix";
       nixpkgs = symlink:stockholm-nixpkgs;
+      null = "/home/tv/stockholm/null";
       secrets = "/home/tv/secrets/${config.krebs.build.host.name}";
       secrets-common = "/home/tv/secrets/common";
       stockholm-krebs = "/home/tv/stockholm/krebs";
@@ -101,7 +102,7 @@ with lib;
       };
 
       environment.variables = {
-        NIX_PATH = mkForce "/var/src";
+        NIX_PATH = mkForce "secrets=/var/src/null:/var/src";
       };
 
       programs.bash = {
-- 
cgit v1.2.3


From 28382e43e0df74a6b10bfcf23465d8415fa86460 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 19:51:01 +0100
Subject: tv: RIP consul

---
 tv/1systems/cd.nix            |   1 -
 tv/1systems/mkdir.nix         |   1 -
 tv/1systems/rmdir.nix         |   1 -
 tv/2configs/consul-client.nix |   9 ----
 tv/2configs/consul-server.nix |  21 --------
 tv/3modules/consul.nix        | 118 ------------------------------------------
 tv/3modules/default.nix       |   1 -
 7 files changed, 152 deletions(-)
 delete mode 100644 tv/2configs/consul-client.nix
 delete mode 100644 tv/2configs/consul-server.nix
 delete mode 100644 tv/3modules/consul.nix

(limited to 'tv')

diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 27e94aef..e42d5750 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -14,7 +14,6 @@ with lib;
   imports = [
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    #../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
     ../2configs/retiolum.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 9d8a0bcf..79e5f73b 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -22,7 +22,6 @@ in
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
     {
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 1f1d975c..6fd79c59 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -23,7 +23,6 @@ in
   imports = [
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
-    ../2configs/consul-server.nix
     ../2configs/exim-smarthost.nix
     ../2configs/git.nix
     {
diff --git a/tv/2configs/consul-client.nix b/tv/2configs/consul-client.nix
deleted file mode 100644
index 0a8bf4d7..00000000
--- a/tv/2configs/consul-client.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ pkgs, ... }:
-
-{
-  imports = [ ./consul-server.nix ];
-
-  tv.consul = {
-    server = pkgs.lib.mkForce false;
-  };
-}
diff --git a/tv/2configs/consul-server.nix b/tv/2configs/consul-server.nix
deleted file mode 100644
index d10f9ea7..00000000
--- a/tv/2configs/consul-server.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ config, ... }:
-
-{
-  tv.consul = rec {
-    enable = true;
-
-    self = config.krebs.build.host;
-    inherit (self) dc;
-
-    server = true;
-
-    hosts = with config.krebs.hosts; [
-      # TODO get this list automatically from each host where tv.consul.enable is true
-      cd
-      mkdir
-      nomic
-      rmdir
-      #wu
-    ];
-  };
-}
diff --git a/tv/3modules/consul.nix b/tv/3modules/consul.nix
deleted file mode 100644
index 5c955fdb..00000000
--- a/tv/3modules/consul.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-# if quorum gets lost, then start any node with a config that doesn't contain bootstrap_expect
-# but -bootstrap
-# TODO consul-bootstrap HOST  that actually does is
-# TODO tools to inspect state of a cluster in outage state
-
-with lib;
-let
-  cfg = config.tv.consul;
-
-  out = {
-    options.tv.consul = api;
-    config = mkIf cfg.enable (mkMerge [
-      imp
-      { tv.iptables.input-retiolum-accept-new-tcp = [ "8300" "8301" ]; }
-      # TODO udp for 8301
-    ]);
-  };
-
-  api = {
-    enable = mkEnableOption "tv.consul";
-
-    dc = mkOption {
-      type = types.label;
-    };
-    hosts = mkOption {
-      type = with types; listOf host;
-    };
-    encrypt-file = mkOption {
-      type = types.str; # TODO path (but not just into store)
-      default = toString <secrets/consul-encrypt.json>;
-    };
-    data-dir = mkOption {
-      type = types.str; # TODO path (but not just into store)
-      default = "/var/lib/consul";
-    };
-    self = mkOption {
-      type = types.host;
-    };
-    server = mkOption {
-      type = types.bool;
-      default = false;
-    };
-    GOMAXPROCS = mkOption {
-      type = types.int;
-      default = cfg.self.cores;
-    };
-  };
-
-  consul-config = {
-    datacenter = cfg.dc;
-    data_dir = cfg.data-dir;
-    log_level = "INFO";
-    #node_name =
-    server = cfg.server;
-    enable_syslog = true;
-    retry_join =
-      # TODO allow consul in other nets than retiolum [maybe]
-      concatMap (host: host.nets.retiolum.addrs)
-                (filter (host: host.name != cfg.self.name) cfg.hosts);
-    leave_on_terminate = true;
-  } // optionalAttrs cfg.server {
-    bootstrap_expect = length cfg.hosts;
-    leave_on_terminate = false;
-  };
-
-  imp = {
-    environment.systemPackages = with pkgs; [
-      consul
-    ];
-
-    systemd.services.consul = {
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [
-        consul
-      ];
-      environment = {
-        GOMAXPROCS = toString cfg.GOMAXPROCS;
-      };
-      serviceConfig = {
-        PermissionsStartOnly = "true";
-        SyslogIdentifier = "consul";
-        User = user.name;
-        PrivateTmp = "true";
-        Restart = "always";
-        ExecStartPre = pkgs.writeScript "consul-init" ''
-          #! /bin/sh
-          mkdir -p ${cfg.data-dir}
-          chown ${user.name}: ${cfg.data-dir}
-          install -o ${user.name} -m 0400 ${cfg.encrypt-file} /tmp/encrypt.json
-        '';
-        ExecStart = pkgs.writeScript "consul-service" ''
-          #! /bin/sh
-          set -euf
-          exec >/dev/null
-          exec consul agent \
-            -config-file=${toFile "consul.json" (toJSON consul-config)} \
-            -config-file=/tmp/encrypt.json
-        '';
-        #-node=${cfg.self.fqdn} \
-        #ExecStart = "${tinc}/sbin/tincd -c ${confDir} -d 0 -U ${user} -D";
-      };
-    };
-
-    users.extraUsers = singleton {
-      inherit (user) name uid;
-    };
-  };
-
-  user = rec {
-    name = "consul";
-    uid = genid name;
-  };
-
-in
-out
diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
index bb10d826..f7889b24 100644
--- a/tv/3modules/default.nix
+++ b/tv/3modules/default.nix
@@ -2,7 +2,6 @@ _:
 
 {
   imports = [
-    ./consul.nix
     ./ejabberd.nix
     ./iptables.nix
   ];
-- 
cgit v1.2.3


From d341d1ad1006d49299007c2210dfd8f9903ae21a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 20:01:28 +0100
Subject: tv vim: drop noise

---
 tv/2configs/vim.nix | 5 -----
 1 file changed, 5 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index bab94927..83cc6e11 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -7,11 +7,6 @@ let
       vim
     ];
 
-    # Nano really is just a stupid name for Vim.
-    nixpkgs.config.packageOverrides = pkgs: {
-      nano = pkgs.vim;
-    };
-
     environment.etc.vimrc.source = vimrc;
 
     environment.variables.EDITOR = mkForce "vim";
-- 
cgit v1.2.3


From ef0ce9065f312140cbcb51fc5102c4c5d4e80568 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 20:02:01 +0100
Subject: tv nix.vim: let b:current_syntax

---
 tv/2configs/vim.nix | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'tv')

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 83cc6e11..23f90af0 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -105,6 +105,8 @@ let
 
       syn match String /"\([^\\"]\|\\.\)*"/
       syn match Comment /\(^\|\s\)#.*/
+
+      let b:current_syntax = "nix"
     ''}
 
     au BufRead,BufNewFile /dev/shm/* set nobackup nowritebackup noswapfile
-- 
cgit v1.2.3


From ba4bfed2715cb3973f9dbaa6f0a6010c59121a54 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 20:05:12 +0100
Subject: wu: selectively allowUnfree nvidia-x11

---
 tv/1systems/wu.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'tv')

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index aef8ca76..2fa0e8ab 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -157,7 +157,7 @@ with lib;
 
   nixpkgs.config.chromium.enablePepperFlash = true;
 
-  nixpkgs.config.allowUnfree = true;
+  nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name;
   hardware.bumblebee.enable = true;
   hardware.bumblebee.group = "video";
   hardware.enableAllFirmware = true;
-- 
cgit v1.2.3


From 34dcaa692382072889e7e796461933ff129d5a13 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 20:06:15 +0100
Subject: xu: don't unconditionally allowUnfree

---
 tv/1systems/xu.nix | 1 -
 1 file changed, 1 deletion(-)

(limited to 'tv')

diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 31a8a3e9..8c4af2bd 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -155,7 +155,6 @@ with lib;
 
   nixpkgs.config.chromium.enablePepperFlash = true;
 
-  nixpkgs.config.allowUnfree = true;
   #hardware.bumblebee.enable = true;
   #hardware.bumblebee.group = "video";
   hardware.enableAllFirmware = true;
-- 
cgit v1.2.3


From 44b9f90b2c70c997399afcc550dac2fff155af6b Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 20:12:06 +0100
Subject: tv config: allowUnfree = false

---
 tv/2configs/default.nix | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'tv')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 777cd4ea..ee1d9521 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -70,6 +70,9 @@ with lib;
 
       nix.useChroot = true;
     }
+    {
+      nixpkgs.config.allowUnfree = false;
+    }
     {
       environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
 
-- 
cgit v1.2.3


From afd09edbd3ec1739fb95eaab664a2400386ce7a0 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 2 Feb 2016 20:17:10 +0100
Subject: tv: cleanup allowUnfree

---
 tv/2configs/hw/AO753.nix | 9 ++++-----
 tv/2configs/hw/x220.nix  | 1 -
 2 files changed, 4 insertions(+), 6 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix
index acd9ee32..72a40819 100644
--- a/tv/2configs/hw/AO753.nix
+++ b/tv/2configs/hw/AO753.nix
@@ -1,4 +1,6 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
+
+with lib;
 
 {
   imports = [
@@ -39,8 +41,5 @@
     HandleSuspendKey=ignore
   '';
 
-  nixpkgs.config = {
-    allowUnfree = false;
-    allowUnfreePredicate = (x: pkgs.lib.hasPrefix "broadcom-sta-" x.name);
-  };
+  nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name;
 }
diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix
index 8549311e..7cec670f 100644
--- a/tv/2configs/hw/x220.nix
+++ b/tv/2configs/hw/x220.nix
@@ -14,7 +14,6 @@
   networking.wireless.enable = true;
 
   #hardware.enableAllFirmware = true;
-  #nixpkgs.config.allowUnfree = true;
   #zramSwap.enable = true;
   #zramSwap.numDevices = 2;
 
-- 
cgit v1.2.3


From cdb590be5072712c9552a98f8979aa94288dcbc8 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 3 Feb 2016 13:36:54 +0100
Subject: krebs.git.rules: specify type

---
 tv/2configs/git.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index 5e0f95c1..01dc7de9 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -9,7 +9,7 @@ let
       enable = true;
       root-title = "public repositories at ${config.krebs.build.host.name}";
       root-desc = "keep calm and engage";
-      repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) repos;
+      repos = repos;
       rules = rules;
     };
   };
@@ -99,7 +99,7 @@ let
         repo = [ repo ];
         perm = fetch;
       } ++
-      optional (length (repo.collaborators or []) > 0) {
+      optional (repo.collaborators or [] != []) {
         user = repo.collaborators;
         repo = [ repo ];
         perm = fetch;
-- 
cgit v1.2.3


From 5bc7523bb54e960f5ac00492b16519b1bce21007 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 3 Feb 2016 19:39:00 +0100
Subject: cac-1.0.3 -> cac-api-1.1.0

---
 tv/1systems/wu.nix  | 2 +-
 tv/2configs/git.nix | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

(limited to 'tv')

diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 2fa0e8ab..29e6de08 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -43,7 +43,7 @@ with lib;
         # tv
         bc
         bind # dig
-        cac
+        cac-api
         dic
         file
         get
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index 01dc7de9..b8180085 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -22,8 +22,8 @@ let
 
   public-repos = mapAttrs make-public-repo ({
   } // mapAttrValues (setAttr "section" "1. Miscellaneous") {
-    cac = {
-      desc = "CloudAtCost command line interface";
+    cac-api = {
+      desc = "CloudAtCost API command line interface";
     };
     get = {};
     hack = {};
-- 
cgit v1.2.3


From fb734eded558aad5a728eb1b1b350235a921d541 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 4 Feb 2016 03:07:47 +0100
Subject: stockholm: stockholm-path -> ./.

---
 tv/2configs/default.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index ee1d9521..46320b73 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -10,14 +10,13 @@ with lib;
     target = mkDefault "root@${config.krebs.build.host.name}";
     source-version = 2;
     source = mapAttrs (_: mkDefault) ({
-      nixos-config = "symlink:stockholm-private/1systems/${config.krebs.build.host.name}.nix";
-      nixpkgs = symlink:stockholm-nixpkgs;
-      null = "/home/tv/stockholm/null";
+      nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix";
+      nixpkgs = symlink:stockholm/nixpkgs;
+      null = "symlink:stockholm/null";
       secrets = "/home/tv/secrets/${config.krebs.build.host.name}";
       secrets-common = "/home/tv/secrets/common";
-      stockholm-krebs = "/home/tv/stockholm/krebs";
-      stockholm-nixpkgs = "/home/tv/stockholm/nixpkgs";
-      stockholm-private = "/home/tv/stockholm/tv";
+      stockholm = "/home/tv/stockholm";
+      stockholm-user = "symlink:stockholm/tv";
       upstream-nixpkgs = {
         url = https://github.com/NixOS/nixpkgs;
         rev = "77f8f35d57618c1ba456d968524f2fb2c3448295";
-- 
cgit v1.2.3


From b857a48632128be0324c68be95bee16fb0f1b15f Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 4 Feb 2016 05:40:26 +0100
Subject: krebs.build.populate: init and drop support for v1

---
 tv/2configs/default.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

(limited to 'tv')

diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 46320b73..57c4620c 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -8,11 +8,9 @@ with lib;
   krebs.build = {
     user = config.krebs.users.tv;
     target = mkDefault "root@${config.krebs.build.host.name}";
-    source-version = 2;
     source = mapAttrs (_: mkDefault) ({
       nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix";
       nixpkgs = symlink:stockholm/nixpkgs;
-      null = "symlink:stockholm/null";
       secrets = "/home/tv/secrets/${config.krebs.build.host.name}";
       secrets-common = "/home/tv/secrets/common";
       stockholm = "/home/tv/stockholm";
@@ -104,7 +102,7 @@ with lib;
       };
 
       environment.variables = {
-        NIX_PATH = mkForce "secrets=/var/src/null:/var/src";
+        NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
       };
 
       programs.bash = {
-- 
cgit v1.2.3