This repository has no description
move over from stockholm, make aergia buildable
author
lassulus
date
(Sep 7, 2023, 12:14 PM CEST)
commit
6f538321
6f538321cb47b93e721f052f9dcb08f614e284a9
parent
4031216a
4031216a4f32cd5148ad70504b8d548a95e6d725
+18662
+13
nixos/default.nix
+13
nixos/default.nix
···
1
+
{ self, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
./2configs
5
+
./3modules
6
+
self.inputs.stockholm.nixosModules.krebs
7
+
];
8
+
nixpkgs.config.packageOverrides = import ./5pkgs pkgs;
9
+
nixpkgs.overlays = [
10
+
self.inputs.stockholm.overlays.default
11
+
(import (self.inputs.stockholm.inputs.nix-writers + "/pkgs"))
12
+
];
13
+
}
+82
nixos/2configs/AP.nix
+82
nixos/2configs/AP.nix
···
1
+
{ config, pkgs, ... }:
2
+
let
3
+
wifi = "wlp0s29u1u2";
4
+
in {
5
+
boot.extraModulePackages = [
6
+
pkgs.linuxPackages.rtl8814au
7
+
];
8
+
networking.networkmanager.unmanaged = [ wifi "et0" ];
9
+
10
+
systemd.services.hostapd = {
11
+
description = "hostapd wireless AP";
12
+
path = [ pkgs.hostapd ];
13
+
wantedBy = [ "network.target" ];
14
+
15
+
after = [ "${wifi}-cfg.service" "nat.service" "bind.service" "dhcpd.service" "sys-subsystem-net-devices-${wifi}.device" ];
16
+
17
+
serviceConfig = {
18
+
ExecStart = "${pkgs.hostapd}/bin/hostapd ${pkgs.writeText "hostapd.conf" ''
19
+
interface=${wifi}
20
+
hw_mode=a
21
+
channel=36
22
+
ieee80211d=1
23
+
country_code=DE
24
+
ieee80211n=1
25
+
ieee80211ac=1
26
+
wmm_enabled=1
27
+
28
+
# 5ghz
29
+
ssid=krebsing
30
+
auth_algs=1
31
+
wpa=2
32
+
wpa_key_mgmt=WPA-PSK
33
+
rsn_pairwise=CCMP
34
+
wpa_passphrase=aidsballz
35
+
''}";
36
+
Restart = "always";
37
+
};
38
+
};
39
+
40
+
networking.bridges.br0.interfaces = [
41
+
wifi
42
+
"et0"
43
+
];
44
+
45
+
networking.interfaces.br0.ipv4.addresses = [
46
+
{ address = "10.99.0.1"; prefixLength = 24; }
47
+
];
48
+
services.dhcpd4 = {
49
+
enable = true;
50
+
interfaces = [ "br0" ];
51
+
extraConfig = ''
52
+
option subnet-mask 255.255.255.0;
53
+
option routers 10.99.0.1;
54
+
option domain-name-servers 1.1.1.1, 8.8.8.8;
55
+
subnet 10.99.0.0 netmask 255.255.255.0 {
56
+
range 10.99.0.100 10.99.0.200;
57
+
}
58
+
'';
59
+
};
60
+
61
+
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
62
+
krebs.iptables.tables.filter.FORWARD.rules = [
63
+
{ v6 = false; predicate = "-d 10.99.0.0/24 -o br0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
64
+
{ v6 = false; predicate = "-s 10.99.0.0/24 -i br0"; target = "ACCEPT"; }
65
+
{ v6 = false; predicate = "-i br0 -o br0"; target = "ACCEPT"; }
66
+
{ v6 = false; predicate = "-i br0 -o br0"; target = "ACCEPT"; }
67
+
{ v6 = false; predicate = "-o br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
68
+
{ v6 = false; predicate = "-i br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
69
+
];
70
+
krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
71
+
{ v6 = false; predicate = "-s 10.99.0.0/24"; target = "ACCEPT"; }
72
+
];
73
+
krebs.iptables.tables.nat.POSTROUTING.rules = [
74
+
#TODO find out what this is about?
75
+
{ v6 = false; predicate = "-s 10.99.0.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
76
+
{ v6 = false; predicate = "-s 10.99.0.0/24 -d 255.255.255.255"; target = "RETURN"; }
77
+
78
+
{ v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24"; target = "MASQUERADE"; }
79
+
{ v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
80
+
{ v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
81
+
];
82
+
}
+37
nixos/2configs/IM.nix
+37
nixos/2configs/IM.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
weechat = pkgs.weechat.override {
3
+
configure = { availablePlugins, ... }: {
4
+
scripts = with pkgs.weechatScripts; [
5
+
weechat-matrix
6
+
];
7
+
};
8
+
};
9
+
10
+
tmux = "/run/current-system/sw/bin/tmux";
11
+
12
+
in {
13
+
imports = [
14
+
./bitlbee.nix
15
+
];
16
+
environment.systemPackages = [ weechat ];
17
+
systemd.services.chat = {
18
+
description = "chat environment setup";
19
+
environment.WEECHAT_HOME = "\$HOME/.weechat";
20
+
after = [ "network.target" ];
21
+
wantedBy = [ "multi-user.target" ];
22
+
23
+
restartIfChanged = false;
24
+
25
+
path = [
26
+
pkgs.rxvt-unicode-unwrapped.terminfo
27
+
];
28
+
29
+
serviceConfig = {
30
+
User = "lass";
31
+
RemainAfterExit = true;
32
+
Type = "oneshot";
33
+
ExecStart = "${tmux} -2 new-session -d -s IM ${weechat}/bin/weechat";
34
+
ExecStop = "${tmux} kill-session -t IM"; # TODO run save in weechat
35
+
};
36
+
};
37
+
}
+20
nixos/2configs/ableton.nix
+20
nixos/2configs/ableton.nix
···
1
+
{ config, pkgs, ... }: let
2
+
mainUser = config.users.extraUsers.mainUser;
3
+
in {
4
+
users.users= {
5
+
ableton = {
6
+
isNormalUser = true;
7
+
extraGroups = [
8
+
"audio"
9
+
"video"
10
+
];
11
+
packages = [
12
+
pkgs.wine
13
+
pkgs.winetricks
14
+
];
15
+
};
16
+
};
17
+
security.sudo.extraConfig = ''
18
+
${mainUser.name} ALL=(ableton) NOPASSWD: ALL
19
+
'';
20
+
}
+134
nixos/2configs/alacritty.nix
+134
nixos/2configs/alacritty.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
3
+
alacritty-cfg = extrVals: builtins.toJSON ({
4
+
font = let
5
+
family = "Iosevka Term SS15";
6
+
in {
7
+
normal = {
8
+
family = family;
9
+
style = "Regular";
10
+
};
11
+
bold = {
12
+
family = family;
13
+
style = "Bold";
14
+
};
15
+
italic = {
16
+
family = family;
17
+
style = "Italic";
18
+
};
19
+
bold_italic = {
20
+
family = family;
21
+
style = "Bold Italic";
22
+
};
23
+
size = 12;
24
+
};
25
+
live_config_reload = true;
26
+
window.dimensions = {
27
+
columns = 80;
28
+
lines = 20;
29
+
};
30
+
env.WINIT_X11_SCALE_FACTOR = "1.0";
31
+
# window.opacity = 0;
32
+
hints.enabled = [
33
+
{
34
+
regex = ''(mailto:|gemini:|gopher:|https:|http:|news:|file:|git:|ssh:|ftp:)[^\u0000-\u001F\u007F-\u009F<>"\s{-}\^⟨⟩`]+'';
35
+
command = "/run/current-system/sw/bin/xdg-open";
36
+
post_processing = true;
37
+
mouse.enabled = true;
38
+
binding = {
39
+
key = "U";
40
+
mods = "Alt";
41
+
};
42
+
}
43
+
];
44
+
} // extrVals);
45
+
46
+
alacritty = pkgs.symlinkJoin {
47
+
name = "alacritty";
48
+
paths = [
49
+
(pkgs.writeDashBin "alacritty" ''
50
+
${pkgs.alacritty}/bin/alacritty --config-file /var/theme/config/alacritty.yaml msg create-window "$@" ||
51
+
${pkgs.alacritty}/bin/alacritty --config-file /var/theme/config/alacritty.yaml "$@"
52
+
'')
53
+
pkgs.alacritty
54
+
];
55
+
};
56
+
57
+
in {
58
+
environment.etc = {
59
+
"themes/light/alacritty.yaml".text = alacritty-cfg {
60
+
colors = {
61
+
# Default colors
62
+
primary = {
63
+
# hard contrast: background = '#f9f5d7'
64
+
# background = "#fbf1c7";
65
+
background = "#f9f5d7";
66
+
# soft contrast: background = '#f2e5bc'
67
+
foreground = "#3c3836";
68
+
};
69
+
70
+
# Normal colors
71
+
normal = {
72
+
black = "#fbf1c7";
73
+
red = "#cc241d";
74
+
green = "#98971a";
75
+
yellow = "#d79921";
76
+
blue = "#458588";
77
+
magenta = "#b16286";
78
+
cyan = "#689d6a";
79
+
white = "#7c6f64";
80
+
};
81
+
82
+
# Bright colors
83
+
bright = {
84
+
black = "#928374";
85
+
red = "#9d0006";
86
+
green = "#79740e";
87
+
yellow = "#b57614";
88
+
blue = "#076678";
89
+
magenta = "#8f3f71";
90
+
cyan = "#427b58";
91
+
white = "#3c3836";
92
+
};
93
+
};
94
+
};
95
+
"themes/dark/alacritty.yaml".text = alacritty-cfg {
96
+
colors = {
97
+
# Default colors
98
+
primary = {
99
+
background = "0x000000";
100
+
foreground = "0xffffff";
101
+
};
102
+
cursor = {
103
+
text = "0xF81CE5";
104
+
cursor = "0xffffff";
105
+
};
106
+
107
+
# Normal colors
108
+
normal = {
109
+
black = "0x000000";
110
+
red = "0xfe0100";
111
+
green = "0x33ff00";
112
+
yellow = "0xfeff00";
113
+
blue = "0x0066ff";
114
+
magenta = "0xcc00ff";
115
+
cyan = "0x00ffff";
116
+
white = "0xd0d0d0";
117
+
};
118
+
119
+
# Bright colors
120
+
bright = {
121
+
black = "0x808080";
122
+
red = "0xfe0100";
123
+
green = "0x33ff00";
124
+
yellow = "0xfeff00";
125
+
blue = "0x0066ff";
126
+
magenta = "0xcc00ff";
127
+
cyan = "0x00ffff";
128
+
white = "0xFFFFFF";
129
+
};
130
+
};
131
+
};
132
+
};
133
+
environment.systemPackages = [ alacritty ];
134
+
}
+10
nixos/2configs/atuin-server.nix
+10
nixos/2configs/atuin-server.nix
+16
nixos/2configs/autotether.nix
+16
nixos/2configs/autotether.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
systemd.services.usb_tether = {
4
+
script = ''
5
+
${pkgs.android-tools}/bin/adb -s QV770FAMEK wait-for-device
6
+
${pkgs.android-tools}/bin/adb -s QV770FAMEK shell svc usb setFunctions rndis
7
+
'';
8
+
};
9
+
services.udev.extraRules = ''
10
+
ACTION=="add", SUBSYSTEM=="usb", ENV{PRODUCT}=="fce/320d/510", TAG+="systemd", ENV{SYSTEMD_WANTS}="usb_tether.service"
11
+
'';
12
+
systemd.network.networks.android = {
13
+
matchConfig.Name = "enp0s20u1";
14
+
DHCP = "yes";
15
+
};
16
+
}
+195
nixos/2configs/baseX.nix
+195
nixos/2configs/baseX.nix
···
1
+
{ self, config, lib, pkgs, ... }:
2
+
let
3
+
user = config.krebs.build.user;
4
+
in {
5
+
imports = [
6
+
./alacritty.nix
7
+
./mpv.nix
8
+
./power-action.nix
9
+
./urxvt.nix
10
+
./xdg-open.nix
11
+
./yubikey.nix
12
+
./pipewire.nix
13
+
./tmux.nix
14
+
./xmonad.nix
15
+
./themes.nix
16
+
./fonts.nix
17
+
{
18
+
users.users.mainUser.packages = [
19
+
pkgs.sshuttle
20
+
];
21
+
security.sudo.extraConfig = ''
22
+
lass ALL= (root) NOPASSWD:SETENV: ${pkgs.sshuttle}/bin/.sshuttle-wrapped
23
+
'';
24
+
}
25
+
{ #font magic
26
+
options.lass.fonts = {
27
+
regular = lib.mkOption {
28
+
type = lib.types.str;
29
+
default = "xft:Iosevka Term SS15:style=regular";
30
+
};
31
+
bold = lib.mkOption {
32
+
type = lib.types.str;
33
+
default = "xft:Iosevka Term SS15:style=bold";
34
+
};
35
+
italic = lib.mkOption {
36
+
type = lib.types.str;
37
+
default = "xft:Iosevka Term SS15:style=italic";
38
+
};
39
+
};
40
+
config.krebs.xresources.resources.X = ''
41
+
*.font: ${config.lass.fonts.regular}
42
+
*.boldFont: ${config.lass.fonts.bold}
43
+
*.italicFont: ${config.lass.fonts.italic}
44
+
'';
45
+
}
46
+
];
47
+
48
+
users.users.mainUser.extraGroups = [ "audio" "pipewire" "video" ];
49
+
50
+
time.timeZone = "Europe/Berlin";
51
+
52
+
programs.ssh.agentTimeout = "10m";
53
+
programs.ssh.startAgent = false;
54
+
services.openssh.forwardX11 = true;
55
+
56
+
environment.systemPackages = with pkgs; [
57
+
acpi
58
+
acpilight
59
+
ripgrep
60
+
cabal2nix
61
+
dic
62
+
dmenu
63
+
font-size
64
+
fzfmenu
65
+
gimp
66
+
gitAndTools.gh
67
+
git-crypt
68
+
git-preview
69
+
dconf
70
+
iodine
71
+
libarchive
72
+
lm_sensors
73
+
ncdu
74
+
nix-index
75
+
nixpkgs-review
76
+
nmap
77
+
pavucontrol
78
+
ponymix
79
+
powertop
80
+
rxvt-unicode
81
+
sshvnc
82
+
sxiv
83
+
nsxiv
84
+
taskwarrior
85
+
termite
86
+
transgui
87
+
wirelesstools
88
+
x11vnc
89
+
xclip
90
+
xephyrify
91
+
xorg.xmodmap
92
+
xorg.xhost
93
+
xdotool
94
+
xsel
95
+
zathura
96
+
flameshot
97
+
(pkgs.writers.writeDashBin "screenshot" ''
98
+
set -efu
99
+
100
+
${pkgs.flameshot}/bin/flameshot gui &&
101
+
${pkgs.klem}/bin/klem
102
+
'')
103
+
(pkgs.writers.writeDashBin "IM" ''
104
+
${pkgs.mosh}/bin/mosh green.r -- tmux new-session -A -s IM -- weechat
105
+
'')
106
+
(pkgs.writers.writeDashBin "deploy_hm" ''
107
+
target=$1
108
+
shift
109
+
110
+
hm_profile=$(${pkgs.home-manager}/bin/home-manager -f ~/sync/stockholm/lass/2configs/home-manager.nix build "$@")
111
+
nix-copy-closure --to "$target" "$hm_profile"
112
+
ssh "$target" -- "$hm_profile"/activate
113
+
'')
114
+
zbar
115
+
];
116
+
117
+
services.udev.extraRules = ''
118
+
SUBSYSTEM=="backlight", ACTION=="add", \
119
+
RUN+="${pkgs.coreutils}/bin/chgrp video /sys/class/backlight/%k/brightness", \
120
+
RUN+="${pkgs.coreutils}/bin/chmod g+w /sys/class/backlight/%k/brightness"
121
+
'';
122
+
123
+
services.xserver = {
124
+
enable = true;
125
+
layout = "us";
126
+
display = lib.mkForce 0;
127
+
xkbVariant = "altgr-intl";
128
+
xkbOptions = "caps:escape";
129
+
libinput.enable = true;
130
+
exportConfiguration = true;
131
+
displayManager = {
132
+
lightdm.enable = true;
133
+
defaultSession = "none+xmonad";
134
+
sessionCommands = ''
135
+
${pkgs.xorg.xhost}/bin/xhost +LOCAL:
136
+
'';
137
+
};
138
+
};
139
+
140
+
nixpkgs.config.packageOverrides = super: {
141
+
dmenu = pkgs.writers.writeDashBin "dmenu" ''
142
+
${pkgs.fzfmenu}/bin/fzfmenu "$@"
143
+
'';
144
+
};
145
+
146
+
krebs.xresources.enable = true;
147
+
148
+
lass.klem = {
149
+
kpaste.script = pkgs.writeDash "kpaste-wrapper" ''
150
+
${pkgs.kpaste}/bin/kpaste \
151
+
| ${pkgs.coreutils}/bin/tail -1 \
152
+
| ${pkgs.coreutils}/bin/tr -d '\r\n'
153
+
'';
154
+
go = {
155
+
target = "STRING";
156
+
script = "${pkgs.goify}/bin/goify";
157
+
};
158
+
"go.lassul.us" = {
159
+
target = "STRING";
160
+
script = pkgs.writeDash "go.lassul.us" ''
161
+
export GO_HOST='go.lassul.us'
162
+
${pkgs.goify}/bin/goify
163
+
'';
164
+
};
165
+
qrcode = {
166
+
target = "image";
167
+
script = pkgs.writeDash "zbar" ''
168
+
${pkgs.zbar}/bin/zbarimg -q --raw -
169
+
'';
170
+
};
171
+
ocr = {
172
+
target = "image";
173
+
script = pkgs.writeDash "gocr" ''
174
+
${pkgs.netpbm}/bin/pngtopnm - \
175
+
| ${pkgs.gocr}/bin/gocr -
176
+
'';
177
+
};
178
+
};
179
+
180
+
services.clipmenu.enable = true;
181
+
182
+
# synchronize all the clipboards
183
+
systemd.user.services.autocutsel = {
184
+
enable = true;
185
+
wantedBy = [ "graphical-session.target" ];
186
+
after = [ "graphical-session.target" ];
187
+
serviceConfig = {
188
+
Type = "forking";
189
+
ExecStart = pkgs.writers.writeDash "autocutsel" ''
190
+
${pkgs.autocutsel}/bin/autocutsel -fork -selection PRIMARY
191
+
${pkgs.autocutsel}/bin/autocutsel -fork -selection CLIPBOARD
192
+
'';
193
+
};
194
+
};
195
+
}
+13
nixos/2configs/bird.nix
+13
nixos/2configs/bird.nix
+34
nixos/2configs/bitcoin.nix
+34
nixos/2configs/bitcoin.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
let
4
+
mainUser = config.users.extraUsers.mainUser;
5
+
in {
6
+
7
+
users.extraUsers = {
8
+
bitcoin = {
9
+
name = "bitcoin";
10
+
description = "user for bitcoin stuff";
11
+
home = "/home/bitcoin";
12
+
useDefaultShell = true;
13
+
createHome = true;
14
+
packages = [ pkgs.electrum ];
15
+
isNormalUser = true;
16
+
};
17
+
monero = {
18
+
name = "monero";
19
+
description = "user for monero stuff";
20
+
home = "/home/monero";
21
+
useDefaultShell = true;
22
+
createHome = true;
23
+
packages = [
24
+
pkgs.monero
25
+
pkgs.monero-gui
26
+
];
27
+
isNormalUser = true;
28
+
};
29
+
};
30
+
security.sudo.extraConfig = ''
31
+
${mainUser.name} ALL=(bitcoin) ALL
32
+
${mainUser.name} ALL=(monero) ALL
33
+
'';
34
+
}
+33
nixos/2configs/bitlbee.nix
+33
nixos/2configs/bitlbee.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
services.bitlbee = {
5
+
enable = true;
6
+
portNumber = 6666;
7
+
plugins = [
8
+
pkgs.bitlbee-facebook
9
+
pkgs.bitlbee-steam
10
+
pkgs.bitlbee-discord
11
+
];
12
+
libpurple_plugins = [
13
+
# pkgs.telegram-purple
14
+
# pkgs.tdlib-purple
15
+
# pkgs.purple-gowhatsapp
16
+
];
17
+
configDir = "/var/state/bitlbee";
18
+
};
19
+
20
+
systemd.services.bitlbee.serviceConfig = {
21
+
ExecStartPre = [
22
+
"+${pkgs.writeDash "setup-bitlbee" ''
23
+
${pkgs.coreutils}/bin/chown bitlbee:bitlbee /var/state/bitlbee || :
24
+
''}"
25
+
];
26
+
ReadWritePaths = [
27
+
"/var/state/bitlbee"
28
+
];
29
+
};
30
+
systemd.tmpfiles.rules = [
31
+
"d /var/state/bitlbee 0700 - - -"
32
+
];
33
+
}
+115
nixos/2configs/blue-host.nix
+115
nixos/2configs/blue-host.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
all_hosts = [
4
+
"icarus"
5
+
"shodan"
6
+
"daedalus"
7
+
"skynet"
8
+
"prism"
9
+
"littleT"
10
+
];
11
+
remote_hosts = filter (h: h != config.networking.hostName) all_hosts;
12
+
13
+
in {
14
+
imports = [
15
+
<stockholm/lass/2configs/container-networking.nix>
16
+
{ #hack for already defined
17
+
systemd.services."container@blue".reloadIfChanged = mkForce false;
18
+
systemd.services."container@blue".preStart = ''
19
+
${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue'
20
+
'';
21
+
systemd.services."container@blue".preStop = ''
22
+
/run/wrappers/bin/fusermount -u /var/lib/containers/blue
23
+
'';
24
+
}
25
+
];
26
+
27
+
system.activationScripts.containerPermissions = ''
28
+
mkdir -p /var/lib/containers
29
+
chmod 711 /var/lib/containers
30
+
'';
31
+
32
+
containers.blue = {
33
+
config = { ... }: {
34
+
environment.systemPackages = [
35
+
pkgs.git
36
+
pkgs.rxvt-unicode-unwrapped.terminfo
37
+
];
38
+
services.openssh.enable = true;
39
+
users.users.root.openssh.authorizedKeys.keys = [
40
+
config.krebs.users.lass.pubkey
41
+
];
42
+
};
43
+
autoStart = false;
44
+
enableTun = true;
45
+
privateNetwork = true;
46
+
hostAddress = "10.233.2.9";
47
+
localAddress = "10.233.2.10";
48
+
};
49
+
50
+
51
+
#systemd.services = builtins.listToAttrs (map (host:
52
+
# let
53
+
# in nameValuePair "sync-blue-${host}" {
54
+
# bindsTo = [ "container@blue.service" ];
55
+
# wantedBy = [ "container@blue.service" ];
56
+
# # ssh needed for rsync
57
+
# path = [ pkgs.openssh ];
58
+
# serviceConfig = {
59
+
# Restart = "always";
60
+
# RestartSec = 10;
61
+
# ExecStart = pkgs.writeDash "sync-blue-${host}" ''
62
+
# set -efu
63
+
# #make sure blue is running
64
+
# /run/wrappers/bin/ping -c1 blue.r > /dev/null
65
+
66
+
# #make sure the container is unlocked
67
+
# ${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue'
68
+
69
+
# #make sure our target is reachable
70
+
# ${pkgs.untilport}/bin/untilport ${host}.r 22 2>/dev/null
71
+
72
+
# #start sync
73
+
# ${pkgs.lsyncd}/bin/lsyncd -log scarce ${pkgs.writeText "lsyncd-config.lua" ''
74
+
# settings {
75
+
# nodaemon = true,
76
+
# inotifyMode = "CloseWrite or Modify",
77
+
# }
78
+
# sync {
79
+
# default.rsyncssh,
80
+
# source = "/var/lib/containers/.blue",
81
+
# host = "${host}.r",
82
+
# targetdir = "/var/lib/containers/.blue",
83
+
# rsync = {
84
+
# archive = true,
85
+
# owner = true,
86
+
# group = true,
87
+
# };
88
+
# ssh = {
89
+
# binary = "${pkgs.openssh}/bin/ssh";
90
+
# identityFile = "/var/lib/containers/blue/home/lass/.ssh/id_rsa",
91
+
# },
92
+
# }
93
+
# ''}
94
+
# '';
95
+
# };
96
+
# unitConfig.ConditionPathExists = "!/var/run/ppp0.pid";
97
+
# }
98
+
#) remote_hosts);
99
+
100
+
environment.systemPackages = [
101
+
(pkgs.writeDashBin "start-blue" ''
102
+
set -ef
103
+
if ! $(mount | ${pkgs.gnugrep}/bin/grep -qi '^encfs on /var/lib/containers/blue'); then
104
+
${pkgs.encfs}/bin/encfs --public /var/lib/containers/.blue /var/lib/containers/blue
105
+
fi
106
+
nixos-container start blue
107
+
nixos-container run blue -- nixos-rebuild -I /var/src dry-build
108
+
if ping -c1 blue.r >/dev/null; then
109
+
echo 'blue is already running. bailing out'
110
+
exit 23
111
+
fi
112
+
nixos-container run blue -- nixos-rebuild -I /var/src switch
113
+
'')
114
+
];
115
+
}
+32
nixos/2configs/blue.nix
+32
nixos/2configs/blue.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
./mail.nix
6
+
./pass.nix
7
+
];
8
+
9
+
environment.systemPackages = with pkgs; [
10
+
dic
11
+
nmap
12
+
git-preview
13
+
l-gen-secrets
14
+
];
15
+
16
+
services.tor.enable = true;
17
+
services.tor.client.enable = true;
18
+
19
+
krebs.iptables.tables.filter.INPUT.rules = [
20
+
{ predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT";}
21
+
{ predicate = "-i wiregrill -p udp --dport 60000:61000"; target = "ACCEPT";}
22
+
{ predicate = "-i retiolum -p tcp --dport 9998:9999"; target = "ACCEPT";}
23
+
{ predicate = "-i wiregrill -p tcp --dport 9998:9999"; target = "ACCEPT";}
24
+
{ predicate = "-i retiolum -p tcp --dport imap"; target = "ACCEPT";}
25
+
{ predicate = "-i wiregrill -p tcp --dport imap"; target = "ACCEPT";}
26
+
];
27
+
28
+
services.dovecot2 = {
29
+
enable = true;
30
+
mailLocation = "maildir:~/Maildir";
31
+
};
32
+
}
+43
nixos/2configs/br.nix
+43
nixos/2configs/br.nix
···
1
+
{ config, lib, pkgs, modulesPath, ... }: {
2
+
3
+
imports = [
4
+
(modulesPath + "/services/hardware/sane_extra_backends/brscan4.nix")
5
+
];
6
+
7
+
hardware.sane = {
8
+
enable = true;
9
+
brscan4 = {
10
+
enable = true;
11
+
netDevices = {
12
+
bra = {
13
+
model = "MFCL2700DN";
14
+
ip = "10.42.0.4";
15
+
};
16
+
};
17
+
};
18
+
};
19
+
20
+
services.saned.enable = true;
21
+
22
+
# usage: scanimage -d "$(find-scanner bra)" --batch --format=tiff --resolution 150 -x 211 -y 298
23
+
environment.systemPackages = [
24
+
(pkgs.writeDashBin "find-scanner" ''
25
+
set -efu
26
+
name=$1
27
+
${pkgs.sane-backends}/bin/scanimage -f '%m %d
28
+
' \
29
+
| ${pkgs.gawk}/bin/awk -v dev="*$name" '$1 == dev { print $2; exit }' \
30
+
| ${pkgs.gnugrep}/bin/grep .
31
+
'')
32
+
];
33
+
34
+
services.printing = {
35
+
enable = true;
36
+
drivers = [
37
+
pkgs.mfcl2700dncupswrapper
38
+
];
39
+
};
40
+
41
+
users.users.mainUser.extraGroups = [ "scanner" "lp" ];
42
+
43
+
}
+8
nixos/2configs/browsers.nix
+8
nixos/2configs/browsers.nix
+115
nixos/2configs/c-base.nix
+115
nixos/2configs/c-base.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
let
4
+
in {
5
+
6
+
environment.systemPackages = [
7
+
pkgs.cifs-utils
8
+
];
9
+
10
+
systemd.network.networks.c-base = {
11
+
matchConfig.Name = "c-base";
12
+
networkConfig = {
13
+
IgnoreCarrierLoss = "3s";
14
+
KeepConfiguration = "static";
15
+
DNS = "10.0.1.254";
16
+
Domains = "cbrp3.c-base.org";
17
+
};
18
+
routes = [
19
+
{ routeConfig = {
20
+
Destination = "10.0.0.0/23";
21
+
Gateway = "172.31.77.1";
22
+
};}
23
+
{ routeConfig = {
24
+
Destination = "91.102.9.99/32"; # vorstand.c-base.org
25
+
Gateway = "172.31.77.1";
26
+
};}
27
+
];
28
+
};
29
+
services.openvpn.servers.c-base = {
30
+
config = ''
31
+
remote vpn.ext.c-base.org 1194
32
+
verify-x509-name vpn.ext.c-base.org name
33
+
client
34
+
proto udp
35
+
dev-type tun
36
+
dev c-base
37
+
resolv-retry infinite
38
+
nobind
39
+
# user openvpn
40
+
# group openvpn
41
+
persist-key
42
+
persist-tun
43
+
comp-lzo
44
+
# register-dns
45
+
# block-outside-dns
46
+
script-security 2
47
+
auth-user-pass ${config.krebs.secret.directory}/cbase.txt>}
48
+
#auth-user-pass
49
+
key-direction 1
50
+
<tls-auth>
51
+
#
52
+
# 2048 bit OpenVPN static key
53
+
#
54
+
-----BEGIN OpenVPN Static key V1-----
55
+
54a66ed1048bed7508703347e89d68d6
56
+
5586e6a5d1218cf8675941031d540be6
57
+
993e07200a16ad3b770b659932ee71e5
58
+
f8080b5c9fa2acb3893abd40fad2552c
59
+
fdaf17565e617ae450efcccf5652dca5
60
+
a16419509024b075941098731eb25ac0
61
+
a64f963ece3dca1d2a64a9c5e17839d7
62
+
5b5080165a9b2dc90ef111879d7d3173
63
+
2d1027ae42d869394aca08da4472a9d0
64
+
6b724b4ed43a957feef7d6dfc86da241
65
+
74828fa0e1240941586f0d937cac32fc
66
+
13cc81e7bed58817353d6afaff7e6a26
67
+
4f9cc086af79c1cdca660d86e18cff96
68
+
69dd3d392caf09a468894a8504f4cc7c
69
+
7ae0072e6d9ad90b166ad13a39c57b3c
70
+
3a869e27a1d89deb161c255227551713
71
+
-----END OpenVPN Static key V1-----
72
+
</tls-auth>
73
+
<ca>
74
+
-----BEGIN CERTIFICATE-----
75
+
MIIGsDCCBJigAwIBAgIJAPkM1l2zA306MA0GCSqGSIb3DQEBCwUAMIGWMQswCQYD
76
+
VQQGEwJERTEPMA0GA1UEBxMGQmVybGluMRswGQYDVQQLExJ2cG4uZXh0LmMtYmFz
77
+
ZS5vcmcxGzAZBgNVBAMTEnZwbi5leHQuYy1iYXNlLm9yZzEbMBkGA1UEKRMSdnBu
78
+
LmV4dC5jLWJhc2Uub3JnMR8wHQYJKoZIhvcNAQkBFhBhZG1heEBjLWJhc2Uub3Jn
79
+
MB4XDTE2MDcwOTE4MjkyMFoXDTI2MDcxMDE4MjkyMFowgZYxCzAJBgNVBAYTAkRF
80
+
MQ8wDQYDVQQHEwZCZXJsaW4xGzAZBgNVBAsTEnZwbi5leHQuYy1iYXNlLm9yZzEb
81
+
MBkGA1UEAxMSdnBuLmV4dC5jLWJhc2Uub3JnMRswGQYDVQQpExJ2cG4uZXh0LmMt
82
+
YmFzZS5vcmcxHzAdBgkqhkiG9w0BCQEWEGFkbWF4QGMtYmFzZS5vcmcwggIiMA0G
83
+
CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXEs+uWCXLNmm+lgP9x7u3FqWa4pPI
84
+
h64c6EWIULMATrhEw+Ej4fpCXwU9otFaO04fAeJmZGkDcnAYdBDiCeI0luOSdj44
85
+
Bg9KecSei/TskqjhDVnEBp65hiz0rZE6c1baPdLYmD5xrXWb3i0zrlBYFawuL6C2
86
+
lwVCEm3cadvkDJ2DleMuu3NblV8ViIDN0HZqzJNP72g1I0MgohkpetACXlf7MzQV
87
+
PFHfzvb04Rj2lJ8BDhceQ0WmjtVV/Ag6nka5oi954OeHMujRuH+rZYiQZDZpJLHK
88
+
Kh1KWTVlWPRy+AvCi9lweDWSmLccq7Ug4xMtDF4I5qW3tjCd0xqpZ21Xmo2JyKtY
89
+
4h8wEDPqiJvgwvkXsH17GLn5ZxiMcQuRJQYZqJephkzR9uccJeWSS76kwm/vLqG3
90
+
+eORlYnyjiNXtiMIhmAEFjpWUrGH8v4CijpUNP6E63ynGrRVXK684YQXkqL+xPAt
91
+
t6dsMBUwf94a2S1o2kgvuRCim1wlHvf1QsHrO/Hwgpzc8no/daWL+Z9Rq9okTHNK
92
+
nc1G5dv8TkmxIDYnLm07QMzzBoOT36BcGtkEBA+0xhQlX5PyQdM5/jnZVhdSBmoP
93
+
MbZXPoU/gJAIuuBuwdTlgCzYf44/9/YU/AnW8eLrbhm9KtMtoMpatrWorKqk/GPv
94
+
/lGNRQuNffrbiQIDAQABo4H+MIH7MB0GA1UdDgQWBBTf5cYbK+KCF9u9aobFlLbu
95
+
ilwX4jCBywYDVR0jBIHDMIHAgBTf5cYbK+KCF9u9aobFlLbuilwX4qGBnKSBmTCB
96
+
ljELMAkGA1UEBhMCREUxDzANBgNVBAcTBkJlcmxpbjEbMBkGA1UECxMSdnBuLmV4
97
+
dC5jLWJhc2Uub3JnMRswGQYDVQQDExJ2cG4uZXh0LmMtYmFzZS5vcmcxGzAZBgNV
98
+
BCkTEnZwbi5leHQuYy1iYXNlLm9yZzEfMB0GCSqGSIb3DQEJARYQYWRtYXhAYy1i
99
+
YXNlLm9yZ4IJAPkM1l2zA306MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQAD
100
+
ggIBAMs1moiS7UZ4neOivQjqwKrBbm1j3tgmPLhDfNMmXYarGhnBGAlLxLAQWtG+
101
+
Fnbx8KcsJnrsWcGfZcst1z45S4a5oBdVNKOfgkMOG0glZorIDO8Odrb51rpyzU0v
102
+
0wcNumMNWhkFuo2OTBHPnnJIWEAFwwCCSCL0I0hQxxoaV36kphjuIwzrMJhd+XAT
103
+
24En58cNp6sPRDd+FzOH08uFINevyzKWYxkMgVj+e3fbuiyOB8RqvndKvtfBBcpB
104
+
cCO86lGnj/ETMDciTczUShxaMn9wV1zr1KH1xvT3ohUeOcQZGbGTcjG4mxlns8ZO
105
+
U5J3Yrcd1eMfJq9Bwd3zPsTLnT8LwIS8vfYRav9b34XdqcBG73dhrjsicMK0Qy0z
106
+
Qz7vKJzcvrEnKuaMyB3mCxz/UvbNc2Bupwm4FmzN5eFjDs+7paYFdfOzqMjoRP+8
107
+
bcXSqDN5P2eUd7cdsZXaFNcsf1FkWlE3GudVBOmNJqz9zBab/T5J+l4Z90Pd6OUX
108
+
GNozEvLhcJkvPKA526TegHTGC8hMquxKc9tpOzNRqZJMFa+UG1mgMrMepRmM/B3s
109
+
QrKI1C11iCVYfb9J0tQUkfENHMx4J7mG2DZAhnKWQDU2awM41qU4A7aBYaJvDPnQ
110
+
RRcbaT0D794lKUQwH/mZuyKzF22oZNk1o1TV2SaFXqgX5tDt
111
+
-----END CERTIFICATE-----
112
+
</ca>
113
+
'';
114
+
};
115
+
}
+19
nixos/2configs/ciko.nix
+19
nixos/2configs/ciko.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
users.users.ciko = {
4
+
uid = genid_uint31 "ciko";
5
+
description = "acc for ciko";
6
+
home = "/home/ciko";
7
+
useDefaultShell = true;
8
+
createHome = true;
9
+
openssh.authorizedKeys.keys = [
10
+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTUWm/fISw/gbuHvf3kwxGEuk1aY5HrNNvr8QXCQv0khDdaYmZSELbtFQtE04WGTWmackNcLpld5mETVyCM0BjOgqMJYQNhtywxfYcodEY5xxHCuGgA3S1t94MZub+DRodXCfB0yUV85Wbb0sltkMTJufMwYmLEGxSLRukxAOcNsXdjlyro96csmYrIiV6R7+REnz8OcR7sKlI4tvKA1mbvWmjbDBd1MZ8Jc0Lwf+b0H/rH69wEQIcB5HRHHJIChoAk0t2azSjXagk1+4AebONZTCKvTHxs/D2wUBIzoxyjmh5S0aso/cKw8qpKcl/A2mZiIvW3KMlJAM5U+RQKMrr"
11
+
];
12
+
isNormalUser = true;
13
+
};
14
+
15
+
system.activationScripts.user-shadow = ''
16
+
${pkgs.coreutils}/bin/chmod +x /home/ciko
17
+
'';
18
+
}
19
+
+69
nixos/2configs/codimd.nix
+69
nixos/2configs/codimd.nix
···
1
+
{ config, pkgs, lib, ... }:
2
+
let
3
+
domain = "pad.lassul.us";
4
+
in
5
+
{
6
+
7
+
# redirect legacy domain to new one
8
+
services.nginx.virtualHosts."codi.lassul.us" = {
9
+
enableACME = true;
10
+
addSSL = true;
11
+
locations."/".return = "301 https://${domain}\$request_uri";
12
+
};
13
+
14
+
services.nginx.virtualHosts.${domain} = {
15
+
enableACME = true;
16
+
forceSSL = true;
17
+
locations."/" = {
18
+
proxyPass = "https://localhost:3091";
19
+
proxyWebsockets = true;
20
+
};
21
+
};
22
+
23
+
security.acme.certs.${domain}.group = "hedgecert";
24
+
users.groups.hedgecert.members = [ "hedgedoc" "nginx" ];
25
+
26
+
security.dhparams = {
27
+
enable = true;
28
+
params.hedgedoc = { };
29
+
};
30
+
31
+
systemd.services.hedgedoc.environment = {
32
+
CMD_COOKIE_POLICY = "none";
33
+
CMD_CSP_ALLOW_FRAMING = "true";
34
+
};
35
+
36
+
services.borgbackup.jobs.hetzner.paths = [
37
+
"/var/backup"
38
+
"/var/lib/hedgedoc"
39
+
];
40
+
systemd.services.hedgedoc-backup = {
41
+
startAt = "daily";
42
+
serviceConfig = {
43
+
ExecStart = ''${pkgs.sqlite}/bin/sqlite3 /var/lib/hedgedoc/db.hedgedoc.sqlite ".backup /var/backup/hedgedoc/backup.sq3"'';
44
+
Type = "oneshot";
45
+
};
46
+
};
47
+
48
+
services.hedgedoc = {
49
+
enable = true;
50
+
configuration.allowOrigin = [ domain ];
51
+
settings = {
52
+
db = {
53
+
dialect = "sqlite";
54
+
storage = "/var/lib/hedgedoc/db.hedgedoc.sqlite";
55
+
};
56
+
useCDN = false;
57
+
port = 3091;
58
+
domain = domain;
59
+
allowFreeURL = true;
60
+
61
+
useSSL = true;
62
+
protocolUseSSL = true;
63
+
sslCAPath = [ "/etc/ssl/certs/ca-certificates.crt" ];
64
+
sslCertPath = "/var/lib/acme/${domain}/cert.pem";
65
+
sslKeyPath = "/var/lib/acme/${domain}/key.pem";
66
+
dhParamPath = config.security.dhparams.params.hedgedoc.path;
67
+
};
68
+
};
69
+
}
+40
nixos/2configs/consul.nix
+40
nixos/2configs/consul.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
services.consul = {
4
+
enable = true;
5
+
# dropPrivileges = false;
6
+
webUi = true;
7
+
# interface.bind = "retiolum";
8
+
extraConfig = {
9
+
bind_addr = config.krebs.build.host.nets.retiolum.ip4.addr;
10
+
bootstrap_expect = 3;
11
+
server = true;
12
+
# retry_join = config.services.consul.extraConfig.start_join;
13
+
retry_join = lib.mapAttrsToList (n: h:
14
+
lib.head h.nets.retiolum.aliases
15
+
) (lib.filterAttrs (n: h: h.consul) config.krebs.hosts);
16
+
rejoin_after_leave = true;
17
+
18
+
# try to fix random lock loss on leader reelection
19
+
retry_interval = "3s";
20
+
};
21
+
};
22
+
23
+
environment.etc."consul.d/testservice.json".text = builtins.toJSON {
24
+
service = {
25
+
name = "testing";
26
+
};
27
+
};
28
+
29
+
krebs.iptables.tables.filter.INPUT.rules = [
30
+
{ predicate = "-i retiolum -p tcp --dport 8300"; target = "ACCEPT"; }
31
+
{ predicate = "-i retiolum -p tcp --dport 8301"; target = "ACCEPT"; }
32
+
{ predicate = "-i retiolum -p udp --dport 8301"; target = "ACCEPT"; }
33
+
{ predicate = "-i retiolum -p tcp --dport 8302"; target = "ACCEPT"; }
34
+
{ predicate = "-i retiolum -p udp --dport 8302"; target = "ACCEPT"; }
35
+
{ predicate = "-i retiolum -p tcp --dport 8400"; target = "ACCEPT"; }
36
+
{ predicate = "-i retiolum -p tcp --dport 8500"; target = "ACCEPT"; }
37
+
{ predicate = "-i retiolum -p tcp --dport 8600"; target = "ACCEPT"; }
38
+
{ predicate = "-i retiolum -p udp --dport 8500"; target = "ACCEPT"; }
39
+
];
40
+
}
+30
nixos/2configs/container-networking.nix
+30
nixos/2configs/container-networking.nix
···
1
+
{ lib, ... }:
2
+
3
+
{
4
+
krebs.iptables.tables.filter.FORWARD.rules = [
5
+
# { v6 = false; predicate = "-d 10.233.2.0/24 -o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
6
+
# { v6 = false; predicate = "-s 10.233.2.0/24 -i ve-+"; target = "ACCEPT"; }
7
+
{ v6 = false; predicate = "-o ctr+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
8
+
{ v6 = false; predicate = "-i ctr+"; target = "ACCEPT"; }
9
+
{ v6 = false; predicate = "-o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
10
+
{ v6 = false; predicate = "-i ve-+"; target = "ACCEPT"; }
11
+
# { v6 = false; predicate = "-i ve-+ -o ve-+"; target = "ACCEPT"; }
12
+
# { v6 = false; predicate = "-o ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
13
+
# { v6 = false; predicate = "-i ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
14
+
];
15
+
krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
16
+
{ v6 = false; predicate = "-i ctr+"; target = "ACCEPT"; }
17
+
{ v6 = false; predicate = "-i ve-+"; target = "ACCEPT"; }
18
+
];
19
+
krebs.iptables.tables.nat.POSTROUTING.rules = [
20
+
# { v6 = false; predicate = "-o et0"; target = "MASQUERADE"; }
21
+
22
+
{ v6 = false; predicate = "-s 10.233.0.0/16 ! -d 10.233.0.0/16"; target = "MASQUERADE"; }
23
+
# { v6 = false; predicate = "-s 10.233.2.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
24
+
# { v6 = false; predicate = "-s 10.233.2.0/24 -d 255.255.255.255"; target = "RETURN"; }
25
+
# { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24"; target = "MASQUERADE"; }
26
+
# { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
27
+
# { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
28
+
];
29
+
boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
30
+
}
+36
nixos/2configs/copyq.nix
+36
nixos/2configs/copyq.nix
···
1
+
{ config, pkgs, ... }:
2
+
let
3
+
copyqConfig = pkgs.writeDash "copyq-config" ''
4
+
${pkgs.copyq}/bin/copyq config check_clipboard true
5
+
${pkgs.copyq}/bin/copyq config check_selection true
6
+
${pkgs.copyq}/bin/copyq config copy_clipboard true
7
+
${pkgs.copyq}/bin/copyq config copy_selection true
8
+
9
+
${pkgs.copyq}/bin/copyq config activate_closes true
10
+
${pkgs.copyq}/bin/copyq config clipboard_notification_lines 0
11
+
${pkgs.copyq}/bin/copyq config clipboard_tab \&clipboard
12
+
${pkgs.copyq}/bin/copyq config disable_tray true
13
+
${pkgs.copyq}/bin/copyq config hide_tabs true
14
+
${pkgs.copyq}/bin/copyq config hide_toolbar true
15
+
${pkgs.copyq}/bin/copyq config item_popup_interval true
16
+
${pkgs.copyq}/bin/copyq config maxitems 1000
17
+
${pkgs.copyq}/bin/copyq config move true
18
+
${pkgs.copyq}/bin/copyq config text_wrap true
19
+
'';
20
+
in {
21
+
systemd.user.services.copyq = {
22
+
wantedBy = [ "graphical-session.target" ];
23
+
requires = [ "xmonad.service" ];
24
+
environment = {
25
+
DISPLAY = ":${toString config.services.xserver.display}";
26
+
};
27
+
serviceConfig = {
28
+
SyslogIdentifier = "copyq";
29
+
ExecStart = "${pkgs.copyq}/bin/copyq";
30
+
ExecStartPost = copyqConfig;
31
+
Restart = "always";
32
+
RestartSec = "15s";
33
+
StartLimitBurst = 0;
34
+
};
35
+
};
36
+
}
+68
nixos/2configs/cunicu.nix
+68
nixos/2configs/cunicu.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
environment.systemPackages = [
4
+
pkgs.cunicu
5
+
];
6
+
7
+
networking.firewall.allowedUDPPorts = [ 42230 ];
8
+
9
+
environment.etc."cunicu.yaml".text = builtins.toJSON {
10
+
# backends = [
11
+
# "grpc://signal.cunicu.li:443"
12
+
# ];
13
+
rpc.socket = "/var/run/cunicu.sock";
14
+
15
+
listen_port = 51820;
16
+
17
+
sync_routes = true;
18
+
sync_hosts = true;
19
+
20
+
domain = "c";
21
+
22
+
discover_peers = true;
23
+
discover_endpoints = true;
24
+
community = "aidsballs";
25
+
26
+
networks = [
27
+
"10.245.0.0/16"
28
+
];
29
+
30
+
ice = {
31
+
urls = [
32
+
"stun:stun3.l.google.com:19302"
33
+
"stun:relay.webwormhole.io"
34
+
"stun:stun.sipgate.net"
35
+
"stun:stun.ekiga.net"
36
+
"stun:stun.services.mozilla.com"
37
+
];
38
+
interface_filter = "w*|e*|v*|i*";
39
+
};
40
+
41
+
interfaces.wiregrill = {};
42
+
43
+
peers = lib.mapAttrs
44
+
(_: host: {
45
+
public_key = host.nets.wiregrill.wireguard.pubkey;
46
+
allowed_ips = with host.nets.wiregrill; [
47
+
"${ip6.addr}/128"
48
+
] ++ (lib.optional (ip4 != null) "${ip4.addr}/32");
49
+
} // lib.optionalAttrs (host.nets.wiregrill.via != null) {
50
+
endpoint = host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}";
51
+
})
52
+
(lib.filterAttrs (_: host: lib.hasAttr "wiregrill" host.nets) config.krebs.hosts);
53
+
};
54
+
55
+
systemd.services.cunicu = {
56
+
wantedBy = [ "multi-user.target" ];
57
+
restartTriggers = [ config.environment.etc."cunicu.yaml".source ];
58
+
environment = {
59
+
CUNICU_CONFIG_ALLOW_INSECURE = "true";
60
+
CUNICU_EXPERIMENTAL = "true";
61
+
};
62
+
serviceConfig = {
63
+
ExecStart = pkgs.writers.writeDash "cunicu" ''
64
+
${pkgs.cunicu}/bin/cunicu daemon
65
+
'';
66
+
};
67
+
};
68
+
}
+257
nixos/2configs/default.nix
+257
nixos/2configs/default.nix
···
1
+
{ self, config, lib, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
./binary-cache/client.nix
5
+
./gc.nix
6
+
./mc.nix
7
+
./vim.nix
8
+
./zsh.nix
9
+
./htop.nix
10
+
./wiregrill.nix
11
+
./tmux.nix
12
+
./tor-ssh.nix
13
+
./networkd.nix
14
+
self.inputs.stockholm.nixosModules.users
15
+
self.inputs.stockholm.nixosModules.hosts
16
+
self.inputs.stockholm.nixosModules.kartei
17
+
self.inputs.stockholm.nixosModules.build
18
+
self.inputs.stockholm.nixosModules.dns
19
+
self.inputs.stockholm.nixosModules.exim
20
+
self.inputs.stockholm.nixosModules.exim-retiolum
21
+
self.inputs.stockholm.nixosModules.tinc
22
+
self.inputs.stockholm.nixosModules.fetchWallpaper
23
+
self.inputs.stockholm.nixosModules.iptables
24
+
self.inputs.stockholm.nixosModules.power-action
25
+
self.inputs.stockholm.nixosModules.setuid
26
+
self.inputs.stockholm.nixosModules.secret
27
+
self.inputs.stockholm.nixosModules.sitemap
28
+
self.inputs.stockholm.nixosModules.ssl
29
+
self.inputs.stockholm.nixosModules.systemd
30
+
self.inputs.stockholm.nixosModules.xresources
31
+
{
32
+
users.extraUsers.mainUser.passwordFile = "${config.krebs.secret.directory}/passwordFile";
33
+
users.extraUsers.root.passwordFile = "${config.krebs.secret.directory}/passwordFile";
34
+
}
35
+
{
36
+
users.extraUsers = {
37
+
root = {
38
+
openssh.authorizedKeys.keys = [
39
+
config.krebs.users.lass.pubkey
40
+
config.krebs.users.lass-blue.pubkey
41
+
config.krebs.users.lass-green.pubkey
42
+
];
43
+
};
44
+
mainUser = {
45
+
name = "lass";
46
+
uid = 1337;
47
+
home = "/home/lass";
48
+
group = "users";
49
+
createHome = true;
50
+
useDefaultShell = true;
51
+
isNormalUser = true;
52
+
extraGroups = [
53
+
"audio"
54
+
"video"
55
+
"fuse"
56
+
"wheel"
57
+
"tor"
58
+
];
59
+
openssh.authorizedKeys.keys = [
60
+
config.krebs.users.lass.pubkey
61
+
config.krebs.users.lass-blue.pubkey
62
+
config.krebs.users.lass-green.pubkey
63
+
];
64
+
};
65
+
};
66
+
}
67
+
(let ca-bundle = "/etc/ssl/certs/ca-bundle.crt"; in {
68
+
environment.variables = {
69
+
CURL_CA_BUNDLE = ca-bundle;
70
+
GIT_SSL_CAINFO = ca-bundle;
71
+
SSL_CERT_FILE = ca-bundle;
72
+
};
73
+
})
74
+
{
75
+
#for sshuttle
76
+
environment.systemPackages = [
77
+
pkgs.python3Packages.python
78
+
];
79
+
}
80
+
];
81
+
82
+
networking.hostName = config.krebs.build.host.name;
83
+
84
+
krebs = {
85
+
enable = true;
86
+
build.user = config.krebs.users.lass;
87
+
ssl.trustIntermediate = true;
88
+
secret.directory = "/var/src/secrets";
89
+
};
90
+
91
+
nix.useSandbox = true;
92
+
93
+
users.mutableUsers = false;
94
+
95
+
# multiple-definition-problem when defining environment.variables.EDITOR
96
+
environment.extraInit = ''
97
+
EDITOR=vim
98
+
'';
99
+
100
+
nixpkgs.config.allowUnfree = true;
101
+
102
+
environment.systemPackages = with pkgs; [
103
+
#stockholm
104
+
deploy
105
+
git
106
+
git-absorb
107
+
git-preview
108
+
gnumake
109
+
jq
110
+
nix-output-monitor
111
+
112
+
#style
113
+
rxvt-unicode-unwrapped.terminfo
114
+
alacritty.terminfo
115
+
116
+
#monitoring tools
117
+
htop
118
+
iotop
119
+
120
+
#network
121
+
iptables
122
+
iftop
123
+
tcpdump
124
+
mosh
125
+
eternal-terminal
126
+
sshify
127
+
128
+
#stuff for dl
129
+
aria2
130
+
131
+
#neat utils
132
+
file
133
+
hashPassword
134
+
kpaste
135
+
cyberlocker-tools
136
+
pciutils
137
+
pop
138
+
q
139
+
rs
140
+
untilport
141
+
(pkgs.writeDashBin "urgent" ''
142
+
printf '\a'
143
+
'')
144
+
usbutils
145
+
logify
146
+
goify
147
+
148
+
#unpack stuff
149
+
libarchive
150
+
151
+
(pkgs.writeDashBin "sshn" ''
152
+
${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
153
+
'')
154
+
];
155
+
156
+
environment.shellAliases = {
157
+
ll = "ls -l";
158
+
la = "ls -la";
159
+
ls = "ls --color";
160
+
ip = "ip -color=auto";
161
+
grep = "grep --color=auto";
162
+
};
163
+
164
+
programs.bash = {
165
+
enableCompletion = true;
166
+
interactiveShellInit = ''
167
+
HISTCONTROL='erasedups:ignorespace'
168
+
HISTSIZE=65536
169
+
HISTFILESIZE=$HISTSIZE
170
+
171
+
shopt -s checkhash
172
+
shopt -s histappend histreedit histverify
173
+
shopt -s no_empty_cmd_completion
174
+
complete -d cd
175
+
LS_COLORS=$LS_COLORS:'di=1;31:' ; export LS_COLORS
176
+
'';
177
+
promptInit = ''
178
+
if test $UID = 0; then
179
+
PS1='\[\033[1;31m\]\w\[\033[0m\] '
180
+
PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
181
+
elif test $UID = 1337; then
182
+
PS1='\[\033[1;32m\]\w\[\033[0m\] '
183
+
PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
184
+
else
185
+
PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
186
+
PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
187
+
fi
188
+
if test -n "$SSH_CLIENT"; then
189
+
PS1='\[\033[35m\]\h'" $PS1"
190
+
PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
191
+
fi
192
+
'';
193
+
};
194
+
195
+
services.openssh.enable = true;
196
+
197
+
services.journald.extraConfig = ''
198
+
SystemMaxUse=1G
199
+
RuntimeMaxUse=128M
200
+
Storage=persistent
201
+
'';
202
+
203
+
krebs.iptables = {
204
+
enable = true;
205
+
tables = {
206
+
nat.PREROUTING.rules = [
207
+
{ predicate = "-i retiolum -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
208
+
{ predicate = "-i wiregrill -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
209
+
{ predicate = "-p tcp -m tcp --dport 22"; target = "REDIRECT --to-ports 0"; }
210
+
{ predicate = "-p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
211
+
];
212
+
nat.OUTPUT.rules = [
213
+
{ predicate = "-o lo -p tcp -m tcp --dport 45621"; target = "REDIRECT --to-ports 22"; }
214
+
];
215
+
filter.INPUT.policy = "DROP";
216
+
filter.FORWARD.policy = "DROP";
217
+
filter.INPUT.rules = lib.mkMerge [
218
+
(lib.mkBefore [
219
+
{ predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
220
+
{ predicate = "-p icmp"; target = "ACCEPT"; }
221
+
{ predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
222
+
{ predicate = "-i lo"; target = "ACCEPT"; }
223
+
{ predicate = "-p tcp --dport 22"; target = "ACCEPT"; }
224
+
])
225
+
(lib.mkOrder 1000 [
226
+
{ predicate = "-i retiolum -p udp --dport 60000:61000"; target = "ACCEPT"; }
227
+
{ predicate = "-i retiolum -p udp -m udp --dport 53"; target = "ACCEPT"; }
228
+
{ predicate = "-i retiolum -p tcp --dport 19999"; target = "ACCEPT"; }
229
+
])
230
+
(lib.mkAfter [
231
+
{ predicate = "-p tcp -i retiolum"; target = "REJECT --reject-with tcp-reset"; }
232
+
{ predicate = "-p udp -i retiolum"; target = "REJECT --reject-with icmp-port-unreachable"; v6 = false; }
233
+
{ predicate = "-i retiolum"; target = "REJECT --reject-with icmp-proto-unreachable"; v6 = false; }
234
+
])
235
+
];
236
+
};
237
+
};
238
+
239
+
networking.dhcpcd.extraConfig = ''
240
+
noipv4ll
241
+
'';
242
+
243
+
networking.extraHosts = ''
244
+
10.42.0.1 styx.gg23
245
+
'';
246
+
247
+
nix.extraOptions = ''
248
+
experimental-features = nix-command flakes
249
+
'';
250
+
251
+
# use 24:00 time format, the default got sneakily changed around 20.03
252
+
i18n.defaultLocale = lib.mkDefault "C.UTF-8";
253
+
time.timeZone = lib.mkDefault"Europe/Berlin";
254
+
255
+
# disable doc usually
256
+
documentation.nixos.enable = lib.mkDefault false;
257
+
}
+41
nixos/2configs/doc.nix
+41
nixos/2configs/doc.nix
···
1
+
let
2
+
pkgs = import <nixpkgs> {};
3
+
4
+
mkNixosManual = let
5
+
inherit pkgs;
6
+
inherit (pkgs) lib;
7
+
# Reduces the attrs from a package set so broken packages evaluate (I think?)
8
+
scrubDerivations = namePrefix: pkgSet: lib.mapAttrs
9
+
(name: value:
10
+
let wholeName = "${namePrefix}.${name}"; in
11
+
if lib.isAttrs value then
12
+
scrubDerivations wholeName value
13
+
// (lib.optionalAttrs (lib.isDerivation value) { outPath = "\${${wholeName}}"; })
14
+
else value
15
+
)
16
+
pkgSet;
17
+
# An evluation of the specified system version with only the modules and no config
18
+
scrubbedEval = lib.evalModules {
19
+
modules = [
20
+
{
21
+
#imports = [ ./default.nix ];
22
+
}
23
+
] ++ (import (pkgs.path + /nixos/modules/module-list.nix));
24
+
# Forward the filtered package set and the modules path
25
+
specialArgs = {
26
+
pkgs = scrubDerivations "pkgs" pkgs;
27
+
modulesPath = pkgs.path + /nixos/modules;
28
+
};
29
+
};
30
+
in (import (pkgs.path + /nixos/doc/manual)) rec {
31
+
# From parent scope
32
+
inherit (scrubbedEval) config;
33
+
# From let
34
+
inherit pkgs;
35
+
version = scrubbedEval.config.system.nixos.release;
36
+
revision = "release-${version}";
37
+
38
+
extraSources = [ ../. ];
39
+
options = scrubbedEval.options;
40
+
};
41
+
in mkNixosManual
+6
nixos/2configs/docker.nix
+6
nixos/2configs/docker.nix
+276
nixos/2configs/dunst.nix
+276
nixos/2configs/dunst.nix
···
1
+
{ config, pkgs, ... }:
2
+
let
3
+
dunstConfig = pkgs.writeText "dunst-config" ''
4
+
[global]
5
+
font = Iosevka Term 11
6
+
7
+
# Allow a small subset of html markup:
8
+
# <b>bold</b>
9
+
# <i>italic</i>
10
+
# <s>strikethrough</s>
11
+
# <u>underline</u>
12
+
#
13
+
# For a complete reference see
14
+
# <http://developer.gnome.org/pango/stable/PangoMarkupFormat.html>.
15
+
# If markup is not allowed, those tags will be stripped out of the
16
+
# message.
17
+
markup = yes
18
+
plain_text = no
19
+
20
+
# The format of the message. Possible variables are:
21
+
# %a appname
22
+
# %s summary
23
+
# %b body
24
+
# %i iconname (including its path)
25
+
# %I iconname (without its path)
26
+
# %p progress value if set ([ 0%] to [100%]) or nothing
27
+
# Markup is allowed
28
+
format = "%a\n<b>%s</b>\n%b"
29
+
30
+
# Sort messages by urgency.
31
+
sort = yes
32
+
33
+
# Show how many messages are currently hidden (because of geometry).
34
+
indicate_hidden = yes
35
+
36
+
# Alignment of message text.
37
+
# Possible values are "left", "center" and "right".
38
+
alignment = center
39
+
40
+
# The frequency with wich text that is longer than the notification
41
+
# window allows bounces back and forth.
42
+
# This option conflicts with "word_wrap".
43
+
# Set to 0 to disable.
44
+
bounce_freq = 0
45
+
46
+
# Show age of message if message is older than show_age_threshold
47
+
# seconds.
48
+
# Set to -1 to disable.
49
+
show_age_threshold = 1
50
+
51
+
# Split notifications into multiple lines if they don't fit into
52
+
# geometry.
53
+
word_wrap = yes
54
+
55
+
# Ignore newlines '\n' in notifications.
56
+
ignore_newline = no
57
+
58
+
# Hide duplicate's count and stack them
59
+
stack_duplicates = yes
60
+
hide_duplicates_count = no
61
+
62
+
63
+
# The geometry of the window:
64
+
# [{width}]x{height}[+/-{x}+/-{y}]
65
+
# The geometry of the message window.
66
+
# The height is measured in number of notifications everything else
67
+
# in pixels. If the width is omitted but the height is given
68
+
# ("-geometry x2"), the message window expands over the whole screen
69
+
# (dmenu-like). If width is 0, the window expands to the longest
70
+
# message displayed. A positive x is measured from the left, a
71
+
# negative from the right side of the screen. Y is measured from
72
+
# the top and down respectevly.
73
+
# The width can be negative. In this case the actual width is the
74
+
# screen width minus the width defined in within the geometry option.
75
+
geometry = "500x10-0+0"
76
+
77
+
# Shrink window if it's smaller than the width. Will be ignored if
78
+
# width is 0.
79
+
shrink = no
80
+
81
+
# The transparency of the window. Range: [0; 100].
82
+
# This option will only work if a compositing windowmanager is
83
+
# present (e.g. xcompmgr, compiz, etc.).
84
+
# transparency = 5
85
+
86
+
# Don't remove messages, if the user is idle (no mouse or keyboard input)
87
+
# for longer than idle_threshold seconds.
88
+
# Set to 0 to disable.
89
+
idle_threshold = 0
90
+
91
+
# Which monitor should the notifications be displayed on.
92
+
monitor = keyboard
93
+
94
+
# Display notification on focused monitor. Possible modes are:
95
+
# mouse: follow mouse pointer
96
+
# keyboard: follow window with keyboard focus
97
+
# none: don't follow anything
98
+
#
99
+
# "keyboard" needs a windowmanager that exports the
100
+
# _NET_ACTIVE_WINDOW property.
101
+
# This should be the case for almost all modern windowmanagers.
102
+
#
103
+
# If this option is set to mouse or keyboard, the monitor option
104
+
# will be ignored.
105
+
follow = none
106
+
107
+
# Should a notification popped up from history be sticky or timeout
108
+
# as if it would normally do.
109
+
sticky_history = yes
110
+
111
+
# Maximum amount of notifications kept in history
112
+
history_length = 15
113
+
114
+
# Display indicators for URLs (U) and actions (A).
115
+
show_indicators = no
116
+
117
+
# The height of a single line. If the height is smaller than the
118
+
# font height, it will get raised to the font height.
119
+
# This adds empty space above and under the text.
120
+
line_height = 3
121
+
122
+
# Draw a line of "separatpr_height" pixel height between two
123
+
# notifications.
124
+
# Set to 0 to disable.
125
+
separator_height = 1
126
+
127
+
# Padding between text and separator.
128
+
padding = 1
129
+
130
+
# Horizontal padding.
131
+
horizontal_padding = 1
132
+
133
+
# Define a color for the separator.
134
+
# possible values are:
135
+
# * auto: dunst tries to find a color fitting to the background;
136
+
# * foreground: use the same color as the foreground;
137
+
# * frame: use the same color as the frame;
138
+
# * anything else will be interpreted as a X color.
139
+
separator_color = frame
140
+
141
+
# Print a notification on startup.
142
+
# This is mainly for error detection, since dbus (re-)starts dunst
143
+
# automatically after a crash.
144
+
startup_notification = true
145
+
146
+
# dmenu path.
147
+
dmenu = ${pkgs.dmenu}/bin/dmenu -p dunst:
148
+
149
+
# Browser for opening urls in context menu.
150
+
browser = /usr/bin/firefox -new-tab
151
+
152
+
# Align icons left/right/off
153
+
icon_position = off
154
+
max_icon_size = 80
155
+
156
+
# Paths to default icons.
157
+
icon_folders = /usr/share/icons/Paper/16x16/mimetypes/:/usr/share/icons/Paper/48x48/status/:/usr/share/icons/Paper/16x16/devices/:/usr/share/icons/Paper/48x48/notifications/:/usr/share/icons/Paper/48x48/emblems/
158
+
159
+
frame_width = 2
160
+
frame_color = "#8EC07C"
161
+
162
+
[shortcuts]
163
+
164
+
# Shortcuts are specified as [modifier+][modifier+]...key
165
+
# Available modifiers are "ctrl", "mod1" (the alt-key), "mod2",
166
+
# "mod3" and "mod4" (windows-key).
167
+
# Xev might be helpful to find names for keys.
168
+
169
+
# Close notification.
170
+
close = ctrl+space
171
+
172
+
# Close all notifications.
173
+
close_all = ctrl+shift+space
174
+
175
+
# Redisplay last message(s).
176
+
# On the US keyboard layout "grave" is normally above TAB and left
177
+
# of "1".
178
+
history = ctrl+grave
179
+
180
+
# Context menu.
181
+
context = mod4+u
182
+
183
+
[urgency_low]
184
+
# IMPORTANT: colors have to be defined in quotation marks.
185
+
# Otherwise the "#" and following would be interpreted as a comment.
186
+
frame_color = "#3B7C87"
187
+
foreground = "#3B7C87"
188
+
background = "#191311"
189
+
#background = "#2B313C"
190
+
timeout = 1
191
+
192
+
[urgency_normal]
193
+
frame_color = "#5B8234"
194
+
foreground = "#5B8234"
195
+
background = "#191311"
196
+
#background = "#2B313C"
197
+
timeout = 1
198
+
199
+
[urgency_critical]
200
+
frame_color = "#B7472A"
201
+
foreground = "#B7472A"
202
+
background = "#191311"
203
+
#background = "#2B313C"
204
+
timeout = 1
205
+
206
+
207
+
# Every section that isn't one of the above is interpreted as a rules to
208
+
# override settings for certain messages.
209
+
# Messages can be matched by "appname", "summary", "body", "icon", "category",
210
+
# "msg_urgency" and you can override the "timeout", "urgency", "foreground",
211
+
# "background", "new_icon" and "format".
212
+
# Shell-like globbing will get expanded.
213
+
#
214
+
# SCRIPTING
215
+
# You can specify a script that gets run when the rule matches by
216
+
# setting the "script" option.
217
+
# The script will be called as follows:
218
+
# script appname summary body icon urgency
219
+
# where urgency can be "LOW", "NORMAL" or "CRITICAL".
220
+
#
221
+
# NOTE: if you don't want a notification to be displayed, set the format
222
+
# to "".
223
+
# NOTE: It might be helpful to run dunst -print in a terminal in order
224
+
# to find fitting options for rules.
225
+
226
+
#[espeak]
227
+
# summary = "*"
228
+
# script = dunst_espeak.sh
229
+
230
+
#[script-test]
231
+
# summary = "*script*"
232
+
# script = dunst_test.sh
233
+
234
+
#[ignore]
235
+
# # This notification will not be displayed
236
+
# summary = "foobar"
237
+
# format = ""
238
+
239
+
#[signed_on]
240
+
# appname = Pidgin
241
+
# summary = "*signed on*"
242
+
# urgency = low
243
+
#
244
+
#[signed_off]
245
+
# appname = Pidgin
246
+
# summary = *signed off*
247
+
# urgency = low
248
+
#
249
+
#[says]
250
+
# appname = Pidgin
251
+
# summary = *says*
252
+
# urgency = critical
253
+
#
254
+
#[twitter]
255
+
# appname = Pidgin
256
+
# summary = *twitter.com*
257
+
# urgency = normal
258
+
#
259
+
# vim: ft=cfg
260
+
'';
261
+
in {
262
+
systemd.user.services.dunst = {
263
+
wantedBy = [ "graphical-session.target" ];
264
+
requires = [ "xmonad.service" ];
265
+
environment = {
266
+
DISPLAY = ":${toString config.services.xserver.display}";
267
+
};
268
+
serviceConfig = {
269
+
SyslogIdentifier = "dunst";
270
+
ExecStart = "${pkgs.dunst}/bin/dunst -conf ${dunstConfig}";
271
+
Restart = "always";
272
+
RestartSec = "15s";
273
+
StartLimitBurst = 0;
274
+
};
275
+
};
276
+
}
+24
nixos/2configs/elster.nix
+24
nixos/2configs/elster.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
let
4
+
mainUser = config.users.extraUsers.mainUser;
5
+
6
+
in {
7
+
users.extraUsers = {
8
+
elster = {
9
+
name = "elster";
10
+
description = "user for running elster-online";
11
+
home = "/home/elster";
12
+
useDefaultShell = true;
13
+
extraGroups = [];
14
+
createHome = true;
15
+
isNormalUser = true;
16
+
};
17
+
};
18
+
krebs.per-user.elster.packages = [
19
+
pkgs.chromium
20
+
];
21
+
security.sudo.extraConfig = ''
22
+
${mainUser.name} ALL=(elster) NOPASSWD: ALL
23
+
'';
24
+
}
+7
nixos/2configs/et-server.nix
+7
nixos/2configs/et-server.nix
+12
nixos/2configs/exim-retiolum.nix
+12
nixos/2configs/exim-retiolum.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
krebs.exim-retiolum = {
4
+
enable = true;
5
+
system-aliases = [
6
+
{ from = "root"; to = "lass"; }
7
+
];
8
+
};
9
+
krebs.iptables.tables.filter.INPUT.rules = [
10
+
{ predicate = "-i retiolum -p tcp --dport smtp"; target = "ACCEPT"; }
11
+
];
12
+
}
+62
nixos/2configs/exim-smarthost.nix
+62
nixos/2configs/exim-smarthost.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
3
+
to = concatStringsSep "," [
4
+
"lass@green.r"
5
+
];
6
+
7
+
mails = import <secrets/mails.nix>;
8
+
9
+
in {
10
+
environment.systemPackages = [ pkgs.review-mail-queue ];
11
+
12
+
krebs.exim-smarthost = {
13
+
enable = true;
14
+
dkim = [
15
+
{ domain = "lassul.us"; }
16
+
];
17
+
ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
18
+
ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
19
+
primary_hostname = "lassul.us";
20
+
sender_domains = [
21
+
"lassul.us"
22
+
];
23
+
relay_from_hosts = map (host: host.nets.retiolum.ip6.addr) [
24
+
config.krebs.hosts.aergia
25
+
config.krebs.hosts.blue
26
+
config.krebs.hosts.coaxmetal
27
+
config.krebs.hosts.green
28
+
config.krebs.hosts.mors
29
+
config.krebs.hosts.xerxes
30
+
];
31
+
internet-aliases = map (from: { inherit from to; }) mails ++ [
32
+
];
33
+
system-aliases = [
34
+
{ from = "mailer-daemon"; to = "postmaster"; }
35
+
{ from = "postmaster"; to = "root"; }
36
+
{ from = "nobody"; to = "root"; }
37
+
{ from = "hostmaster"; to = "root"; }
38
+
{ from = "usenet"; to = "root"; }
39
+
{ from = "news"; to = "root"; }
40
+
{ from = "webmaster"; to = "root"; }
41
+
{ from = "www"; to = "root"; }
42
+
{ from = "ftp"; to = "root"; }
43
+
{ from = "abuse"; to = "root"; }
44
+
{ from = "noc"; to = "root"; }
45
+
{ from = "security"; to = "root"; }
46
+
{ from = "root"; to = "lass"; }
47
+
];
48
+
};
49
+
krebs.iptables.tables.filter.INPUT.rules = [
50
+
{ predicate = "-p tcp --dport smtp"; target = "ACCEPT"; }
51
+
];
52
+
53
+
security.acme.certs."mail.lassul.us" = {
54
+
group = "lasscert";
55
+
webroot = "/var/lib/acme/acme-challenge";
56
+
};
57
+
users.groups.lasscert.members = [
58
+
"dovecot2"
59
+
"exim"
60
+
"nginx"
61
+
];
62
+
}
+11
nixos/2configs/fetchWallpaper.nix
+11
nixos/2configs/fetchWallpaper.nix
+58
nixos/2configs/firefoxPatched.nix
+58
nixos/2configs/firefoxPatched.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
let
4
+
lpkgs = import ../5pkgs { inherit pkgs; };
5
+
6
+
inherit (lib)
7
+
concatMapStrings
8
+
;
9
+
10
+
plugins = with lpkgs.firefoxPlugins; [
11
+
noscript
12
+
ublock
13
+
vimperator
14
+
];
15
+
16
+
copyXpi = plugin:
17
+
"cp ${plugin}/*.xpi $out/usr/lib/firefox-*/browser/extensions/";
18
+
19
+
preferences = pkgs.writeText "autoload.js" ''
20
+
pref('general.config.filename', 'firefox.cfg');
21
+
pref('general.config.obscure_value', 0);
22
+
'';
23
+
24
+
config = pkgs.writeText "firefox.cfg" ''
25
+
//
26
+
lockPref("app.update.enabled", false);
27
+
lockPref("extensions.update.enabled", false);
28
+
lockPref("autoadmin.global_config_url", "");
29
+
lockPref("extensions.checkUpdateSecurity", false);
30
+
lockPref("services.sync.enabled", false);
31
+
lockPref("browser.shell.checkDefaultBrowser", false);
32
+
lockPref("layout.spellcheckDefault", 0);
33
+
lockPref("app.update.auto", false);
34
+
lockPref("browser.newtabpage.enabled", false);
35
+
lockPref("noscript.firstRunRedirection", false);
36
+
lockPref("noscript.hoverUI", false);
37
+
lockPref("noscript.notify", false);
38
+
defaultPref("extensions.newAddons", false);
39
+
defaultPref("extensions.autoDisableScopes", 0);
40
+
defaultPref("plugin.scan.plid.all", false);
41
+
'';
42
+
43
+
in {
44
+
environment.systemPackages = [
45
+
(pkgs.lib.overrideDerivation pkgs.firefox-bin (original : {
46
+
installPhase = ''
47
+
${original.installPhase}
48
+
find $out/usr/lib
49
+
${concatMapStrings copyXpi plugins}
50
+
cd $out/usr/lib/firefox-*/
51
+
mkdir -p browser/defaults/preferences
52
+
cp ${preferences} browser/defaults/preferences/autoload.js
53
+
cp ${config} ./firefox.cfg
54
+
'';
55
+
}))
56
+
];
57
+
}
58
+
+14
nixos/2configs/fonts.nix
+14
nixos/2configs/fonts.nix
+69
nixos/2configs/fysiirc.nix
+69
nixos/2configs/fysiirc.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
3
+
format-github-message = pkgs.writeDashBin "format-github-message" ''
4
+
set -efu
5
+
export PATH=${lib.makeBinPath [
6
+
pkgs.jq
7
+
]}
8
+
INPUT=$(jq -c .)
9
+
if $(printf '%s' "$INPUT" | jq 'has("issue") or has("pull_request")'); then
10
+
${write_to_irc} "$(printf '%s' "$INPUT" | jq -r '
11
+
"\(.action): " +
12
+
"[\(.issue.title // .pull_request.title)] " +
13
+
"\(.comment.html_url // .issue.html_url // .pull_request.html_url) "
14
+
')"
15
+
fi
16
+
'';
17
+
18
+
write_to_irc = pkgs.writeDash "write_to_irc" ''
19
+
${pkgs.curl}/bin/curl -fsSv http://localhost:44001 \
20
+
-H content-type:application/json \
21
+
-d "$(${pkgs.jq}/bin/jq -n \
22
+
--arg text "$1" '{
23
+
command:"PRIVMSG",
24
+
params:["#fysi",$text]
25
+
}'
26
+
)"
27
+
'';
28
+
29
+
in {
30
+
krebs.iptables.tables.filter.INPUT.rules = [
31
+
{ predicate = "-p tcp --dport 44002"; target = "ACCEPT"; }
32
+
];
33
+
krebs.reaktor2.fysiweb-github = {
34
+
hostname = "irc.libera.chat";
35
+
port = "6697";
36
+
useTLS = true;
37
+
nick = "fysiweb-github";
38
+
API.listen = "inet://127.0.0.1:44001";
39
+
plugins = [
40
+
{
41
+
plugin = "register";
42
+
config = {
43
+
channels = [
44
+
"#fysi"
45
+
];
46
+
};
47
+
}
48
+
];
49
+
};
50
+
krebs.htgen.fysiweb-github = {
51
+
port = 44002;
52
+
user = {
53
+
name = "reaktor2-fysiweb-github";
54
+
};
55
+
script = ''. ${pkgs.writeDash "github-irc" ''
56
+
set -xefu
57
+
case "$Method $Request_URI" in
58
+
"POST /")
59
+
payload=$(head -c "$req_content_length")
60
+
printf '%s' "$payload" | ${format-github-message}/bin/format-github-message
61
+
printf 'HTTP/1.1 200 OK\r\n'
62
+
printf 'Connection: close\r\n'
63
+
printf '\r\n'
64
+
exit
65
+
;;
66
+
esac
67
+
''}'';
68
+
};
69
+
}
+96
nixos/2configs/games.nix
+96
nixos/2configs/games.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
let
4
+
mainUser = config.users.extraUsers.mainUser;
5
+
vdoom = pkgs.writers.writeDash "vdoom" ''
6
+
${pkgs.zandronum}/bin/zandronum \
7
+
-fov 120 \
8
+
"$@"
9
+
'';
10
+
doom = pkgs.writers.writeDash "doom" ''
11
+
DOOM_DIR=''${DOOM_DIR:-~/doom/}
12
+
${vdoom} \
13
+
-file $DOOM_DIR/lib/brutalv21.pk3 \
14
+
"$@"
15
+
'';
16
+
doom1 = pkgs.writers.writeDashBin "doom1" ''
17
+
DOOM_DIR=''${DOOM_DIR:-~/doom/}
18
+
${doom} -iwad $DOOM_DIR/wads/stock/doom.wad "$@"
19
+
'';
20
+
doom2 = pkgs.writers.writeDashBin "doom2" ''
21
+
DOOM_DIR=''${DOOM_DIR:-~/doom/}
22
+
${doom} -iwad $DOOM_DIR/wads/stock/doom2.wad "$@"
23
+
'';
24
+
vdoom1 = pkgs.writers.writeDashBin "vdoom1" ''
25
+
DOOM_DIR=''${DOOM_DIR:-~/doom/}
26
+
${vdoom} -iwad $DOOM_DIR/wads/stock/doom.wad "$@"
27
+
'';
28
+
vdoom2 = pkgs.writers.writeDashBin "vdoom2" ''
29
+
DOOM_DIR=''${DOOM_DIR:-~/doom/}
30
+
${vdoom} -iwad $DOOM_DIR/wads/stock/doom2.wad "$@"
31
+
'';
32
+
33
+
doomservercfg = pkgs.writeText "doomserver.cfg" ''
34
+
skill 7
35
+
#survival true
36
+
#sv_maxlives 4
37
+
#sv_norespawn true
38
+
#sv_weapondrop true
39
+
no_jump true
40
+
#sv_noweaponspawn true
41
+
sv_sharekeys true
42
+
sv_survivalcountdowntime 1
43
+
sv_noteamselect true
44
+
sv_updatemaster false
45
+
#sv_coop_loseinventory true
46
+
#cl_startasspectator false
47
+
#lms_spectatorview false
48
+
'';
49
+
50
+
vdoomserver = pkgs.writers.writeDashBin "vdoomserver" ''
51
+
DOOM_DIR=''${DOOM_DIR:-~/doom/}
52
+
53
+
${pkgs.zandronum}/bin/zandronum-server \
54
+
+exec ${doomservercfg} \
55
+
"$@"
56
+
'';
57
+
58
+
in {
59
+
users.extraUsers = {
60
+
games = {
61
+
name = "games";
62
+
description = "user playing games";
63
+
home = "/home/games";
64
+
extraGroups = [ "audio" "video" "input" "loot" "pipewire" ];
65
+
createHome = true;
66
+
useDefaultShell = true;
67
+
packages = with pkgs; [
68
+
# minecraft
69
+
# ftb
70
+
# steam-run
71
+
# scummvm
72
+
# dolphinEmu
73
+
doom1
74
+
doom2
75
+
# protontricks
76
+
vdoom1
77
+
# vdoom2
78
+
# vdoomserver
79
+
retroarchBare
80
+
];
81
+
isNormalUser = true;
82
+
};
83
+
};
84
+
85
+
hardware.opengl.driSupport32Bit = true;
86
+
hardware.pulseaudio.support32Bit = true;
87
+
88
+
security.sudo.extraConfig = ''
89
+
${mainUser.name} ALL=(games) NOPASSWD: ALL
90
+
'';
91
+
92
+
krebs.iptables.tables.filter.INPUT.rules = [
93
+
{ predicate = "-p tcp --dport 10666"; target = "ACCEPT"; }
94
+
{ predicate = "-p udp --dport 10666"; target = "ACCEPT"; }
95
+
];
96
+
}
+7
nixos/2configs/gc.nix
+7
nixos/2configs/gc.nix
+91
nixos/2configs/gg23.nix
+91
nixos/2configs/gg23.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
# ipv6 from vodafone is really really flaky
4
+
boot.kernel.sysctl."net.ipv6.conf.et0.disable_ipv6" = 1;
5
+
systemd.network.networks."50-et0" = {
6
+
matchConfig.Name = "et0";
7
+
DHCP = "ipv4";
8
+
# dhcpV4Config.UseDNS = false;
9
+
# dhcpV6Config.UseDNS = false;
10
+
linkConfig = {
11
+
RequiredForOnline = "routable";
12
+
};
13
+
networkConfig = {
14
+
LinkLocalAddressing = "no";
15
+
};
16
+
# dhcpV6Config = {
17
+
# PrefixDelegationHint = "::/60";
18
+
# };
19
+
# networkConfig = {
20
+
# IPv6AcceptRA = true;
21
+
# };
22
+
# ipv6PrefixDelegationConfig = {
23
+
# Managed = true;
24
+
# };
25
+
};
26
+
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
27
+
systemd.network.networks."50-int0" = {
28
+
name = "int0";
29
+
address = [
30
+
"10.42.0.1/24"
31
+
];
32
+
networkConfig = {
33
+
# IPForward = "yes";
34
+
# IPMasquerade = "both";
35
+
ConfigureWithoutCarrier = true;
36
+
DHCPServer = "yes";
37
+
# IPv6SendRA = "yes";
38
+
# DHCPPrefixDelegation = "yes";
39
+
};
40
+
dhcpServerStaticLeases = [
41
+
{
42
+
dhcpServerStaticLeaseConfig = {
43
+
Address = "10.42.0.4";
44
+
MACAddress = "3c:2a:f4:22:28:37";
45
+
};
46
+
}
47
+
];
48
+
};
49
+
networking.networkmanager.unmanaged = [ "int0" ];
50
+
krebs.iptables.tables.filter.INPUT.rules = [
51
+
{ predicate = "-i int0"; target = "ACCEPT"; }
52
+
];
53
+
krebs.iptables.tables.filter.FORWARD.rules = [
54
+
{ predicate = "-i int0"; target = "ACCEPT"; }
55
+
{ predicate = "-o int0"; target = "ACCEPT"; }
56
+
{ predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
57
+
];
58
+
krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
59
+
{ v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; }
60
+
];
61
+
krebs.iptables.tables.nat.POSTROUTING.rules = [
62
+
{ v6 = false; predicate = "-s 10.42.0.0/24"; target = "MASQUERADE"; }
63
+
];
64
+
65
+
networking.domain = "gg23";
66
+
67
+
networking.useHostResolvConf = false;
68
+
services.resolved.extraConfig = ''
69
+
DNSStubListener=no
70
+
'';
71
+
services.dnsmasq = {
72
+
enable = true;
73
+
resolveLocalQueries = false;
74
+
75
+
extraConfig = ''
76
+
local=/gg23/
77
+
domain=gg23
78
+
expand-hosts
79
+
listen-address=10.42.0.1
80
+
interface=int0
81
+
'';
82
+
};
83
+
84
+
environment.systemPackages = [
85
+
(pkgs.writers.writeDashBin "restart_router" ''
86
+
${pkgs.mosquitto}/bin/mosquitto_pub -h localhost -t 'cmnd/router/POWER' -u gg23 -P gg23-mqtt -m OFF
87
+
sleep 2
88
+
${pkgs.mosquitto}/bin/mosquitto_pub -h localhost -t 'cmnd/router/POWER' -u gg23 -P gg23-mqtt -m ON
89
+
'')
90
+
];
91
+
}
+55
nixos/2configs/git-brain.nix
+55
nixos/2configs/git-brain.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
4
+
repos = krebs-repos;
5
+
rules = concatMap krebs-rules (attrValues krebs-repos);
6
+
7
+
krebs-repos = mapAttrs make-krebs-repo {
8
+
brain = { };
9
+
};
10
+
11
+
12
+
make-krebs-repo = with git; name: { cgit ? {}, ... }: {
13
+
inherit cgit name;
14
+
public = false;
15
+
hooks = {
16
+
post-receive = pkgs.git-hooks.irc-announce {
17
+
nick = config.networking.hostName;
18
+
verbose = true;
19
+
channel = "#xxx";
20
+
# TODO remove the hardcoded hostname
21
+
server = "irc.r";
22
+
};
23
+
};
24
+
};
25
+
26
+
27
+
28
+
# TODO: get the list of all krebsministers
29
+
krebsminister = with config.krebs.users; [ makefu tv kmein ];
30
+
krebs-rules = repo:
31
+
set-owners repo [ config.krebs.users.lass ] ++ set-ro-access repo krebsminister;
32
+
33
+
set-ro-access = with git; repo: user:
34
+
singleton {
35
+
inherit user;
36
+
repo = [ repo ];
37
+
perm = fetch;
38
+
};
39
+
40
+
set-owners = with git;repo: user:
41
+
singleton {
42
+
inherit user;
43
+
repo = [ repo ];
44
+
perm = push "refs/*" [ non-fast-forward create delete merge ];
45
+
};
46
+
47
+
in {
48
+
krebs.git = {
49
+
enable = true;
50
+
cgit = {
51
+
enable = false;
52
+
};
53
+
inherit repos rules;
54
+
};
55
+
}
+203
nixos/2configs/git.nix
+203
nixos/2configs/git.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
let
4
+
5
+
out = {
6
+
services.nginx.enable = true;
7
+
krebs.git = {
8
+
enable = true;
9
+
cgit = {
10
+
settings = {
11
+
root-title = "public repositories at ${config.krebs.build.host.name}";
12
+
root-desc = "keep calm and engage";
13
+
};
14
+
};
15
+
repos = repos;
16
+
rules = rules;
17
+
};
18
+
19
+
krebs.iptables.tables.filter.INPUT.rules = [
20
+
{ predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; }
21
+
];
22
+
23
+
system.activationScripts.spool-chmod = ''
24
+
${pkgs.coreutils}/bin/chmod +x /var/spool
25
+
'';
26
+
};
27
+
28
+
cgit-clear-cache = pkgs.cgit-clear-cache.override {
29
+
inherit (config.krebs.git.cgit.settings) cache-root;
30
+
};
31
+
32
+
repos =
33
+
public-repos //
34
+
optionalAttrs config.krebs.build.host.secure restricted-repos;
35
+
36
+
rules = concatMap make-rules (attrValues repos);
37
+
38
+
public-repos = mapAttrs make-public-repo {
39
+
Reaktor = {
40
+
cgit.desc = "Reaktor IRC bot";
41
+
cgit.section = "software";
42
+
};
43
+
buildbot-classic = {
44
+
cgit.desc = "fork of buildbot";
45
+
cgit.section = "software";
46
+
};
47
+
cholerab = {
48
+
cgit.desc = "krebs thesauron & enterprise-patterns";
49
+
cgit.section = "documentation";
50
+
};
51
+
disko = {
52
+
cgit.desc = "take a description of your disk layout and produce a format script";
53
+
cgit.section = "software";
54
+
};
55
+
go = {
56
+
cgit.desc = "url shortener";
57
+
cgit.section = "software";
58
+
};
59
+
grib2json-bin = {
60
+
cgit.desc = "build jar of grib2json";
61
+
cgit.section = "deployment";
62
+
};
63
+
krebspage = {
64
+
cgit.desc = "homepage of krebs";
65
+
cgit.section = "configuration";
66
+
};
67
+
krops = {
68
+
cgit.desc = "krebs deployment";
69
+
cgit.section = "software";
70
+
};
71
+
news = {
72
+
cgit.desc = "take a rss feed and a timeout and print it to stdout";
73
+
cgit.section = "software";
74
+
};
75
+
newsbot-js = {
76
+
cgit.desc = "print rss feeds to irc channels";
77
+
cgit.section = "software";
78
+
};
79
+
nix-user-chroot = {
80
+
cgit.desc = "Fork of nix-user-chroot by lethalman";
81
+
cgit.section = "software";
82
+
};
83
+
nix-writers = {
84
+
cgit.desc = "high level writers for nix";
85
+
cgit.section = "software";
86
+
};
87
+
nixos-generators = {
88
+
cgit.desc = "custom image builders";
89
+
cgit.section = "software";
90
+
};
91
+
nixpkgs = {
92
+
cgit.desc = "nixpkgs fork";
93
+
cgit.section = "configuration";
94
+
};
95
+
populate = {
96
+
cgit.section = "software";
97
+
};
98
+
reaktor2 = {
99
+
cgit.desc = "irc bot";
100
+
cgit.section = "software";
101
+
};
102
+
stockholm = {
103
+
cgit.desc = "take all the computers hostage, they'll love you!";
104
+
cgit.section = "configuration";
105
+
};
106
+
stockholm-issues = {
107
+
cgit.desc = "stockholm issues";
108
+
cgit.section = "issues";
109
+
};
110
+
the_playlist = {
111
+
cgit.desc = "Good Music collection + tools";
112
+
cgit.section = "art";
113
+
};
114
+
workadventure-nix = {
115
+
cgit.desc = "Nix packaging for workadventure";
116
+
cgit.section = "deployment";
117
+
};
118
+
xmonad-stockholm = {
119
+
cgit.desc = "krebs xmonad modules";
120
+
cgit.section = "configuration";
121
+
};
122
+
} // mapAttrs make-public-repo-silent {
123
+
};
124
+
125
+
restricted-repos = mapAttrs make-restricted-repo (
126
+
{
127
+
brain = {
128
+
collaborators = with config.krebs.users; [ tv makefu ];
129
+
announce = true;
130
+
};
131
+
};
132
+
);
133
+
134
+
make-public-repo = name: { cgit ? {}, collaborators ? [], ... }: {
135
+
inherit cgit collaborators name;
136
+
public = true;
137
+
hooks = {
138
+
post-receive = ''
139
+
${pkgs.git-hooks.irc-announce {
140
+
# TODO make nick = config.krebs.build.host.name the default
141
+
nick = config.krebs.build.host.name;
142
+
channel = "#xxx";
143
+
# TODO define refs in some kind of option per repo
144
+
server = "irc.r";
145
+
verbose = config.krebs.build.host.name == "orange";
146
+
}}
147
+
${cgit-clear-cache}/bin/cgit-clear-cache
148
+
'';
149
+
};
150
+
};
151
+
152
+
make-public-repo-silent = name: { cgit ? {}, ... }: {
153
+
inherit cgit name;
154
+
public = true;
155
+
};
156
+
157
+
make-restricted-repo = name: { admins ? [], collaborators ? [], announce ? true, hooks ? {}, ... }: {
158
+
inherit admins collaborators name;
159
+
public = false;
160
+
hooks = {
161
+
post-receive = ''
162
+
${optionalString announce (pkgs.git-hooks.irc-announce {
163
+
# TODO make nick = config.krebs.build.host.name the default
164
+
nick = config.krebs.build.host.name;
165
+
channel = "#xxx";
166
+
# TODO define refs in some kind of option per repo
167
+
refs = [
168
+
"refs/heads/master"
169
+
"refs/heads/staging*"
170
+
];
171
+
server = "irc.r";
172
+
verbose = false;
173
+
})}
174
+
${cgit-clear-cache}/bin/cgit-clear-cache
175
+
'';
176
+
} // hooks;
177
+
};
178
+
179
+
make-rules =
180
+
with git // config.krebs.users;
181
+
repo:
182
+
singleton {
183
+
user = [ lass lass-green ];
184
+
repo = [ repo ];
185
+
perm = push "refs/*" [ non-fast-forward create delete merge ];
186
+
} ++
187
+
optional (length (repo.admins or []) > 0) {
188
+
user = repo.admins;
189
+
repo = [ repo ];
190
+
perm = push "refs/*" [ non-fast-forward create delete merge ];
191
+
} ++
192
+
optional (length (repo.collaborators or []) > 0) {
193
+
user = repo.collaborators;
194
+
repo = [ repo ];
195
+
perm = fetch;
196
+
} ++
197
+
optional repo.public {
198
+
user = attrValues config.krebs.users;
199
+
repo = [ repo ];
200
+
perm = fetch;
201
+
};
202
+
203
+
in out
+19
nixos/2configs/go.nix
+19
nixos/2configs/go.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
krebs.go = {
4
+
enable = true;
5
+
};
6
+
services.nginx = {
7
+
enable = true;
8
+
virtualHosts.go = {
9
+
locations."/".extraConfig = ''
10
+
proxy_set_header Host go.lassul.us;
11
+
proxy_pass http://localhost:1337;
12
+
'';
13
+
serverAliases = [
14
+
"go.lassul.us"
15
+
];
16
+
};
17
+
};
18
+
}
19
+
+6
nixos/2configs/green-host.nix
+6
nixos/2configs/green-host.nix
+46
nixos/2configs/gsm-wiki.nix
+46
nixos/2configs/gsm-wiki.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
services.nginx.virtualHosts."docs.c3gsm.de" = {
4
+
forceSSL = true;
5
+
enableACME = true;
6
+
locations."/".extraConfig = ''
7
+
auth_basic "Restricted Content";
8
+
auth_basic_user_file ${pkgs.writeText "flix-user-pass" ''
9
+
c3gsm:$apr1$q9OrPI4C$7AY4EIp3J2Xc4eLMbPGE21
10
+
''};
11
+
root /srv/http/docs.c3gsm.de;
12
+
'';
13
+
};
14
+
15
+
services.nginx.virtualHosts."c3gsm.de" = {
16
+
forceSSL = true;
17
+
enableACME = true;
18
+
locations."/".extraConfig = ''
19
+
root /srv/http/c3gsm.de;
20
+
'';
21
+
};
22
+
23
+
users.users.c3gsm-docs = {
24
+
isNormalUser = true;
25
+
home = "/srv/http/docs.c3gsm.de";
26
+
createHome = true;
27
+
homeMode = "750";
28
+
useDefaultShell = true;
29
+
group = "nginx";
30
+
openssh.authorizedKeys.keys = [
31
+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAlW1fvCrVXhVH/z76fXBWYR/qyecYTE9VOOkFLJ6OwG user@osmocom-dev"
32
+
];
33
+
};
34
+
35
+
users.users.c3gsm = {
36
+
isNormalUser = true;
37
+
home = "/srv/http/c3gsm.de";
38
+
createHome = true;
39
+
homeMode = "750";
40
+
useDefaultShell = true;
41
+
group = "nginx";
42
+
openssh.authorizedKeys.keys = [
43
+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAlW1fvCrVXhVH/z76fXBWYR/qyecYTE9VOOkFLJ6OwG user@osmocom-dev"
44
+
];
45
+
};
46
+
}
+11
nixos/2configs/hardening.nix
+11
nixos/2configs/hardening.nix
+48
nixos/2configs/hfos.nix
+48
nixos/2configs/hfos.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
3
+
vmip = "192.168.122.208";
4
+
5
+
in {
6
+
users.users.riot = {
7
+
uid = genid "riot";
8
+
isNormalUser = true;
9
+
extraGroups = [ "libvirtd" ];
10
+
openssh.authorizedKeys.keys = [
11
+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMkyCwdwBrsbs3qrNQcy/SqQpex4aaQoAMuT+NDefFc8KVHOMfmkDccEyAggDTgQhUrEVIvo/fFUmGBd9sm1vN1IthO2Qh5nX+qiK/A2R7sxci0Ry6piU03R27JfpZqi6g8TSPNi1C9rC8eBqOfO3OB8oQOkFmM48Q9cmS8AV3ERLR0LaHoEqUbs86JELbtHrMdKk4Hzo8zTM/isP3GO8iDHRt4dBS/03Ve7+WVxgNwWU2HW3a3jJd3tWHrqGmS/ZfCEC/47eIj4WSW+JiH9Q0BarNEbkkMV1Mvm32MX52stGPd5FaIIUtFqD4745iVSiw8esUGFUxJ1RjWgUHr99h riot@vortex"
12
+
];
13
+
};
14
+
15
+
networking.interfaces."eth0:0".ip4 = [
16
+
{
17
+
address = "213.239.205.246";
18
+
prefixLength = 24;
19
+
}
20
+
];
21
+
22
+
krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
23
+
{ v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 22"; target = "DNAT --to-destination 192.168.122.208:22"; }
24
+
{ v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 25"; target = "DNAT --to-destination 192.168.122.208:25"; }
25
+
{ v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 80"; target = "DNAT --to-destination 192.168.122.208:1080"; }
26
+
{ v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; }
27
+
];
28
+
29
+
krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
30
+
{ v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
31
+
{ v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
32
+
{ v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 1080 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
33
+
{ v6 = false; predicate = "-d 192.168.122.208 -p tcp --dport 1443 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; }
34
+
];
35
+
36
+
krebs.iptables.tables.nat.OUTPUT.rules = mkBefore [
37
+
{ v6 = false; predicate = "-d 213.239.205.246 -p tcp --dport 443"; target = "DNAT --to-destination 192.168.122.208:1443"; }
38
+
];
39
+
40
+
# TODO use bridge interfaces instead of this crap
41
+
systemd.services.libvirtd.serviceConfig.ExecStartPost = let
42
+
restart-iptables = pkgs.writeDash "restart-iptables" ''
43
+
#soo hacky
44
+
${pkgs.coreutils}/bin/sleep 5s
45
+
${pkgs.systemd}/bin/systemctl restart krebs-iptables.service
46
+
'';
47
+
in restart-iptables;
48
+
}
+22
nixos/2configs/home-manager.nix
+22
nixos/2configs/home-manager.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
vim_nix = import ./vim.nix { inherit lib pkgs; config = {}; };
3
+
in {
4
+
programs.git = {
5
+
enable = true;
6
+
userName = "lassulus";
7
+
userEmail = "lassulus@lassul.us";
8
+
extraConfig = {
9
+
rebase.autostash = true;
10
+
};
11
+
};
12
+
13
+
home.packages = [
14
+
(pkgs.writers.writeDashBin "vim" ''
15
+
${vim_nix.environment.etc.vim.source}/bin/vim -u ${vim_nix.environment.etc.vimrc.source} "$@"
16
+
'')
17
+
pkgs.mosh
18
+
pkgs.direnv
19
+
];
20
+
21
+
programs.home-manager.enable = true;
22
+
}
+101
nixos/2configs/home-media.nix
+101
nixos/2configs/home-media.nix
···
1
+
{ pkgs, ... }:
2
+
{
3
+
imports = [
4
+
./mpv.nix
5
+
];
6
+
users.users.media = {
7
+
isNormalUser = true;
8
+
uid = genid_uint31 "media";
9
+
extraGroups = [ "video" "audio" "pipewire" ];
10
+
packages = [
11
+
(pkgs.writers.writeDashBin "mpv" ''
12
+
if test -e "$1"; then
13
+
mpv-ipc-cli loadfile "$(realpath "$1")"
14
+
else
15
+
mpv-ipc-cli loadfile "$1"
16
+
fi
17
+
'')
18
+
];
19
+
};
20
+
21
+
users.users.mainUser.packages = [
22
+
(pkgs.writers.writeDashBin "mpv" ''
23
+
if test -e "$1"; then
24
+
mpv-ipc-cli loadfile "$(realpath "$1")"
25
+
else
26
+
mpv-ipc-cli loadfile "$1"
27
+
fi
28
+
'')
29
+
];
30
+
31
+
services.xserver.displayManager.autoLogin = {
32
+
enable = true;
33
+
user = "media";
34
+
};
35
+
36
+
hardware.pulseaudio.configFile = pkgs.writeText "pulse.pa" ''
37
+
.include ${pkgs.pulseaudioFull}/etc/pulse/default.pa
38
+
load-module module-native-protocol-tcp auth-ip-acl=127.0.0.1;10.42.0.0/24 auth-anonymous=1
39
+
'';
40
+
41
+
environment.systemPackages = [
42
+
(pkgs.writers.writeDashBin "mpv-ipc-cli" ''
43
+
set -efux
44
+
${pkgs.jq}/bin/jq -nc '{ "command": $ARGS.positional }' --args "$@" | ${pkgs.socat}/bin/socat - /tmp/mpv.ipc
45
+
'')
46
+
(pkgs.writers.writeDashBin "ipc-mpv" ''
47
+
/run/current-system/sw/bin/mpv \
48
+
--audio-display=no --audio-channels=stereo \
49
+
--audio-samplerate=48000 --audio-format=s16 \
50
+
--ao-pcm-file=/run/snapserver/snapfifo --ao=pcm \
51
+
--audio-delay=-1 \
52
+
"$@"
53
+
'')
54
+
pkgs.mpvc
55
+
(pkgs.writers.writeDashBin "iptv" ''
56
+
curl -Ssf 'https://iptv-org.github.io/iptv/index.nsfw.m3u' |
57
+
sed 's/.*,//' |
58
+
sed -z 's/\nhttp/,http/g' |
59
+
fzf --bind='enter:execute(echo {} | cut -d ',' -f 2 | xargs -0 mpv-ipc-cli loadfile)'
60
+
'')
61
+
];
62
+
63
+
environment.variables.SOCKET = "/tmp/mpv.ipc";
64
+
systemd.services.mpvd = {
65
+
wantedBy = [ "multi-user.target" ];
66
+
environment.DISPLAY = ":0";
67
+
serviceConfig = {
68
+
User = "media";
69
+
RemainAfterExit = true;
70
+
Nice = "-10";
71
+
ExecStart = ''${pkgs.tmux}/bin/tmux -2 new-session -d -s mpvd -- /run/current-system/sw/bin/ipc-mpv \
72
+
--audio-display=no --audio-channels=stereo \
73
+
--audio-samplerate=48000 --audio-format=s16 \
74
+
--ao-pcm-file=/run/snapserver/snapfifo --ao=pcm \
75
+
--audio-delay=-1 \
76
+
--network-timeout=3 \
77
+
--untimed --cache-pause=no \
78
+
--idle=yes --force-window=yes \
79
+
--loop-playlist=inf \
80
+
--input-ipc-server=/tmp/mpv.ipc
81
+
'';
82
+
ExecStop = "${pkgs.tmux}/bin/tmux kill-session -t mpvd";
83
+
ExecStartPre = [
84
+
"+${pkgs.writers.writeDash "remove_socket" ''
85
+
set -efux
86
+
rm -f /tmp/mpv.ipc
87
+
''}"
88
+
];
89
+
ExecStartPost = [
90
+
"+${pkgs.writers.writeDash "fix_permissions" ''
91
+
set -efux
92
+
until test -e /tmp/mpv.ipc; do
93
+
sleep 1
94
+
done
95
+
# sleep 2
96
+
chmod 666 /tmp/mpv.ipc || :
97
+
''}"
98
+
];
99
+
};
100
+
};
101
+
}
+41
nixos/2configs/htop.nix
+41
nixos/2configs/htop.nix
···
1
+
{ pkgs, ... }:
2
+
3
+
{
4
+
nixpkgs.config.packageOverrides = super: {
5
+
htop = pkgs.symlinkJoin {
6
+
name = "htop";
7
+
paths = [
8
+
(pkgs.writeDashBin "htop" ''
9
+
export HTOPRC=${pkgs.writeText "htoprc" ''
10
+
fields=0 48 17 18 38 39 40 2 46 47 49 1
11
+
sort_key=46
12
+
sort_direction=1
13
+
hide_threads=0
14
+
hide_kernel_threads=1
15
+
hide_userland_threads=0
16
+
shadow_other_users=1
17
+
show_thread_names=1
18
+
show_program_path=1
19
+
highlight_base_name=1
20
+
highlight_megabytes=1
21
+
highlight_threads=1
22
+
tree_view=1
23
+
header_margin=1
24
+
detailed_cpu_time=0
25
+
cpu_count_from_zero=0
26
+
update_process_names=0
27
+
account_guest_in_cpu_meter=1
28
+
color_scheme=6
29
+
delay=15
30
+
left_meters=LeftCPUs2 RightCPUs2 Memory Swap
31
+
left_meter_modes=1 1 1 1
32
+
right_meters=Uptime Tasks LoadAverage Battery
33
+
right_meter_modes=2 2 2 2
34
+
''}
35
+
exec ${super.htop}/bin/htop "$@"
36
+
'')
37
+
super.htop
38
+
];
39
+
};
40
+
};
41
+
}
+58
nixos/2configs/idc.nix
+58
nixos/2configs/idc.nix
···
1
+
{ config, pkgs, lib, ... }: let
2
+
interdimensional-cable = let
3
+
nimaid-github-io = pkgs.fetchFromGitHub {
4
+
owner = "nimaid";
5
+
repo = "nimaid.github.io";
6
+
rev = "5c4f8dda1216d578ad7cd6b0052d5ebf3696ea12";
7
+
sha256 = "sha256-w0u72Q0CkxRu8lr/pp863POzAg09xssbot9pOhSsAn4=";
8
+
};
9
+
in pkgs.writeShellScriptBin "interdimensional-cable" ''
10
+
export PATH=${lib.makeBinPath [ pkgs.mpv pkgs.jq pkgs.gnused ]}
11
+
mpv --shuffle --playlist=<(jq -r '.videos[]' ${nimaid-github-io}/tv/interdimensional_database.json | sed 's#^#https://youtu.be/#')
12
+
'';
13
+
in {
14
+
systemd.services.reaktor2-idc.serviceConfig.DynamicUser = lib.mkForce false;
15
+
systemd.services.reaktor2-idc.serviceConfig.Group = lib.mkForce "users";
16
+
17
+
environment.systemPackages = [ interdimensional-cable ];
18
+
19
+
krebs.reaktor2.idc = {
20
+
hostname = "irc.r";
21
+
username = "lass";
22
+
port = "6667";
23
+
nick = "inter_dimensional_cable";
24
+
plugins = [
25
+
{
26
+
plugin = "register";
27
+
config = {
28
+
channels = [
29
+
# "#xxx"
30
+
"#noise"
31
+
];
32
+
};
33
+
}
34
+
{
35
+
plugin = "system";
36
+
config = {
37
+
hooks.PRIVMSG = [
38
+
{
39
+
activate = "match";
40
+
pattern = ''^!([^ ]+)(?:\s*(.*))?'';
41
+
command = 1;
42
+
arguments = [2];
43
+
commands = {
44
+
next.filename = pkgs.writeDash "next" ''
45
+
DISPLAY=:0 ${pkgs.xdotool}/bin/xdotool key "enter"
46
+
'';
47
+
mute.filename = pkgs.writeDash "mute" ''
48
+
TMUX_TMPDIR=/tmp ${pkgs.tmux}/bin/tmux send-keys -t radio m
49
+
DISPLAY=:0 ${pkgs.xdotool}/bin/xdotool key "m"
50
+
'';
51
+
};
52
+
}
53
+
];
54
+
};
55
+
}
56
+
];
57
+
};
58
+
}
+19
nixos/2configs/iodined.nix
+19
nixos/2configs/iodined.nix
···
1
+
{ pkgs, config, ... }:
2
+
3
+
let
4
+
# TODO: make this a parameter
5
+
domain = "io.lassul.us";
6
+
in {
7
+
8
+
services.iodine.server = {
9
+
enable = true;
10
+
domain = domain;
11
+
ip = "172.16.10.1/24";
12
+
extraConfig = "-c -l ${config.krebs.build.host.nets.internet.ip4.addr}";
13
+
};
14
+
15
+
krebs.iptables.tables.filter.INPUT.rules = [
16
+
{ predicate = "-p udp --dport 53"; target = "ACCEPT";}
17
+
];
18
+
19
+
}
+12
nixos/2configs/ipfs.nix
+12
nixos/2configs/ipfs.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
services.ipfs = {
4
+
enable = true;
5
+
};
6
+
users.users.mainUser.extraGroups = [ "ipfs" ];
7
+
systemd.services.ipfs.serviceConfig.ExecStartPost = [
8
+
(pkgs.writers.writeDash "fix-permission" ''
9
+
chmod g+r /var/lib/ipfs/config
10
+
'')
11
+
];
12
+
}
+33
nixos/2configs/libvirt.nix
+33
nixos/2configs/libvirt.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
virtualisation.libvirtd.enable = true;
5
+
security.polkit.enable = true;
6
+
7
+
krebs.iptables.tables.filter.INPUT.rules = [
8
+
{ v6 = false; predicate = "-i virbr0 -p udp -m udp --dport 53"; target = "ACCEPT"; }
9
+
{ v6 = false; predicate = "-i virbr0 -p tcp -m tcp --dport 53"; target = "ACCEPT"; }
10
+
{ v6 = false; predicate = "-i virbr0 -p udp -m udp --dport 67"; target = "ACCEPT"; }
11
+
{ v6 = false; predicate = "-i virbr0 -p tcp -m tcp --dport 67"; target = "ACCEPT"; }
12
+
];
13
+
krebs.iptables.tables.filter.FORWARD.rules = [
14
+
{ v6 = false; predicate = "-d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
15
+
{ v6 = false; predicate = "-s 192.168.122.0/24 -i virbr0"; target = "ACCEPT"; }
16
+
{ v6 = false; predicate = "-i virbr0 -o virbr0"; target = "ACCEPT"; }
17
+
{ v6 = false; predicate = "-o virbr0"; target = "REJECT --reject-with icmp-port-unreachable"; }
18
+
{ v6 = false; predicate = "-i virbr0"; target = "REJECT --reject-with icmp-port-unreachable"; }
19
+
];
20
+
krebs.iptables.tables.filter.OUTPUT.rules = [
21
+
{ v6 = false; predicate = "-o virbr0 -p udp -m udp --dport 68"; target = "ACCEPT"; }
22
+
];
23
+
krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
24
+
{ v6 = false; predicate = "-s 192.168.122.0/24"; target = "ACCEPT"; }
25
+
];
26
+
krebs.iptables.tables.nat.POSTROUTING.rules = [
27
+
{ v6 = false; predicate = "-s 192.168.122.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
28
+
{ v6 = false; predicate = "-s 192.168.122.0/24 -d 255.255.255.255"; target = "RETURN"; }
29
+
{ v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24"; target = "MASQUERADE"; }
30
+
{ v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
31
+
{ v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
32
+
];
33
+
}
+11
nixos/2configs/livestream.nix
+11
nixos/2configs/livestream.nix
+23
nixos/2configs/logf.nix
+23
nixos/2configs/logf.nix
···
1
+
{ config, pkgs, ... }:
2
+
let
3
+
host-colors = {
4
+
mors = "131";
5
+
prism = "95";
6
+
uriel = "61";
7
+
shodan = "51";
8
+
icarus = "53";
9
+
echelon = "197";
10
+
cloudkrebs = "119";
11
+
};
12
+
urgent = [
13
+
"\\blass@blue\\b"
14
+
];
15
+
in {
16
+
environment.systemPackages = [
17
+
(pkgs.writeDashBin "logf" ''
18
+
export LOGF_URGENT=${pkgs.writeJSON "urgent" urgent}
19
+
export LOGF_HOST_COLORS=${pkgs.writeJSON "host-colors" host-colors}
20
+
${pkgs.logf}/bin/logf ${concatMapStringsSep " " (name: "root@${name}") (attrNames config.lass.hosts)}
21
+
'')
22
+
];
23
+
}
+272
nixos/2configs/mail.nix
+272
nixos/2configs/mail.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
let
4
+
5
+
msmtprc = pkgs.writeText "msmtprc" ''
6
+
defaults
7
+
logfile ~/.msmtp.log
8
+
account prism
9
+
host prism.r
10
+
account c-base
11
+
from lassulus@c-base.org
12
+
host c-mail.c-base.org
13
+
port 465
14
+
tls on
15
+
tls_starttls off
16
+
auth on
17
+
user lassulus
18
+
passwordeval pass show c-base/pass
19
+
account default: prism
20
+
'';
21
+
22
+
notmuch-config = pkgs.writeText "notmuch-config" ''
23
+
[database]
24
+
path=/home/lass/Maildir
25
+
mail_root=/home/lass/Maildir
26
+
27
+
[user]
28
+
name=lassulus
29
+
primary_email=lassulus@lassul.us
30
+
other_email=lass@mors.r;${lib.concatStringsSep ";" (lib.flatten (lib.attrValues mailboxes))}
31
+
32
+
[new]
33
+
tags=unread;inbox;
34
+
ignore=
35
+
36
+
[search]
37
+
exclude_tags=deleted;spam;
38
+
39
+
[maildir]
40
+
synchronize_flags=true
41
+
'';
42
+
43
+
msmtp = pkgs.writeBashBin "msmtp" ''
44
+
${pkgs.coreutils}/bin/tee >(${pkgs.notmuch}/bin/notmuch insert +sent) | \
45
+
${pkgs.msmtp}/bin/msmtp -C ${msmtprc} "$@"
46
+
'';
47
+
48
+
mailcap = pkgs.writeText "mailcap" ''
49
+
text/html; ${pkgs.elinks}/bin/elinks -dump ; copiousoutput;
50
+
'';
51
+
52
+
mailboxes = {
53
+
afra = [ "to:afra@afra-berlin.de" ];
54
+
c-base = [ "to:c-base.org" ];
55
+
coins = [
56
+
"to:btce@lassul.us"
57
+
"to:coinbase@lassul.us"
58
+
"to:polo@lassul.us"
59
+
"to:bitwala@lassul.us"
60
+
"to:payeer@lassul.us"
61
+
"to:gatehub@lassul.us"
62
+
"to:bitfinex@lassul.us"
63
+
"to:binance@lassul.us"
64
+
"to:bitcoin.de@lassul.us"
65
+
"to:robinhood@lassul.us"
66
+
];
67
+
dezentrale = [ "to:dezentrale.space" ];
68
+
dhl = [ "to:dhl@lassul.us" ];
69
+
dn42 = [ "to:dn42@lists.nox.tf" ];
70
+
eloop = [ "to:eloop.org" ];
71
+
github = [ "to:github@lassul.us" ];
72
+
gmail = [ "to:gmail@lassul.us" "to:lassulus@gmail.com" "lassulus@googlemail.com" ];
73
+
india = [ "to:hillhackers@lists.hillhacks.in" "to:hackbeach@lists.hackbeach.in" "to:hackbeach@mail.hackbeach.in" ];
74
+
kaosstuff = [ "to:gearbest@lassul.us" "to:banggood@lassul.us" "to:tomtop@lassul.us" ];
75
+
lugs = [ "to:lugs@lug-s.org" ];
76
+
meetup = [ "to:meetup@lassul.us" ];
77
+
nix = [ "to:nix-devel@googlegroups.com" "to:nix@lassul.us" ];
78
+
patreon = [ "to:patreon@lassul.us" ];
79
+
paypal = [ "to:paypal@lassul.us" ];
80
+
ptl = [ "to:ptl@posttenebraslab.ch" ];
81
+
retiolum = [ "to:lass@mors.r" ];
82
+
security = [
83
+
"to:seclists.org" "to:bugtraq" "to:securityfocus@lassul.us"
84
+
"to:security-announce@lists.apple.com"
85
+
];
86
+
shack = [ "to:shackspace.de" ];
87
+
steam = [ "to:steam@lassul.us" ];
88
+
tinc = [ "to:tinc@tinc-vpn.org" "to:tinc-devel@tinc-vpn.org" ];
89
+
wireguard = [ "to:wireguard@lists.zx2c4" ];
90
+
zzz = [ "to:pizza@lassul.us" "to:spam@krebsco.de" ];
91
+
};
92
+
93
+
tag-new-mails = pkgs.writeDashBin "nm-tag-init" ''
94
+
${pkgs.notmuch}/bin/notmuch new
95
+
${lib.concatMapStringsSep "\n" (i: ''
96
+
mkdir -p "$HOME/Maildir/.${i.name}/cur"
97
+
for mail in $(${pkgs.notmuch}/bin/notmuch search --output=files 'tag:inbox and (${lib.concatMapStringsSep " or " (f: "${f}") i.value})'); do
98
+
if test -e "$mail"; then
99
+
mv "$mail" "$HOME/Maildir/.${i.name}/cur/"
100
+
else
101
+
echo "$mail does not exist"
102
+
fi
103
+
done
104
+
${pkgs.notmuch}/bin/notmuch tag -inbox +${i.name} -- tag:inbox ${lib.concatMapStringsSep " or " (f: "${f}") i.value}
105
+
'') (lib.mapAttrsToList lib.nameValuePair mailboxes)}
106
+
${pkgs.notmuch}/bin/notmuch new
107
+
${pkgs.notmuch}/bin/notmuch dump > "$HOME/Maildir/notmuch.backup"
108
+
'';
109
+
110
+
tag-old-mails = pkgs.writeDashBin "nm-tag-old" ''
111
+
set -efux
112
+
${lib.concatMapStringsSep "\n" (i: ''
113
+
${pkgs.notmuch}/bin/notmuch tag -inbox -archive +${i.name} -- ${lib.concatMapStringsSep " or " (f: "${f}") i.value}
114
+
mkdir -p "$HOME/Maildir/.${i.name}/cur"
115
+
for mail in $(${pkgs.notmuch}/bin/notmuch search --output=files ${lib.concatMapStringsSep " or " (f: "${f}") i.value}); do
116
+
if test -e "$mail"; then
117
+
mv "$mail" "$HOME/Maildir/.${i.name}/cur/"
118
+
else
119
+
echo "$mail does not exist"
120
+
fi
121
+
done
122
+
'') (lib.mapAttrsToList lib.nameValuePair mailboxes)}
123
+
${pkgs.notmuch}/bin/notmuch new --no-hooks
124
+
'';
125
+
126
+
muttrc = pkgs.writeText "muttrc" ''
127
+
128
+
# read html mails
129
+
auto_view text/html
130
+
set mailcap_path = ${mailcap}
131
+
132
+
# notmuch
133
+
set folder="$HOME/Maildir"
134
+
set nm_default_uri = "notmuch://$HOME/Maildir"
135
+
set nm_record = yes
136
+
set nm_record_tags = "-inbox me archive"
137
+
set spoolfile = +Inbox
138
+
set virtual_spoolfile = yes
139
+
140
+
141
+
set sendmail="${msmtp}/bin/msmtp" # enables parsing of outgoing mail
142
+
set from="lassulus@lassul.us"
143
+
alternates ^.*@lassul\.us$ ^.*@.*\.r$
144
+
unset envelope_from_address
145
+
set use_envelope_from
146
+
set reverse_name
147
+
148
+
set sort=threads
149
+
150
+
set index_format="%4C %Z %?GI?%GI& ? %[%y-%m-%d] %-20.20a %?M?(%3M)& ? %s %> %r %g"
151
+
152
+
virtual-mailboxes "Unread" "notmuch://?query=tag:unread"
153
+
virtual-mailboxes "INBOX" "notmuch://?query=tag:inbox"
154
+
${lib.concatMapStringsSep "\n" (i: ''${" "}virtual-mailboxes "${i.name}" "notmuch://?query=tag:${i.name}"'') (lib.mapAttrsToList lib.nameValuePair mailboxes)}
155
+
virtual-mailboxes "TODO" "notmuch://?query=tag:TODO"
156
+
virtual-mailboxes "Starred" "notmuch://?query=tag:*"
157
+
virtual-mailboxes "Archive" "notmuch://?query=tag:archive"
158
+
virtual-mailboxes "Sent" "notmuch://?query=tag:sent"
159
+
virtual-mailboxes "Junk" "notmuch://?query=tag:junk"
160
+
virtual-mailboxes "All" "notmuch://?query=*"
161
+
162
+
tag-transforms "junk" "k" \
163
+
"unread" "u" \
164
+
"replied" "↻" \
165
+
"TODO" "T" \
166
+
167
+
# notmuch bindings
168
+
macro index \\\\ "<vfolder-from-query>" # looks up a hand made query
169
+
macro index + "<modify-labels>+*\n<sync-mailbox>" # tag as starred
170
+
macro index - "<modify-labels>-*\n<sync-mailbox>" # tag as unstarred
171
+
172
+
# muchsync
173
+
bind index \Cr noop
174
+
macro index \Cr \
175
+
"<enter-command>unset wait_key<enter> \
176
+
<shell-escape>${pkgs.writeDash "muchsync" ''
177
+
set -efu
178
+
until ${pkgs.muchsync}/bin/muchsync -F lass@green.r; do
179
+
sleep 1
180
+
done
181
+
''}<enter>
182
+
183
+
#killed
184
+
bind index d noop
185
+
bind pager d noop
186
+
187
+
bind index S noop
188
+
bind index s noop
189
+
bind pager S noop
190
+
bind pager s noop
191
+
macro index S "<modify-labels-then-hide>-inbox -unread +junk\n" # tag as Junk mail
192
+
macro index s "<modify-labels>-junk\n" # tag as Junk mail
193
+
macro pager S "<modify-labels-then-hide>-inbox -unread +junk\n" # tag as Junk mail
194
+
macro pager s "<modify-labels>-junk\n" # tag as Junk mail
195
+
196
+
197
+
bind index A noop
198
+
bind index a noop
199
+
bind pager A noop
200
+
bind pager a noop
201
+
macro index A "<modify-labels>+archive -unread -inbox\n" # tag as Archived
202
+
macro index a "<modify-labels>-archive\n" # tag as Archived
203
+
macro pager A "<modify-labels>+archive -unread -inbox\n" # tag as Archived
204
+
macro pager a "<modify-labels>-archive\n" # tag as Archived
205
+
206
+
207
+
bind index U noop
208
+
bind index u noop
209
+
bind pager U noop
210
+
bind pager u noop
211
+
macro index U "<modify-labels>+unread\n"
212
+
macro index u "<modify-labels>-unread\n"
213
+
macro pager U "<modify-labels>+unread\n"
214
+
macro pager u "<modify-labels>-unread\n"
215
+
216
+
217
+
bind index t noop
218
+
bind pager t noop
219
+
macro index t "<modify-labels>" # tag as Archived
220
+
221
+
# top index bar in email view
222
+
set pager_index_lines=7
223
+
# top_index_bar toggle
224
+
macro pager ,@1 "<enter-command> set pager_index_lines=0; macro pager ] ,@2 'Toggle indexbar<Enter>"
225
+
macro pager ,@2 "<enter-command> set pager_index_lines=3; macro pager ] ,@3 'Toggle indexbar<Enter>"
226
+
macro pager ,@3 "<enter-command> set pager_index_lines=7; macro pager ] ,@1 'Toggle indexbar<Enter>"
227
+
macro pager ] ,@1 'Toggle indexbar
228
+
229
+
# urlview
230
+
macro pager \cb <pipe-entry>'${pkgs.urlview}/bin/urlview'<enter> 'Follow links with urlview'
231
+
232
+
# sidebar
233
+
set sidebar_divider_char = '│'
234
+
set sidebar_delim_chars = "/"
235
+
set sidebar_short_path
236
+
set sidebar_folder_indent
237
+
set sidebar_visible = yes
238
+
set sidebar_format = '%D%?F? [%F]?%* %?N?%N/? %?S?%S?'
239
+
set sidebar_width = 20
240
+
color sidebar_new yellow red
241
+
242
+
# sidebar bindings
243
+
bind index <left> sidebar-prev # got to previous folder in sidebar
244
+
bind index <right> sidebar-next # got to next folder in sidebar
245
+
bind index <space> sidebar-open # open selected folder from sidebar
246
+
# sidebar toggle
247
+
macro index,pager ,@) "<enter-command> set sidebar_visible=no; macro index,pager [ ,@( 'Toggle sidebar'<Enter>"
248
+
macro index,pager ,@( "<enter-command> set sidebar_visible=yes; macro index,pager [ ,@) 'Toggle sidebar'<Enter>"
249
+
macro index,pager [ ,@( 'Toggle sidebar' # toggle the sidebar
250
+
'';
251
+
252
+
mutt = pkgs.symlinkJoin {
253
+
name = "mutt";
254
+
paths = [
255
+
(pkgs.writeDashBin "mutt" ''
256
+
exec ${pkgs.neomutt}/bin/neomutt -F ${muttrc} "$@"
257
+
'')
258
+
pkgs.neomutt
259
+
];
260
+
};
261
+
262
+
in {
263
+
environment.variables.NOTMUCH_CONFIG = toString notmuch-config;
264
+
environment.systemPackages = [
265
+
msmtp
266
+
mutt
267
+
pkgs.notmuch
268
+
pkgs.muchsync
269
+
tag-new-mails
270
+
tag-old-mails
271
+
];
272
+
}
+61
nixos/2configs/matrix.nix
+61
nixos/2configs/matrix.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
services.matrix-synapse = {
4
+
enable = true;
5
+
settings = {
6
+
server_name = "lassul.us";
7
+
# registration_shared_secret = "yolo";
8
+
database.name = "sqlite3";
9
+
turn_uris = [
10
+
"turn:turn.matrix.org?transport=udp"
11
+
"turn:turn.matrix.org?transport=tcp"
12
+
];
13
+
listeners = [
14
+
{
15
+
port = 8008;
16
+
bind_addresses = [ "::1" ];
17
+
type = "http";
18
+
tls = false;
19
+
x_forwarded = true;
20
+
resources = [
21
+
{
22
+
names = [ "client" ];
23
+
compress = true;
24
+
}
25
+
{
26
+
names = [ "federation" ];
27
+
compress = true;
28
+
}
29
+
];
30
+
}
31
+
];
32
+
};
33
+
};
34
+
services.nginx = {
35
+
virtualHosts = {
36
+
"lassul.us" = {
37
+
locations."= /.well-known/matrix/server".extraConfig = ''
38
+
add_header Content-Type application/json;
39
+
return 200 '${builtins.toJSON {
40
+
"m.server" = "matrix.lassul.us:443";
41
+
}}';
42
+
'';
43
+
locations."= /.well-known/matrix/client".extraConfig = ''
44
+
add_header Content-Type application/json;
45
+
add_header Access-Control-Allow-Origin *;
46
+
return 200 '${builtins.toJSON {
47
+
"m.homeserver" = { "base_url" = "https://matrix.lassul.us"; };
48
+
"m.identity_server" = { "base_url" = "https://vector.im"; };
49
+
}}';
50
+
'';
51
+
};
52
+
"matrix.lassul.us" = {
53
+
forceSSL = true;
54
+
enableACME = true;
55
+
locations."/_matrix" = {
56
+
proxyPass = "http://[::1]:8008";
57
+
};
58
+
};
59
+
};
60
+
};
61
+
}
+344
nixos/2configs/mc.nix
+344
nixos/2configs/mc.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
let
4
+
mcExt = pkgs.writeText "mc.ext" ''
5
+
# gitfs changeset
6
+
regex/^\[git\]
7
+
Open=%cd %p/changesetfs://
8
+
View=%cd %p/patchsetfs://
9
+
10
+
### Archives ###
11
+
12
+
# .tgz, .tpz, .tar.gz, .tar.z, .tar.Z, .ipk, .gem
13
+
regex/\.t([gp]?z|ar\.g?[zZ])$|\.ipk$|\.gem$
14
+
Open=%cd %p/utar://
15
+
16
+
shell/.tar.bz
17
+
# Open=%cd %p/utar://
18
+
19
+
regex/\.t(ar\.bz2|bz2?|b2)$
20
+
Open=%cd %p/utar://
21
+
22
+
# .tar.lzma, .tlz
23
+
regex/\.t(ar\.lzma|lz)$
24
+
Open=%cd %p/utar://
25
+
26
+
# .tar.xz, .txz
27
+
regex/\.t(ar\.xz|xz)$
28
+
Open=%cd %p/utar://
29
+
30
+
# .tar.F - used in QNX
31
+
shell/.tar.F
32
+
# Open=%cd %p/utar://
33
+
34
+
# .qpr/.qpk - QNX Neutrino package installer files
35
+
regex/\.qp[rk]$
36
+
Open=%cd %p/utar://
37
+
38
+
# tar
39
+
shell/i/.tar
40
+
Open=%cd %p/utar://
41
+
42
+
# lha
43
+
type/^LHa\ .*archive
44
+
Open=%cd %p/ulha://
45
+
46
+
# arj
47
+
regex/i/\.a(rj|[0-9][0-9])$
48
+
Open=%cd %p/uarj://
49
+
50
+
# cab
51
+
shell/i/.cab
52
+
Open=%cd %p/ucab://
53
+
54
+
# ha
55
+
shell/i/.ha
56
+
Open=%cd %p/uha://
57
+
58
+
# rar
59
+
regex/i/\.r(ar|[0-9][0-9])$
60
+
Open=%cd %p/urar://
61
+
62
+
# ALZip
63
+
shell/i/.alz
64
+
Open=%cd %p/ualz://
65
+
66
+
# cpio
67
+
shell/.cpio.Z
68
+
Open=%cd %p/ucpio://
69
+
70
+
shell/.cpio.xz
71
+
Open=%cd %p/ucpio://
72
+
73
+
shell/.cpio.gz
74
+
Open=%cd %p/ucpio://
75
+
76
+
shell/i/.cpio
77
+
Open=%cd %p/ucpio://
78
+
79
+
# 7zip archives (they are not man pages)
80
+
shell/i/.7z
81
+
Open=%cd %p/u7z://
82
+
83
+
# patch
84
+
regex/\.(diff|patch)(\.bz2)$
85
+
Open=%cd %p/patchfs://
86
+
87
+
regex/\.(diff|patch)(\.(gz|Z))$
88
+
Open=%cd %p/patchfs://
89
+
90
+
# ls-lR
91
+
regex/(^|\.)ls-?lR(\.gz|Z|bz2)$
92
+
Open=%cd %p/lslR://
93
+
94
+
# trpm
95
+
shell/.trpm
96
+
Open=%cd %p/trpm://
97
+
98
+
# RPM packages (SuSE uses *.spm for source packages)
99
+
regex/\.(src\.rpm|spm)$
100
+
Open=%cd %p/rpm://
101
+
102
+
shell/.rpm
103
+
Open=%cd %p/rpm://
104
+
105
+
# deb
106
+
regex/\.u?deb$
107
+
Open=%cd %p/deb://
108
+
109
+
# dpkg
110
+
shell/.debd
111
+
Open=%cd %p/debd://
112
+
113
+
# apt
114
+
shell/.deba
115
+
Open=%cd %p/deba://
116
+
117
+
# ISO9660
118
+
shell/i/.iso
119
+
Open=%cd %p/iso9660://
120
+
121
+
122
+
regex/\.(diff|patch)$
123
+
Open=%cd %p/patchfs://
124
+
125
+
# ar library
126
+
regex/\.s?a$
127
+
Open=%cd %p/uar://
128
+
129
+
# gplib
130
+
shell/i/.lib
131
+
Open=%cd %p/ulib://
132
+
133
+
134
+
# Mailboxes
135
+
type/^ASCII\ mail\ text
136
+
Open=%cd %p/mailfs://
137
+
138
+
139
+
### Sources ###
140
+
141
+
# C/C++
142
+
regex/i/\.(c|cc|cpp)$
143
+
Include=editor
144
+
145
+
# C/C++ header
146
+
regex/i/\.(h|hh|hpp)$
147
+
Include=editor
148
+
149
+
# Fortran
150
+
shell/i/.f
151
+
Include=editor
152
+
153
+
# Assembler
154
+
regex/i/\.(s|asm)$
155
+
Include=editor
156
+
157
+
include/editor
158
+
Open=%var{EDITOR:vim} %f
159
+
160
+
### Images ###
161
+
162
+
shell/i/.gif
163
+
Include=image
164
+
165
+
regex/i/\.jpe?g$
166
+
Include=image
167
+
168
+
shell/i/.bmp
169
+
Include=image
170
+
171
+
shell/i/.png
172
+
Include=image
173
+
174
+
shell/i/.jng
175
+
Include=image
176
+
177
+
shell/i/.mng
178
+
Include=image
179
+
180
+
shell/i/.tiff
181
+
Include=image
182
+
183
+
shell/.ico
184
+
Include=image
185
+
186
+
include/image
187
+
Open=sxiv %f
188
+
View=sxiv %f
189
+
190
+
### Sound files ###
191
+
192
+
regex/i/\.(wav|snd|voc|au|smp|aiff|snd|m4a|ape|aac|wv)$
193
+
Include=audio
194
+
195
+
regex/i/\.(mod|s3m|xm|it|mtm|669|stm|ult|far)$
196
+
Include=audio
197
+
198
+
shell/i/.waw22
199
+
Include=audio
200
+
201
+
shell/i/.mp3
202
+
Include=audio
203
+
204
+
regex/i/\.og[gax]$
205
+
Include=audio
206
+
207
+
regex/i/\.(spx|flac)$
208
+
Include=audio
209
+
210
+
regex/i/\.(midi?|rmid?)$
211
+
Include=audio
212
+
213
+
shell/i/.wma
214
+
Include=audio
215
+
216
+
include/audio
217
+
Open=mpv %f
218
+
View=mpv %f
219
+
220
+
### Video ###
221
+
222
+
shell/i/.avi
223
+
Include=video
224
+
225
+
regex/i/\.as[fx]$
226
+
Include=video
227
+
228
+
shell/i/.divx
229
+
Include=video
230
+
231
+
shell/i/.rmvb
232
+
Include=video
233
+
234
+
shell/i/.mkv
235
+
Include=video
236
+
237
+
regex/i/\.(mov|qt)$
238
+
Include=video
239
+
240
+
regex/i/\.(mp4|m4v|mpe?g)$
241
+
Include=video
242
+
243
+
# MPEG-2 TS container + H.264 codec
244
+
shell/i/.mts
245
+
Include=video
246
+
247
+
shell/i/.ts
248
+
Include=video
249
+
250
+
shell/i/.vob
251
+
Include=video
252
+
253
+
shell/i/.wmv
254
+
Include=video
255
+
256
+
regex/i/\.fl[icv]$
257
+
Include=video
258
+
259
+
shell/i/.ogv
260
+
Include=video
261
+
262
+
# WebM
263
+
shell/i/.webm
264
+
Include=video
265
+
266
+
type/WebM
267
+
Include=video
268
+
269
+
include/video
270
+
Open=mpv %f
271
+
View=mpv %f
272
+
273
+
274
+
### Documents ###
275
+
276
+
# PDF
277
+
shell/i/.pdf
278
+
Open=zathura %f
279
+
View=zathura %f
280
+
281
+
### Miscellaneous ###
282
+
283
+
# Makefile
284
+
regex/[Mm]akefile$
285
+
Open=make -f %f %{Enter parameters}
286
+
287
+
288
+
### Plain compressed files ###
289
+
290
+
# ace
291
+
shell/i/.ace
292
+
Open=%cd %p/uace://
293
+
Extract=unace x %f
294
+
295
+
# arc
296
+
shell/i/.arc
297
+
Open=%cd %p/uarc://
298
+
Extract=arc x %f '*'
299
+
Extract (with flags)=I=%{Enter any Arc flags:}; if test -n "$I"; then arc x $I %f; fi
300
+
301
+
# zip
302
+
shell/i/.zip
303
+
Open=%cd %p/uzip://
304
+
305
+
# zip
306
+
type/i/^zip\ archive
307
+
Open=%cd %p/uzip://
308
+
309
+
# jar(zip)
310
+
type/i/^Java\ Jar\ file\ data\ \(zip\)
311
+
Open=%cd %p/uzip://
312
+
313
+
# zoo
314
+
shell/i/.zoo
315
+
Open=%cd %p/uzoo://
316
+
317
+
### Default ###
318
+
319
+
# Default target for anything not described above
320
+
default/*
321
+
Open=vim %f
322
+
View=vim %f
323
+
324
+
'';
325
+
326
+
in {
327
+
environment.systemPackages = [
328
+
(pkgs.symlinkJoin {
329
+
name = "mc";
330
+
paths = [
331
+
(pkgs.writeDashBin "mc" ''
332
+
export MC_DATADIR=${pkgs.write "mc-ext" {
333
+
"/mc.ext.ini".link = mcExt;
334
+
"/sfs.ini".text = "";
335
+
}};
336
+
export TERM=xterm-256color
337
+
exec ${pkgs.mc}/bin/mc -S yadt256 "$@"
338
+
'')
339
+
pkgs.mc
340
+
];
341
+
})
342
+
];
343
+
}
344
+
+13
nixos/2configs/minecraft.nix
+13
nixos/2configs/minecraft.nix
···
1
+
{ pkgs, ... }: let
2
+
3
+
unstable = import <nixpkgs-unstable> { config.allowUnfree = true; };
4
+
5
+
in {
6
+
services.minecraft-server = {
7
+
enable = true;
8
+
eula = true;
9
+
package = unstable.minecraft-server;
10
+
};
11
+
networking.firewall.allowedTCPPorts = [ 25565 ];
12
+
networking.firewall.allowedUDPPorts = [ 25565 ];
13
+
}
+11
nixos/2configs/minetest.nix
+11
nixos/2configs/minetest.nix
+20
nixos/2configs/mouse.nix
+20
nixos/2configs/mouse.nix
···
1
+
{ lib, ... }:
2
+
{
3
+
hardware.trackpoint = {
4
+
enable = true;
5
+
sensitivity = 220;
6
+
speed = 0;
7
+
emulateWheel = true;
8
+
};
9
+
10
+
services.xserver.libinput.enable = lib.mkForce false;
11
+
services.xserver.synaptics = {
12
+
enable = true;
13
+
horizEdgeScroll = false;
14
+
horizontalScroll = false;
15
+
vertEdgeScroll = false;
16
+
maxSpeed = "0.1";
17
+
minSpeed = "0.01";
18
+
tapButtons = false;
19
+
};
20
+
}
+103
nixos/2configs/mpv.nix
+103
nixos/2configs/mpv.nix
···
1
+
{ pkgs, lib, ... }:
2
+
3
+
let
4
+
dl_subs = pkgs.writers.writeDashBin "dl_subs" ''
5
+
filename=$1
6
+
${pkgs.subdl}/bin/subdl --output='/tmp/{m}.{M}.sub' "$filename" 1>&2
7
+
echo "/tmp/$(basename "$filename").sub"
8
+
'';
9
+
10
+
autosub = pkgs.writeText "autosub.lua" ''
11
+
-- Requires Subliminal version 1.0 or newer
12
+
-- Make sure to specify your system's Subliminal location below:
13
+
local utils = require 'mp.utils'
14
+
15
+
-- Log function: log to both terminal and mpv OSD (On-Screen Display)
16
+
function log(string, secs)
17
+
secs = secs or 2 -- secs defaults to 2 when the secs parameter is absent
18
+
mp.msg.warn(string) -- This logs to the terminal
19
+
mp.osd_message(string, secs) -- This logs to mpv screen
20
+
end
21
+
22
+
function download()
23
+
log('Searching subtitles ...', 10)
24
+
path = mp.get_property('path')
25
+
result = utils.subprocess({ args = {"${dl_subs}/bin/dl_subs", path} })
26
+
if result.error == nil then
27
+
filename = string.gsub(result.stdout, "\n", "")
28
+
log(filename)
29
+
mp.commandv('sub_add', filename)
30
+
log('Subtitles ready!')
31
+
else
32
+
log('Subtitles failed downloading')
33
+
end
34
+
end
35
+
36
+
-- Control function: only download if necessary
37
+
function control_download()
38
+
duration = tonumber(mp.get_property('duration'))
39
+
if duration < 900 then
40
+
mp.msg.warn('Video is less than 15 minutes\n', '=> NOT downloading any subtitles')
41
+
return
42
+
end
43
+
-- There does not seem to be any documentation for the 'sub' property,
44
+
-- but it works on both internally encoded as well as external subtitle files!
45
+
-- -> sub = '1' when subtitles are present
46
+
-- -> sub = 'no' when subtitles are not present
47
+
-- -> sub = 'auto' when called before the 'file-loaded' event is triggered
48
+
sub = mp.get_property('sub')
49
+
if sub == '1' then
50
+
mp.msg.warn('Sub track is already present\n', '=> NOT downloading other subtitles')
51
+
return
52
+
end
53
+
mp.msg.warn('No sub track was detected\n', '=> Proceeding to download subtitles:')
54
+
download()
55
+
end
56
+
57
+
mp.add_key_binding('S', "download_subs", download)
58
+
'';
59
+
60
+
mpvInput = pkgs.writeText "mpv.input" ''
61
+
: script-binding console/enable
62
+
x add audio-delay -0.050
63
+
X add audio-delay 0.050
64
+
'';
65
+
66
+
mpvConfig = pkgs.writeText "mpv.conf" ''
67
+
osd-font-size=20
68
+
'';
69
+
70
+
mpv = pkgs.symlinkJoin {
71
+
name = "mpv";
72
+
paths = [
73
+
(pkgs.writeDashBin "mpv" ''
74
+
set -efu
75
+
Y_RES=1081
76
+
# we need to disable sponsorblock local database because of
77
+
# https://github.com/po5/mpv_sponsorblock/issues/31
78
+
exec ${pkgs.mpv.override {
79
+
scripts = with pkgs.mpvScripts; [
80
+
sponsorblock
81
+
quality-menu
82
+
];
83
+
}}/bin/mpv \
84
+
--no-config \
85
+
--input-conf=${mpvInput} \
86
+
--include=${mpvConfig} \
87
+
--script=${autosub} \
88
+
--ytdl-format="best[height<$Y_RES]" \
89
+
--script-opts=ytdl_hook-ytdl_path=${pkgs.yt-dlp}/bin/yt-dlp \
90
+
--script-opts-append=sponsorblock-local_database=no \
91
+
--audio-channels=2 \
92
+
"$@"
93
+
'')
94
+
pkgs.mpv
95
+
];
96
+
};
97
+
98
+
in {
99
+
environment.systemPackages = [
100
+
mpv
101
+
dl_subs
102
+
];
103
+
}
+39
nixos/2configs/muchsync.nix
+39
nixos/2configs/muchsync.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
{
4
+
systemd.services.muchsync = let
5
+
hosts = [
6
+
"coaxmetal.r"
7
+
"mors.r"
8
+
"green.r"
9
+
];
10
+
in {
11
+
description = "sync mails";
12
+
environment = {
13
+
NOTMUCH_CONFIG = config.environment.variables.NOTMUCH_CONFIG;
14
+
};
15
+
after = [ "network.target" ];
16
+
17
+
restartIfChanged = false;
18
+
19
+
path = [
20
+
pkgs.notmuch
21
+
pkgs.openssh
22
+
];
23
+
24
+
startAt = "*:*"; # run every minute
25
+
serviceConfig = {
26
+
User = "lass";
27
+
Type = "oneshot";
28
+
ExecStart = pkgs.writeDash "sync-mails" ''
29
+
set -euf
30
+
31
+
/run/current-system/sw/bin/nm-tag-init 2>/dev/null
32
+
${concatMapStringsSep "\n" (host: ''
33
+
echo syncing ${host}:
34
+
${pkgs.muchsync}/bin/muchsync -s 'ssh -CTaxq -o ConnectTimeout=4' --nonew lass@${host} || :
35
+
'') hosts}
36
+
'';
37
+
};
38
+
};
39
+
}
+107
nixos/2configs/mumble-reminder.nix
+107
nixos/2configs/mumble-reminder.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
write_to_irc = chan: pkgs.writeDash "write_to_irc" ''
3
+
${pkgs.curl}/bin/curl -fsSv --unix-socket '${lib.removePrefix "unix:" config.krebs.reaktor2.mumble-reminder.API.listen}' http://z/ \
4
+
-H content-type:application/json \
5
+
-d "$(${pkgs.jq}/bin/jq -n \
6
+
--arg text "$1" '{
7
+
command:"PRIVMSG",
8
+
params:["${chan}",$text]
9
+
}'
10
+
)"
11
+
'';
12
+
animals = ''
13
+
Erdferkel
14
+
Paviane
15
+
Raupen
16
+
Australischen Wildhunde
17
+
Emus
18
+
Flundern
19
+
Gorillas
20
+
Kolibris
21
+
Schwarzfersenantilopen
22
+
Quallen
23
+
Kois
24
+
Faulaffen
25
+
Schraubenziegen
26
+
Nachtigallen
27
+
Okapis
28
+
Stachelschweine
29
+
Kurzschwanzkängurus
30
+
Waschbären
31
+
'';
32
+
systemPlugin = {
33
+
plugin = "system";
34
+
config = {
35
+
hooks.PRIVMSG = [
36
+
{
37
+
pattern = "^erriner mich$";
38
+
activate = "match";
39
+
command = {
40
+
filename = pkgs.writeDash "add_remind" ''
41
+
echo "$_from" >> /var/lib/reaktor2-mumble-reminder/users
42
+
sort /var/lib/reaktor2-mumble-reminder/users | uniq > /var/lib/reaktor2-mumble-reminder/users.tmp
43
+
mv /var/lib/reaktor2-mumble-reminder/users.tmp /var/lib/reaktor2-mumble-reminder/users
44
+
echo "Ich werde $_from in zukunft an das meetup errinern"
45
+
'';
46
+
};
47
+
}
48
+
{
49
+
pattern = "^nerv nicht$";
50
+
activate = "match";
51
+
command = {
52
+
filename = pkgs.writeDash "del_remind" ''
53
+
${pkgs.gnused}/bin/sed -i "/$_from/d" /var/lib/reaktor2-mumble-reminder/users
54
+
echo "okok, Ich werde $_from nich mehr errinern"
55
+
'';
56
+
};
57
+
}
58
+
];
59
+
};
60
+
};
61
+
62
+
in {
63
+
krebs.reaktor2.mumble-reminder = {
64
+
hostname = "irc.hackint.org";
65
+
nick = "lassulus__";
66
+
API.listen = "unix:/var/lib/reaktor2-mumble-reminder/reaktor_hackint.sock";
67
+
plugins = [
68
+
{
69
+
plugin = "register";
70
+
config = {
71
+
channels = [
72
+
"#krebs"
73
+
"#nixos"
74
+
];
75
+
};
76
+
}
77
+
systemPlugin
78
+
];
79
+
port = "6697";
80
+
};
81
+
systemd.services.mumble-reminder-nixos = {
82
+
description = "weekly reminder for nixos mumble";
83
+
startAt = "Wed *-*-* 19:00:00 Europe/Berlin";
84
+
serviceConfig = {
85
+
ExecStart = pkgs.writers.writeDash "mumble_reminder" ''
86
+
animals='
87
+
${animals}
88
+
'
89
+
${write_to_irc "#nixos"} "Es ist Mittwoch meine $(echo "$animals" | grep -v '^$' | shuf -n1 )!"
90
+
${write_to_irc "#nixos"} "kommt auf mumble://lassul.us"
91
+
'';
92
+
};
93
+
};
94
+
systemd.services.mumble-reminder-krebs = {
95
+
description = "weekly reminder for nixos mumble";
96
+
startAt = "Wed *-*-* 19:00:00 Europe/Berlin";
97
+
serviceConfig = {
98
+
ExecStart = pkgs.writers.writeDash "mumble_reminder" ''
99
+
animals='
100
+
${animals}
101
+
'
102
+
${write_to_irc "#krebs"} "Es ist Mittwoch meine $(echo "$animals" | grep -v '^$' | shuf -n1 )!"
103
+
${write_to_irc "#krebs"} "$(cat /var/lib/reaktor2-mumble-reminder/users | ${pkgs.findutils}/bin/xargs echo) : mumble?"
104
+
'';
105
+
};
106
+
};
107
+
}
+37
nixos/2configs/murmur.nix
+37
nixos/2configs/murmur.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
services.murmur = {
4
+
enable = true;
5
+
allowHtml = false;
6
+
bandwidth = 10000000;
7
+
registerName = "lassul.us";
8
+
autobanTime = 30;
9
+
};
10
+
krebs.iptables.tables.filter.INPUT.rules = [
11
+
{ predicate = "-p tcp --dport 64738"; target = "ACCEPT";}
12
+
{ predicate = "-p udp --dport 64738"; target = "ACCEPT";}
13
+
];
14
+
15
+
systemd.services.docker-mumble-web.serviceConfig = {
16
+
StandardOutput = lib.mkForce "journal";
17
+
StandardError = lib.mkForce "journal";
18
+
};
19
+
virtualisation.oci-containers.containers.mumble-web = {
20
+
image = "rankenstein/mumble-web:0.5";
21
+
environment = {
22
+
MUMBLE_SERVER = "lassul.us:64738";
23
+
};
24
+
ports = [
25
+
"64739:8080"
26
+
];
27
+
};
28
+
29
+
services.nginx.virtualHosts."mumble.lassul.us" = {
30
+
enableACME = true;
31
+
forceSSL = true;
32
+
locations."/" = {
33
+
proxyPass = "http://localhost:64739";
34
+
proxyWebsockets = true;
35
+
};
36
+
};
37
+
}
+25
nixos/2configs/network-manager.nix
+25
nixos/2configs/network-manager.nix
···
1
+
{ pkgs, lib, ... }:
2
+
{
3
+
networking.wireless.enable = lib.mkForce false;
4
+
5
+
networking.networkmanager = {
6
+
ethernet.macAddress = "random";
7
+
wifi.macAddress = "random";
8
+
enable = true;
9
+
unmanaged = [
10
+
"docker*"
11
+
"vboxnet*"
12
+
];
13
+
};
14
+
systemd.services.NetworkManager-wait-online.enable = false;
15
+
users.users.mainUser = {
16
+
extraGroups = [ "networkmanager" ];
17
+
packages = with pkgs; [
18
+
gnome.gnome-keyring
19
+
dconf
20
+
];
21
+
};
22
+
environment.systemPackages = [
23
+
pkgs.nm-dmenu
24
+
];
25
+
}
+20
nixos/2configs/networkd.nix
+20
nixos/2configs/networkd.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
4
+
systemd.services.systemd-networkd.stopIfChanged = false;
5
+
# Services that are only restarted might be not able to resolve when resolved is stopped before
6
+
systemd.services.systemd-resolved.stopIfChanged = false;
7
+
8
+
networking.useNetworkd = true;
9
+
systemd.network = {
10
+
enable = true;
11
+
networks.wl0 = {
12
+
matchConfig.Name = "wl0";
13
+
DHCP = "yes";
14
+
networkConfig = {
15
+
IgnoreCarrierLoss = "3s";
16
+
};
17
+
dhcpV4Config.UseDNS = true;
18
+
};
19
+
};
20
+
}
+22
nixos/2configs/nfs-dl.nix
+22
nixos/2configs/nfs-dl.nix
···
1
+
{
2
+
fileSystems."/mnt/prism" = {
3
+
device = "prism.w:/export/download";
4
+
fsType = "nfs";
5
+
options = [
6
+
#"timeo=14"
7
+
"noauto"
8
+
"noatime"
9
+
"nodiratime"
10
+
#"noac"
11
+
#"nocto"
12
+
"x-systemd.automount"
13
+
"x-systemd.device-timeout=1"
14
+
"x-systemd.idle-timeout=1min"
15
+
"x-systemd.requires=retiolum.service"
16
+
"user"
17
+
"_netdev"
18
+
"soft"
19
+
];
20
+
};
21
+
}
22
+
+19
nixos/2configs/orange-host.nix
+19
nixos/2configs/orange-host.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
krebs.sync-containers3.containers.orange = {
4
+
sshKey = "${config.krebs.secret.directory}/orange.sync.key";
5
+
};
6
+
containers.orange.bindMounts."/var/lib" = {
7
+
hostPath = "/var/lib/sync-containers3/orange/state";
8
+
isReadOnly = false;
9
+
};
10
+
services.nginx.virtualHosts."lassul.us" = {
11
+
# enableACME = config.security;
12
+
# forceSSL = true;
13
+
locations."/" = {
14
+
recommendedProxySettings = true;
15
+
proxyWebsockets = true;
16
+
proxyPass = "http://orange.r";
17
+
};
18
+
};
19
+
}
+18
nixos/2configs/otp-ssh.nix
+18
nixos/2configs/otp-ssh.nix
···
1
+
{ pkgs, ... }:
2
+
# Enables second factor for ssh password login
3
+
4
+
## Usage:
5
+
# gen-oath-safe <username> totp
6
+
## scan the qrcode with google authenticator (or FreeOTP)
7
+
## copy last line into secrets/<host>/users.oath (chmod 700)
8
+
{
9
+
security.pam.oath = {
10
+
# enabling it will make it a requisite of `all` services
11
+
# enable = true;
12
+
digits = 6;
13
+
# TODO assert existing
14
+
usersFile = "${config.krebs.secret.directory}/users.oath";
15
+
};
16
+
# I want TFA only active for sshd with password-auth
17
+
security.pam.services.sshd.oathAuth = true;
18
+
}
+21
nixos/2configs/pass.nix
+21
nixos/2configs/pass.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
{
4
+
users.users.mainUser.packages = with pkgs; [
5
+
(pass.withExtensions (ext: [ ext.pass-otp ]))
6
+
gnupg
7
+
(pkgs.writers.writeDashBin "unlock" ''
8
+
set -efu
9
+
HOST=$1
10
+
11
+
pw=$(pass show "admin/$HOST/luks")
12
+
torify sshn root@$(pass "hosts/$HOST/initrd/hostname") "echo $pw > /crypt-ramfs/passphrase"
13
+
'')
14
+
];
15
+
16
+
programs.gnupg.agent.enable = true;
17
+
systemd.tmpfiles.rules = [
18
+
"L+ /home/lass/.password-store - - - - sync/pwstore"
19
+
];
20
+
21
+
}
+145
nixos/2configs/paste.nix
+145
nixos/2configs/paste.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
{
4
+
services.nginx.virtualHosts.cyberlocker = {
5
+
serverAliases = [ "c.r" ];
6
+
locations."/".extraConfig = ''
7
+
client_max_body_size 4G;
8
+
proxy_set_header Host $host;
9
+
proxy_pass http://127.0.0.1:${toString config.krebs.htgen.cyberlocker.port};
10
+
'';
11
+
extraConfig = ''
12
+
add_header Access-Control-Allow-Origin * always;
13
+
add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
14
+
'';
15
+
};
16
+
services.nginx.virtualHosts.paste = {
17
+
serverAliases = [ "p.r" ];
18
+
locations."/".extraConfig = ''
19
+
client_max_body_size 4G;
20
+
proxy_set_header Host $host;
21
+
proxy_pass http://127.0.0.1:${toString config.krebs.htgen.paste.port};
22
+
'';
23
+
locations."/image".extraConfig = /* nginx */ ''
24
+
client_max_body_size 40M;
25
+
26
+
proxy_set_header Host $host;
27
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
28
+
proxy_set_header X-Forwarded-Proto $scheme;
29
+
30
+
proxy_pass http://127.0.0.1:${toString config.krebs.htgen.imgur.port};
31
+
proxy_pass_header Server;
32
+
'';
33
+
extraConfig = ''
34
+
add_header 'Access-Control-Allow-Origin' '*';
35
+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
36
+
'';
37
+
};
38
+
services.nginx.virtualHosts."c.krebsco.de" = {
39
+
enableACME = true;
40
+
addSSL = true;
41
+
serverAliases = [ "c.krebsco.de" ];
42
+
locations."/".extraConfig = ''
43
+
if ($request_method != GET) {
44
+
return 403;
45
+
}
46
+
proxy_set_header Host $host;
47
+
proxy_pass http://127.0.0.1:${toString config.krebs.htgen.cyberlocker.port};
48
+
'';
49
+
extraConfig = ''
50
+
add_header Access-Control-Allow-Origin * always;
51
+
add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
52
+
'';
53
+
};
54
+
services.nginx.virtualHosts."p.krebsco.de" = {
55
+
enableACME = true;
56
+
addSSL = true;
57
+
serverAliases = [ "p.krebsco.de" ];
58
+
locations."/".extraConfig = ''
59
+
if ($request_method = 'OPTIONS') {
60
+
return 204;
61
+
}
62
+
client_max_body_size 4G;
63
+
proxy_set_header Host $host;
64
+
proxy_set_header X-Forwarded-Proto $scheme;
65
+
proxy_pass http://127.0.0.1:${toString config.krebs.htgen.paste.port};
66
+
'';
67
+
locations."/form".extraConfig = ''
68
+
client_max_body_size 4G;
69
+
proxy_set_header Host $host;
70
+
proxy_pass http://127.0.0.1:${toString config.krebs.htgen.paste-form.port};
71
+
'';
72
+
locations."/image".extraConfig = ''
73
+
proxy_set_header Host $host;
74
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
75
+
proxy_set_header X-Forwarded-Proto $scheme;
76
+
77
+
proxy_pass http://127.0.0.1:${toString config.krebs.htgen.imgur.port};
78
+
proxy_pass_header Server;
79
+
'';
80
+
extraConfig = ''
81
+
add_header Access-Control-Allow-Headers Authorization always;
82
+
add_header Access-Control-Allow-Origin * always;
83
+
add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
84
+
'';
85
+
};
86
+
87
+
krebs.htgen.paste = {
88
+
port = 9081;
89
+
script = /* sh */ ''
90
+
(. ${pkgs.htgen-paste}/bin/htgen-paste)
91
+
'';
92
+
};
93
+
94
+
systemd.services.paste-gc = {
95
+
startAt = "daily";
96
+
serviceConfig = {
97
+
ExecStart = ''
98
+
${pkgs.findutils}/bin/find /var/lib/htgen-paste/items -type f -mtime '+30' -exec rm {} \;
99
+
'';
100
+
User = "htgen-paste";
101
+
};
102
+
};
103
+
104
+
krebs.htgen.paste-form = {
105
+
port = 7770;
106
+
script = /* sh */ ''
107
+
export PATH=${makeBinPath [
108
+
pkgs.curl
109
+
pkgs.gnused
110
+
]}:$PATH
111
+
(. ${pkgs.writeScript "paste-form" ''
112
+
case "$Method" in
113
+
'POST')
114
+
ref=$(head -c $req_content_length | sed '0,/^\r$/d;$d' | curl -fSs --data-binary @- https://p.krebsco.de | sed '1d;s/^http:/https:/')
115
+
116
+
printf 'HTTP/1.1 200 OK\r\n'
117
+
printf 'Content-Type: text/plain; charset=UTF-8\r\n'
118
+
printf 'Server: %s\r\n' "$Server"
119
+
printf 'Connection: close\r\n'
120
+
printf 'Content-Length: %d\r\n' $(expr ''${#ref} + 1)
121
+
printf '\r\n'
122
+
printf '%s\n' "$ref"
123
+
124
+
exit
125
+
;;
126
+
esac
127
+
''})
128
+
'';
129
+
};
130
+
krebs.htgen.imgur = {
131
+
port = 7771;
132
+
script = /* sh */ ''
133
+
(. ${pkgs.htgen-imgur}/bin/htgen-imgur)
134
+
'';
135
+
};
136
+
krebs.htgen.cyberlocker = {
137
+
port = 7772;
138
+
script = /* sh */ ''
139
+
(. ${pkgs.htgen-cyberlocker}/bin/htgen-cyberlocker)
140
+
'';
141
+
};
142
+
krebs.iptables.tables.filter.INPUT.rules = [
143
+
{ predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT";}
144
+
];
145
+
}
+35
nixos/2configs/pipewire.nix
+35
nixos/2configs/pipewire.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
# TODO test `alsactl init` after suspend to reinit mic
3
+
{
4
+
security.rtkit.enable = true;
5
+
6
+
hardware.bluetooth = {
7
+
enable = true;
8
+
powerOnBoot = true;
9
+
};
10
+
11
+
environment.systemPackages = with pkgs; [
12
+
alsa-utils
13
+
pulseaudio
14
+
ponymix
15
+
];
16
+
17
+
services.pipewire = {
18
+
enable = true;
19
+
systemWide = true;
20
+
alsa.enable = true;
21
+
alsa.support32Bit = true;
22
+
pulse.enable = true;
23
+
jack.enable = true;
24
+
};
25
+
environment.etc = {
26
+
"wireplumber/bluetooth.lua.d/51-bluez-config.lua".text = ''
27
+
bluez_monitor.properties = {
28
+
["bluez5.enable-sbc-xq"] = true,
29
+
["bluez5.enable-msbc"] = true,
30
+
["bluez5.enable-hw-volume"] = true,
31
+
["bluez5.headset-roles"] = "[ hsp_hs hsp_ag hfp_hf hfp_ag ]"
32
+
}
33
+
'';
34
+
};
35
+
}
+45
nixos/2configs/power-action.nix
+45
nixos/2configs/power-action.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
let
4
+
suspend = pkgs.writers.writeDash "suspend" ''
5
+
${pkgs.systemd}/bin/systemctl suspend
6
+
'';
7
+
8
+
speak = text:
9
+
pkgs.writers.writeDash "speak" ''
10
+
${pkgs.espeak}/bin/espeak -v +whisper -s 110 "${text}"
11
+
'';
12
+
13
+
in {
14
+
krebs.power-action = {
15
+
enable = true;
16
+
plans.low-battery = {
17
+
upperLimit = 10;
18
+
lowerLimit = 15;
19
+
charging = false;
20
+
action = pkgs.writers.writeDash "warn-low-battery" ''
21
+
${speak "power level low"}
22
+
'';
23
+
};
24
+
plans.suspend = {
25
+
upperLimit = 10;
26
+
lowerLimit = 0;
27
+
charging = false;
28
+
action = pkgs.writers.writeDash "suspend-wrapper" ''
29
+
/run/wrappers/bin/sudo ${suspend}
30
+
'';
31
+
};
32
+
user = "lass";
33
+
};
34
+
35
+
users.users.power-action = {
36
+
isNormalUser = true;
37
+
extraGroups = [
38
+
"audio"
39
+
];
40
+
};
41
+
42
+
security.sudo.extraConfig = ''
43
+
${config.krebs.power-action.user} ALL= (root) NOPASSWD: ${suspend}
44
+
'';
45
+
}
+19
nixos/2configs/print.nix
+19
nixos/2configs/print.nix
···
1
+
{ pkgs, ... }:
2
+
{
3
+
services.printing = {
4
+
enable = true;
5
+
drivers = [
6
+
pkgs.foomatic-filters
7
+
pkgs.gutenprint
8
+
];
9
+
browsing = true;
10
+
browsedConf = ''
11
+
BrowseDNSSDSubTypes _cups,_print
12
+
BrowseLocalProtocols all
13
+
BrowseRemoteProtocols all
14
+
CreateIPPPrinterQueues All
15
+
16
+
BrowseProtocols all
17
+
'';
18
+
};
19
+
}
+21
nixos/2configs/privoxy-retiolum.nix
+21
nixos/2configs/privoxy-retiolum.nix
···
1
+
{ config, lib, ... }:
2
+
3
+
let
4
+
r_ip = config.krebs.build.host.nets.retiolum.ip4.addr;
5
+
6
+
in {
7
+
imports = [
8
+
./privoxy.nix
9
+
];
10
+
11
+
services.privoxy.listenAddress = "${r_ip}:8118";
12
+
13
+
krebs.iptables = {
14
+
tables = {
15
+
filter.INPUT.rules = [
16
+
{ predicate = "-i retiolum -p tcp --dport 8118"; target = "ACCEPT"; }
17
+
{ predicate = "-i dns0 -p tcp --dport 8118"; target = "ACCEPT"; }
18
+
];
19
+
};
20
+
};
21
+
}
+7
nixos/2configs/privoxy.nix
+7
nixos/2configs/privoxy.nix
+54
nixos/2configs/programs.nix
+54
nixos/2configs/programs.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
## TODO sort and split up
4
+
{
5
+
environment.systemPackages = with pkgs; [
6
+
aria2
7
+
generate-secrets
8
+
gnupg1compat
9
+
htop
10
+
i3lock
11
+
l-gen-secrets
12
+
mosh
13
+
pass
14
+
pavucontrol
15
+
pv
16
+
pwgen
17
+
remmina
18
+
ripgrep
19
+
silver-searcher
20
+
transmission
21
+
wget
22
+
xsel
23
+
yt-dlp
24
+
(pkgs.writeDashBin "youtube-dl" ''
25
+
exec ${pkgs.yt-dlp}/bin/yt-dlp "$@"
26
+
'')
27
+
(pkgs.writeDashBin "tether-on" ''
28
+
adb shell svc usb setFunctions rndis
29
+
'')
30
+
(pkgs.writeDashBin "tether-off" ''
31
+
adb shell svc usb setFunctions
32
+
'')
33
+
(pkgs.writeDashBin "deploy" ''
34
+
set -eu
35
+
export SYSTEM="$1"
36
+
$(nix-build $HOME/sync/stockholm/lass/krops.nix --no-out-link --argstr name "$SYSTEM" -A deploy)
37
+
'')
38
+
(pkgs.writeDashBin "lassul.us" ''
39
+
TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d)
40
+
${pkgs.pass}/bin/pass show admin/ovh/api.config > "$TMPDIR"/ovh-secrets.json
41
+
OVH_ZONE_CONFIG="$TMPDIR"/ovh-secrets.json ${pkgs.ovh-zone}/bin/ovh-zone import /etc/zones/lassul.us lassul.us
42
+
${pkgs.coreutils}/bin/rm -rf "$TMPDIR"
43
+
'')
44
+
(pkgs.writeDashBin "btc-coinbase" ''
45
+
${pkgs.curl}/bin/curl -Ss 'https://api.coinbase.com/v2/prices/spot?currency=EUR' | ${pkgs.jq}/bin/jq '.data.amount'
46
+
'')
47
+
(pkgs.writeDashBin "btc-wex" ''
48
+
${pkgs.curl}/bin/curl -Ss 'https://wex.nz/api/3/ticker/btc_eur' | ${pkgs.jq}/bin/jq '.btc_eur.avg'
49
+
'')
50
+
(pkgs.writeDashBin "btc-kraken" ''
51
+
${pkgs.curl}/bin/curl -Ss 'https://api.kraken.com/0/public/Ticker?pair=BTCEUR' | ${pkgs.jq}/bin/jq '.result.XXBTZEUR.a[0]'
52
+
'')
53
+
];
54
+
}
+25
nixos/2configs/radicale.nix
+25
nixos/2configs/radicale.nix
···
1
+
{ ... }:
2
+
3
+
{
4
+
services.radicale = {
5
+
enable = true;
6
+
config = ''
7
+
[server]
8
+
hosts = 0.0.0.0:5555
9
+
[auth]
10
+
type = htpasswd
11
+
htpasswd_filename = ${<secrets/radicale.htpasswd>}
12
+
htpasswd_encryption = plain
13
+
'';
14
+
};
15
+
krebs.iptables.tables.filter.INPUT.rules = [
16
+
{ predicate = "-i retiolum -p tcp --dport 5555"; target = "ACCEPT"; }
17
+
{ predicate = "-i wiregrill -p tcp --dport 5555"; target = "ACCEPT"; }
18
+
];
19
+
#services.nginx.virtualHosts."lassul.us".locations."/radicale/".extraConfig = ''
20
+
# proxy_pass http://localhost:5555/; # The / is important!
21
+
# proxy_set_header X-Script-Name /radicale;
22
+
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
23
+
# proxy_pass_header Authorization;
24
+
#'';
25
+
}
+55
nixos/2configs/reaktor-coders.nix
+55
nixos/2configs/reaktor-coders.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
let
4
+
hooks = pkgs.reaktor2-plugins.hooks;
5
+
in {
6
+
krebs.reaktor2.coders = {
7
+
hostname = "irc.hackint.org";
8
+
port = "9999";
9
+
useTLS = true;
10
+
nick = "reaktor2|lass";
11
+
plugins = [
12
+
{
13
+
plugin = "register";
14
+
config = {
15
+
channels = [
16
+
"#coders"
17
+
"#germany"
18
+
"#panthermoderns"
19
+
];
20
+
};
21
+
}
22
+
{
23
+
plugin = "system";
24
+
config = {
25
+
workdir = config.krebs.reaktor2.coders.stateDir;
26
+
hooks.PRIVMSG = [
27
+
hooks.sed
28
+
hooks.url-title
29
+
{
30
+
activate = "match";
31
+
pattern = ''^!([^ ]+)(?:\s*(.*))?'';
32
+
command = 1;
33
+
arguments = [2];
34
+
commands = {
35
+
ping.filename = pkgs.writeDash "ping" ''
36
+
exec /run/wrappers/bin/ping -q -c1 "$1" 2>&1 | tail -1
37
+
'';
38
+
google.filename = pkgs.writeDash "google" ''
39
+
exec ${pkgs.ddgr}/bin/ddgr -C -n1 --json "$@" | \
40
+
${pkgs.jq}/bin/jq '@text "\(.[0].abstract) \(.[0].url)"'
41
+
'';
42
+
shrug.filename = pkgs.writeDash "shrug" ''
43
+
exec echo '¯\_(ツ)_/¯'
44
+
'';
45
+
table.filename = pkgs.writeDash "table" ''
46
+
exec echo '(╯°□°）╯ ┻━┻'
47
+
'';
48
+
};
49
+
}
50
+
];
51
+
};
52
+
}
53
+
];
54
+
};
55
+
}
+52
nixos/2configs/realwallpaper.nix
+52
nixos/2configs/realwallpaper.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
let
4
+
hostname = config.krebs.build.host.name;
5
+
inherit (lib)
6
+
nameValuePair
7
+
;
8
+
9
+
in {
10
+
krebs.realwallpaper.enable = true;
11
+
12
+
system.activationScripts.wallpaper-chmod = ''
13
+
${pkgs.coreutils}/bin/chmod +rx /var/realwallpaper
14
+
'';
15
+
services.nginx.virtualHosts.wallpaper = {
16
+
extraConfig = ''
17
+
if ( $server_addr = "${config.krebs.build.host.nets.internet.ip4.addr}" ) {
18
+
return 403;
19
+
}
20
+
'';
21
+
serverAliases = [
22
+
"wallpaper.r"
23
+
];
24
+
locations."/".extraConfig = ''
25
+
autoindex on;
26
+
root /var/realwallpaper/;
27
+
'';
28
+
locations."/realwallpaper.png".extraConfig = ''
29
+
root /var/realwallpaper/;
30
+
'';
31
+
locations."/realwallpaper-krebs.png".extraConfig = ''
32
+
root /var/realwallpaper/;
33
+
'';
34
+
locations."/realwallpaper-krebs-stars.png".extraConfig = ''
35
+
root /var/realwallpaper/;
36
+
'';
37
+
locations."/realwallpaper-krebs-stars-berlin.png".extraConfig = ''
38
+
root /var/realwallpaper/;
39
+
'';
40
+
locations."/realwallpaper-video.mp4".extraConfig = ''
41
+
root /var/realwallpaper/archive;
42
+
'';
43
+
};
44
+
45
+
krebs.iptables = {
46
+
tables = {
47
+
filter.INPUT.rules = [
48
+
{ predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; }
49
+
];
50
+
};
51
+
};
52
+
}
+17
nixos/2configs/rebuild-on-boot.nix
+17
nixos/2configs/rebuild-on-boot.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
systemd.services.rebuild-on-boot = {
4
+
wantedBy = [ "multi-user.target" ];
5
+
environment = {
6
+
NIX_REMOTE = "daemon";
7
+
HOME = "/var/empty";
8
+
};
9
+
serviceConfig = {
10
+
ExecStart = pkgs.writeScript "rebuild" ''
11
+
#!${pkgs.bash}/bin/bash
12
+
(/run/current-system/sw/bin/nixos-rebuild -I /var/src switch) &
13
+
'';
14
+
ExecStop = "${pkgs.coreutils}/bin/sleep 10";
15
+
};
16
+
};
17
+
}
+163
nixos/2configs/red-host.nix
+163
nixos/2configs/red-host.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
ctr.name = "red";
4
+
in
5
+
{
6
+
7
+
krebs.sync-containers3.containers.red = {
8
+
sshKey = "${config.krebs.secret.directory}/containers/red/sync.key";
9
+
ephemeral = true;
10
+
};
11
+
12
+
# containers.${ctr.name} = {
13
+
# config = {
14
+
# environment.systemPackages = [
15
+
# pkgs.dhcpcd
16
+
# pkgs.git
17
+
# pkgs.jq
18
+
# ];
19
+
# networking.useDHCP = lib.mkForce true;
20
+
# systemd.services.autoswitch = {
21
+
# environment = {
22
+
# NIX_REMOTE = "daemon";
23
+
# };
24
+
# wantedBy = [ "multi-user.target" ];
25
+
# serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" ''
26
+
# if test -e /var/src/nixos-config; then
27
+
# /run/current-system/sw/bin/nixos-rebuild -I /var/src switch || :
28
+
# fi
29
+
# '';
30
+
# unitConfig.X-StopOnRemoval = false;
31
+
# };
32
+
# };
33
+
# autoStart = false;
34
+
# enableTun = true;
35
+
# privateNetwork = true;
36
+
# hostBridge = "ctr0";
37
+
# bindMounts = {
38
+
# "/etc/resolv.conf".hostPath = "/etc/resolv.conf";
39
+
# "/var/lib/self-state/disk-image" = {
40
+
# hostPath = "/var/lib/sync-containers3/${ctr.name}";
41
+
# isReadOnly = true;
42
+
# };
43
+
# };
44
+
# };
45
+
46
+
# systemd.services."${ctr.name}_scheduler" = {
47
+
# wantedBy = [ "multi-user.target" ];
48
+
# path = with pkgs; [
49
+
# coreutils
50
+
# consul
51
+
# cryptsetup
52
+
# mount
53
+
# util-linux
54
+
# systemd
55
+
# untilport
56
+
# ];
57
+
# serviceConfig = {
58
+
# Restart = "always";
59
+
# RestartSec = "15s";
60
+
# ExecStart = "${pkgs.consul}/bin/consul lock container_${ctr.name} ${pkgs.writers.writeDash "${ctr.name}-start" ''
61
+
# set -efux
62
+
# trap ${pkgs.writers.writeDash "stop-${ctr.name}" ''
63
+
# set -efux
64
+
# /run/current-system/sw/bin/nixos-container stop ${ctr.name} || :
65
+
# umount /var/lib/nixos-containers/${ctr.name}/var/state || :
66
+
# cryptsetup luksClose ${ctr.name} || :
67
+
# ''} INT TERM EXIT
68
+
# consul kv put containers/${ctr.name}/host ${config.networking.hostName}
69
+
# cryptsetup luksOpen --key-file /var/src/secrets/containers/${ctr.name}/luks /var/lib/sync-containers3/${ctr.name}/disk ${ctr.name}
70
+
# mkdir -p /var/lib/nixos-containers/${ctr.name}/var/state
71
+
# mount /dev/mapper/${ctr.name} /var/lib/nixos-containers/${ctr.name}/var/state
72
+
# ln -frs /var/lib/nixos-containers/${ctr.name}/var/state/var_src /var/lib/nixos-containers/${ctr.name}/var/src
73
+
# /run/current-system/sw/bin/nixos-container start ${ctr.name}
74
+
# set +x
75
+
# until /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null; do sleep 5; done
76
+
# while /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null; do sleep 5; done
77
+
# ''}";
78
+
# };
79
+
# };
80
+
81
+
# users.groups."container_${ctr.name}" = {};
82
+
# users.users."container_${ctr.name}" = {
83
+
# group = "container_${ctr.name}";
84
+
# isSystemUser = true;
85
+
# home = "/var/lib/sync-containers3/${ctr.name}";
86
+
# createHome = true;
87
+
# homeMode = "705";
88
+
# openssh.authorizedKeys.keys = [
89
+
# config.krebs.users.lass.pubkey
90
+
# ];
91
+
# };
92
+
93
+
# systemd.timers."${ctr.name}_syncer" = {
94
+
# timerConfig = {
95
+
# RandomizedDelaySec = 300;
96
+
# };
97
+
# };
98
+
# systemd.services."${ctr.name}_syncer" = {
99
+
# path = with pkgs; [
100
+
# coreutils
101
+
# rsync
102
+
# openssh
103
+
# systemd
104
+
# ];
105
+
# startAt = "*:0/1";
106
+
# serviceConfig = {
107
+
# User = "container_${ctr.name}";
108
+
# LoadCredential = [
109
+
# "ssh_key:${toString <secrets>}/containers/${ctr.name}/sync.key"
110
+
# ];
111
+
# ExecCondition = pkgs.writers.writeDash "${ctr.name}_checker" ''
112
+
# set -efu
113
+
# ! systemctl is-active --quiet container@${ctr.name}.service
114
+
# '';
115
+
# ExecStart = pkgs.writers.writeDash "${ctr.name}_syncer" ''
116
+
# set -efu
117
+
# rsync -a -e "ssh -i $CREDENTIALS_DIRECTORY/ssh_key" --inplace container_sync@${ctr.name}.r:disk-image/disk $HOME/disk
118
+
# '';
119
+
# };
120
+
# };
121
+
122
+
# # networking
123
+
# networking.networkmanager.unmanaged = [ "ctr0" ];
124
+
# networking.interfaces.dummy0.virtual = true;
125
+
# networking.bridges.ctr0.interfaces = [ "dummy0" ];
126
+
# networking.interfaces.ctr0.ipv4.addresses = [{
127
+
# address = "10.233.0.1";
128
+
# prefixLength = 24;
129
+
# }];
130
+
# systemd.services."dhcpd-ctr0" = {
131
+
# wantedBy = [ "multi-user.target" ];
132
+
# after = [ "network.target" ];
133
+
# serviceConfig = {
134
+
# Type = "forking";
135
+
# Restart = "always";
136
+
# DynamicUser = true;
137
+
# StateDirectory = "dhcpd-ctr0";
138
+
# User = "dhcpd-ctr0";
139
+
# Group = "dhcpd-ctr0";
140
+
# AmbientCapabilities = [
141
+
# "CAP_NET_RAW" # to send ICMP messages
142
+
# "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67)
143
+
# ];
144
+
# ExecStartPre = "${pkgs.coreutils}/bin/touch /var/lib/dhcpd-ctr0/dhcpd.leases";
145
+
# ExecStart = "${pkgs.dhcp}/bin/dhcpd -4 -lf /var/lib/dhcpd-ctr0/dhcpd.leases -cf ${pkgs.writeText "dhpd.conf" ''
146
+
# default-lease-time 600;
147
+
# max-lease-time 7200;
148
+
# authoritative;
149
+
# ddns-update-style interim;
150
+
# log-facility local1; # see dhcpd.nix
151
+
152
+
# option subnet-mask 255.255.255.0;
153
+
# option routers 10.233.0.1;
154
+
# # option domain-name-servers 8.8.8.8; # TODO configure dns server
155
+
# subnet 10.233.0.0 netmask 255.255.255.0 {
156
+
# range 10.233.0.10 10.233.0.250;
157
+
# }
158
+
# ''} ctr0";
159
+
# };
160
+
# };
161
+
162
+
}
163
+
+8
nixos/2configs/redis.nix
+8
nixos/2configs/redis.nix
+57
nixos/2configs/retiolum.nix
+57
nixos/2configs/retiolum.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
5
+
krebs.iptables = {
6
+
tables = {
7
+
filter.INPUT.rules = let
8
+
tincport = toString config.krebs.build.host.nets.retiolum.tinc.port;
9
+
in [
10
+
{ predicate = "-p tcp --dport ${tincport}"; target = "ACCEPT"; }
11
+
{ predicate = "-p udp --dport ${tincport}"; target = "ACCEPT"; }
12
+
];
13
+
};
14
+
};
15
+
16
+
krebs.tinc.retiolum = {
17
+
enable = true;
18
+
connectTo = [
19
+
"prism"
20
+
"ni"
21
+
"eve"
22
+
];
23
+
extraConfig = ''
24
+
AutoConnect = no
25
+
${lib.optionalString (config.krebs.build.host.nets.retiolum.via != null) ''
26
+
LocalDiscovery = no
27
+
''}
28
+
'';
29
+
tincUp = lib.mkIf config.systemd.network.enable "";
30
+
privkey = "${config.krebs.secret.directory}/retiolum.rsa_key.priv";
31
+
privkey_ed25519 = "${config.krebs.secret.directory}/retiolum.ed25519_key.priv";
32
+
};
33
+
34
+
systemd.network.networks.retiolum = {
35
+
matchConfig.Name = "retiolum";
36
+
address = [
37
+
"${config.krebs.build.host.nets.retiolum.ip4.addr}/16"
38
+
"${config.krebs.build.host.nets.retiolum.ip6.addr}/16"
39
+
];
40
+
linkConfig = {
41
+
MTUBytes = "1377";
42
+
RequiredForOnline = "no";
43
+
};
44
+
networkConfig = {
45
+
IgnoreCarrierLoss = "10s";
46
+
LinkLocalAddressing = "no";
47
+
};
48
+
};
49
+
50
+
nixpkgs.config.packageOverrides = pkgs: {
51
+
tinc = pkgs.tinc_pre;
52
+
};
53
+
54
+
environment.systemPackages = [
55
+
pkgs.tinc
56
+
];
57
+
}
+14
nixos/2configs/review.nix
+14
nixos/2configs/review.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
let
4
+
mainUser = config.users.extraUsers.mainUser;
5
+
in {
6
+
7
+
users.users.review = {
8
+
isNormalUser = true;
9
+
packages = [ pkgs.nixpkgs-review ];
10
+
};
11
+
security.sudo.extraConfig = ''
12
+
${mainUser.name} ALL=(review) NOPASSWD: ALL
13
+
'';
14
+
}
+87
nixos/2configs/riot.nix
+87
nixos/2configs/riot.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
domains = [
3
+
"hackerfleet.eu"
4
+
"hackerfleet.de"
5
+
];
6
+
in {
7
+
containers.riot = {
8
+
config = {
9
+
environment.systemPackages = [
10
+
pkgs.git
11
+
pkgs.jq
12
+
];
13
+
services.openssh.enable = true;
14
+
users.users.root.openssh.authorizedKeys.keys = [
15
+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
16
+
];
17
+
networking.defaultGateway = "10.233.1.1";
18
+
systemd.services.autoswitch = {
19
+
environment = {
20
+
NIX_REMOTE = "daemon";
21
+
};
22
+
wantedBy = [ "multi-user.target" ];
23
+
serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" ''
24
+
set -efu
25
+
if test -e /etc/nixos/configuration.nix; then
26
+
/run/current-system/sw/bin/nixos-rebuild switch \
27
+
-I nixpkgs=channel:$(cat /etc/nixos/channel) \
28
+
-I nixos-config=/etc/nixos/configuration.nix \
29
+
|| :
30
+
fi
31
+
'';
32
+
unitConfig.X-StopOnRemoval = false;
33
+
};
34
+
};
35
+
autoStart = true;
36
+
enableTun = true;
37
+
privateNetwork = true;
38
+
hostAddress = "10.233.1.1";
39
+
localAddress = "10.233.1.2";
40
+
};
41
+
systemd.services."container@riot".restartIfChanged = lib.mkForce false;
42
+
43
+
systemd.network.networks."50-ve-riot" = {
44
+
matchConfig.Name = "ve-riot";
45
+
46
+
networkConfig = {
47
+
# weirdly we have to use POSTROUTING MASQUERADE here
48
+
# and set ip_forward manually
49
+
# IPForward = "yes";
50
+
# IPMasquerade = "both";
51
+
LinkLocalAddressing = "no";
52
+
KeepConfiguration = "static";
53
+
};
54
+
};
55
+
56
+
boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
57
+
58
+
krebs.iptables.tables.nat.POSTROUTING.rules = [
59
+
{ v6 = false; predicate = "-s ${config.containers.riot.localAddress}"; target = "MASQUERADE"; }
60
+
];
61
+
62
+
# networking.nat can be used instead of this
63
+
krebs.iptables.tables.nat.PREROUTING.rules = [
64
+
{ predicate = "-p tcp --dport 45622"; target = "DNAT --to-destination ${config.containers.riot.localAddress}:22"; v6 = false; }
65
+
];
66
+
krebs.iptables.tables.filter.FORWARD.rules = [
67
+
{ predicate = "-i ve-riot"; target = "ACCEPT"; }
68
+
{ predicate = "-o ve-riot"; target = "ACCEPT"; }
69
+
];
70
+
71
+
72
+
# non container stuff
73
+
74
+
services.nginx.virtualHosts.riot = {
75
+
serverName = null;
76
+
serverAliases = domains;
77
+
};
78
+
79
+
krebs.exim-smarthost.extraRouters = ''
80
+
forward_riot:
81
+
driver = manualroute
82
+
domains = ${lib.concatStringsSep ":" domains}
83
+
transport = remote_smtp
84
+
route_list = * riot
85
+
no_more
86
+
'';
87
+
}
+6
nixos/2configs/rtl-sdr.nix
+6
nixos/2configs/rtl-sdr.nix
+22
nixos/2configs/searx.nix
+22
nixos/2configs/searx.nix
···
1
+
{ pkgs, ... }:
2
+
let
3
+
port = 8889;
4
+
in {
5
+
services.nginx.virtualHosts.search = {
6
+
serverAliases = [ "search.r" ];
7
+
locations."/".extraConfig = ''
8
+
proxy_set_header Host $host;
9
+
proxy_pass http://127.0.0.1:${builtins.toString port};
10
+
'';
11
+
};
12
+
13
+
services.searx = {
14
+
enable = true;
15
+
configFile = pkgs.writeText "searx.cfg" (builtins.toJSON {
16
+
use_default_settings = true;
17
+
server = {
18
+
port = port;
19
+
};
20
+
});
21
+
};
22
+
}
+17
nixos/2configs/smartd.nix
+17
nixos/2configs/smartd.nix
+12
nixos/2configs/snapclient.nix
+12
nixos/2configs/snapclient.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
systemd.services.snapclient = {
4
+
wantedBy = [ "multi-user.target" ];
5
+
path = [ pkgs.snapcast ];
6
+
script = "snapclient -h 10.42.0.1 --hostID ${config.networking.hostName}";
7
+
serviceConfig = {
8
+
DynamicUser = true;
9
+
Group = "pipewire";
10
+
};
11
+
};
12
+
}
+30
nixos/2configs/snapserver.nix
+30
nixos/2configs/snapserver.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
services.snapserver = {
4
+
enable = true;
5
+
# openFirewall = true;
6
+
streams = {
7
+
radio = {
8
+
type = "process";
9
+
location = pkgs.writers.writeDash "radio" ''
10
+
exec ${pkgs.mpv}/bin/mpv http://radio.lassul.us/radio.ogg \
11
+
--no-terminal \
12
+
--audio-display=no \
13
+
--audio-channels=stereo \
14
+
--audio-samplerate=48000 \
15
+
--audio-format=s16 \
16
+
--ao=pcm \
17
+
--ao-pcm-file=/dev/stdout
18
+
'';
19
+
};
20
+
styx = {
21
+
type = "pipe";
22
+
location = "/run/snapserver/snapfifo";
23
+
};
24
+
};
25
+
http.enable = true;
26
+
};
27
+
28
+
networking.firewall.interfaces.int0.allowedTCPPorts = [ 1704 1705 1780 ];
29
+
networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 1780 ];
30
+
}
+15
nixos/2configs/ssh-cryptsetup.nix
+15
nixos/2configs/ssh-cryptsetup.nix
+22
nixos/2configs/starcraft.nix
+22
nixos/2configs/starcraft.nix
···
1
+
{ config, pkgs, ... }: let
2
+
mainUser = config.users.extraUsers.mainUser;
3
+
in {
4
+
users.users= {
5
+
starcraft = {
6
+
isNormalUser = true;
7
+
extraGroups = [
8
+
"audio"
9
+
"video"
10
+
];
11
+
packages = [
12
+
pkgs.wineWowPackages.minimal
13
+
pkgs.winetricks
14
+
pkgs.mpg123
15
+
];
16
+
};
17
+
};
18
+
security.sudo.extraConfig = ''
19
+
${mainUser.name} ALL=(starcraft) NOPASSWD: ALL
20
+
'';
21
+
}
22
+
+29
nixos/2configs/steam.nix
+29
nixos/2configs/steam.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
{
4
+
#
5
+
# Steam stuff
6
+
# source: https://nixos.org/wiki/Talk:Steam
7
+
#
8
+
##TODO: make steam module
9
+
nixpkgs.config.steam.java = true;
10
+
hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
11
+
12
+
users.users.mainUser.packages = [ (pkgs.steam.override {
13
+
extraPkgs = p: with p; [
14
+
gnutls # needed for Halo MCC
15
+
];
16
+
}) ];
17
+
18
+
#ports for inhome streaming
19
+
krebs.iptables = {
20
+
tables = {
21
+
filter.INPUT.rules = [
22
+
{ predicate = "-p tcp --dport 27031"; target = "ACCEPT"; }
23
+
{ predicate = "-p tcp --dport 27036"; target = "ACCEPT"; }
24
+
{ predicate = "-p udp --dport 27031"; target = "ACCEPT"; }
25
+
{ predicate = "-p udp --dport 27036"; target = "ACCEPT"; }
26
+
];
27
+
};
28
+
};
29
+
}
+27
nixos/2configs/syncthing.nix
+27
nixos/2configs/syncthing.nix
···
1
+
{ config, lib, pkgs, ... }: with lib;
2
+
let
3
+
mk_peers = mapAttrs (n: v: { id = v.syncthing.id; });
4
+
5
+
all_peers = filterAttrs (n: v: v.syncthing.id != null) config.krebs.hosts;
6
+
used_peer_names = unique (filter isString (flatten (mapAttrsToList (n: v: v.devices) config.services.syncthing.folders)));
7
+
used_peers = filterAttrs (n: v: elem n used_peer_names) all_peers;
8
+
in {
9
+
services.syncthing = {
10
+
enable = true;
11
+
group = "syncthing";
12
+
configDir = "/var/lib/syncthing";
13
+
key = "${config.krebs.secret.directory}/syncthing.key";
14
+
cert = "${config.krebs.secret.directory}/syncthing.cert";
15
+
# workaround for infinite recursion on unstable, remove in 23.11
16
+
settings.devices = mk_peers used_peers;
17
+
};
18
+
19
+
boot.kernel.sysctl."fs.inotify.max_user_watches" = 524288;
20
+
krebs.iptables.tables.filter.INPUT.rules = [
21
+
{ predicate = "-p tcp --dport 22000"; target = "ACCEPT";}
22
+
{ predicate = "-p udp --dport 21027"; target = "ACCEPT";}
23
+
];
24
+
system.activationScripts.syncthing-home = mkDefault ''
25
+
${pkgs.coreutils}/bin/chmod a+x /home/lass
26
+
'';
27
+
}
+21
nixos/2configs/termite.nix
+21
nixos/2configs/termite.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
{
4
+
environment.systemPackages = [
5
+
pkgs.termite
6
+
];
7
+
8
+
krebs.per-user.lass.packages = let
9
+
termitecfg = pkgs.writeTextFile {
10
+
name = "termite-config";
11
+
destination = "/etc/xdg/termite/config";
12
+
text = ''
13
+
[colors]
14
+
foreground = #d0d7d0
15
+
background = #000000
16
+
'';
17
+
};
18
+
in [
19
+
termitecfg
20
+
];
21
+
}
+21
nixos/2configs/terraria.nix
+21
nixos/2configs/terraria.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
services.terraria = {
4
+
enable = true;
5
+
openFirewall = true;
6
+
};
7
+
8
+
users.groups.terraria = {};
9
+
users.users.terraria.group = "terraria";
10
+
11
+
# mobile
12
+
# nixpkgs.config.packageOverrides = pkgs: {
13
+
# terraria-server = pkgs.terraria-server.overrideAttrs (_: {
14
+
# src = pkgs.fetchurl {
15
+
# url = "https://terraria.org/api/download/mobile-dedicated-server/Terraria-Mobile-Server-1.4.3.2.zip";
16
+
# sha256 = "sha256-Gl/pXylT6NPUY0SwhlPXtsRSkpVtJc5mWdxSYC4T30w=";
17
+
# };
18
+
# });
19
+
# };
20
+
}
21
+
+15
nixos/2configs/testi-host.nix
+15
nixos/2configs/testi-host.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
<stockholm/lass/2configs/container-networking.nix>
5
+
<stockholm/lass/2configs/syncthing.nix>
6
+
];
7
+
krebs.sync-containers.containers.testi = {
8
+
peers = [
9
+
"coaxmetal"
10
+
];
11
+
hostIp = "10.233.2.17";
12
+
localIp = "10.233.2.18";
13
+
format = "plain";
14
+
};
15
+
}
+12
nixos/2configs/texlive.nix
+12
nixos/2configs/texlive.nix
+75
nixos/2configs/themes.nix
+75
nixos/2configs/themes.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
3
+
switch-theme = pkgs.writers.writeDashBin "switch-theme" ''
4
+
set -efux
5
+
if [ "$1" = toggle ]; then
6
+
if [ "$(${pkgs.coreutils}/bin/cat /var/theme/current_theme)" = dark ]; then
7
+
${placeholder "out"}/bin/switch-theme light
8
+
else
9
+
${placeholder "out"}/bin/switch-theme dark
10
+
fi
11
+
elif test -e "/etc/themes/$1"; then
12
+
${pkgs.coreutils}/bin/mkdir -p /var/theme/config
13
+
${pkgs.rsync}/bin/rsync --chown=lass:users -a --delete "/etc/themes/$1/" /var/theme/config/
14
+
echo "$1" > /var/theme/current_theme
15
+
${pkgs.coreutils}/bin/chown lass:users /var/theme/current_theme
16
+
${pkgs.xorg.xrdb}/bin/xrdb -merge /var/theme/config/xresources
17
+
${pkgs.procps}/bin/pkill -HUP xsettingsd
18
+
${pkgs.glib}/bin/gsettings set org.gnome.desktop.interface gtk-theme "$(cat /var/theme/config/gtk-theme)" || :
19
+
else
20
+
echo "theme $1 not found"
21
+
fi
22
+
'';
23
+
24
+
in {
25
+
systemd.services.xsettingsd = {
26
+
wantedBy = [ "multi-user.target" ];
27
+
after = [ "display-manager.service" ];
28
+
environment.DISPLAY = ":0";
29
+
serviceConfig = {
30
+
ExecStart = "${pkgs.xsettingsd}/bin/xsettingsd -c /var/theme/config/xsettings.conf";
31
+
User = "lass";
32
+
Restart = "always";
33
+
RestartSec = "15s";
34
+
};
35
+
};
36
+
systemd.tmpfiles.rules = [
37
+
"d /var/theme/ 755 lass users"
38
+
];
39
+
environment.systemPackages = [
40
+
switch-theme
41
+
pkgs.dracula-theme
42
+
pkgs.gnome3.adwaita-icon-theme
43
+
];
44
+
environment.etc = {
45
+
"themes/light/gtk-theme".text = ''
46
+
Adwaita
47
+
'';
48
+
"themes/light/xsettings.conf".text = ''
49
+
Net/ThemeName "Adwaita"
50
+
'';
51
+
"themes/light/xresources".text = ''
52
+
*background: #ffffff
53
+
*foreground: #000000
54
+
'';
55
+
"themes/dark/gtk-theme".text = ''
56
+
Dracula
57
+
'';
58
+
"themes/dark/xsettings.conf".text = ''
59
+
Net/ThemeName "Dracula"
60
+
'';
61
+
"themes/dark/xresources".text = ''
62
+
*background: #000000
63
+
*foreground: #ffffff
64
+
'';
65
+
};
66
+
system.activationScripts.theme.text = ''
67
+
export DISPLAY=:0
68
+
if test -e /var/theme/current_theme; then
69
+
${switch-theme}/bin/switch-theme "$(cat /var/theme/current_theme)" ||
70
+
${switch-theme}/bin/switch-theme dark
71
+
else
72
+
${switch-theme}/bin/switch-theme dark
73
+
fi
74
+
'';
75
+
}
+46
nixos/2configs/tmux.nix
+46
nixos/2configs/tmux.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
{
4
+
environment.etc."tmux.conf".text = ''
5
+
#prefix key to `
6
+
set-option -g prefix2 `
7
+
8
+
bind-key r source-file /etc/tmux.conf \; display-message "/etc/tmux.conf reloaded"
9
+
10
+
set-option -g default-terminal screen-256color
11
+
12
+
#use session instead of windows
13
+
bind-key c new-session
14
+
bind-key p switch-client -p
15
+
bind-key n switch-client -n
16
+
bind-key C-s switch-client -l
17
+
'';
18
+
nixpkgs.config.packageOverrides = super: {
19
+
tmux = pkgs.symlinkJoin {
20
+
name = "tmux";
21
+
paths = [
22
+
(pkgs.writeDashBin "tmux" ''
23
+
exec ${super.tmux}/bin/tmux -f /etc/tmux.conf "$@"
24
+
'')
25
+
super.tmux
26
+
];
27
+
};
28
+
};
29
+
environment.systemPackages = with pkgs; [
30
+
tmux
31
+
];
32
+
33
+
# programs.bash.interactiveShellInit = ''
34
+
# if [[ "$TERM" != "linux" && -z "$TMUX" ]]; then
35
+
# if [[ -n "$SSH_AUTH_SOCK" ]]; then
36
+
# tmux set-environment -g SSH_AUTH_SOCK "$SSH_AUTH_SOCK" 2>/dev/null
37
+
# fi
38
+
39
+
# exec tmux -u
40
+
# fi
41
+
# if [[ "$__host__" != "$HOST" ]]; then
42
+
# tmux set -g status-bg colour$(string_hash $HOST 255)
43
+
# export __host__=$HOST
44
+
# fi
45
+
# '';
46
+
}
+49
nixos/2configs/tor-initrd.nix
+49
nixos/2configs/tor-initrd.nix
···
1
+
{config, pkgs, ... }:
2
+
## unlock command:
3
+
# (pass admin/$host/root;echo) | torify ssh root@$(pass hosts/$host/initrd/hostname) 'cat > /crypt-ramfs/passphrase'
4
+
{
5
+
boot.initrd.network.enable = true;
6
+
boot.initrd.network.ssh = {
7
+
enable = true;
8
+
port = 22;
9
+
authorizedKeys = [
10
+
config.krebs.users.lass.pubkey
11
+
config.krebs.users.lass-mors.pubkey
12
+
config.krebs.users.lass-green.pubkey
13
+
];
14
+
hostKeys = [ <secrets/initrd/ssh.ed25519_key> ];
15
+
};
16
+
boot.initrd.availableKernelModules = [ "e1000e" ];
17
+
18
+
boot.initrd.secrets = {
19
+
"/etc/tor/onion/bootup" = ${config.krebs.secret.directory}/initrd;
20
+
};
21
+
22
+
boot.initrd.extraUtilsCommands = ''
23
+
copy_bin_and_libs ${pkgs.tor}/bin/tor
24
+
'';
25
+
26
+
# start tor during boot process
27
+
boot.initrd.network.postCommands = let
28
+
torRc = (pkgs.writeText "tor.rc" ''
29
+
DataDirectory /etc/tor
30
+
SOCKSPort 127.0.0.1:9050 IsolateDestAddr
31
+
SOCKSPort 127.0.0.1:9063
32
+
HiddenServiceDir /etc/tor/onion/bootup
33
+
HiddenServicePort 22 127.0.0.1:22
34
+
'');
35
+
in ''
36
+
echo "tor: preparing onion folder"
37
+
# have to do this otherwise tor does not want to start
38
+
chmod -R 700 /etc/tor
39
+
40
+
echo "make sure localhost is up"
41
+
ip a a 127.0.0.1/8 dev lo
42
+
ip link set lo up
43
+
44
+
echo "tor: starting tor"
45
+
tor -f ${torRc} --verify-config
46
+
tor -f ${torRc} &
47
+
'';
48
+
}
49
+
+17
nixos/2configs/tor-ssh.nix
+17
nixos/2configs/tor-ssh.nix
···
1
+
{ config, ... }:
2
+
{
3
+
services.tor = {
4
+
enable = true;
5
+
relay.onionServices.ssh = {
6
+
version = 3;
7
+
map = [{
8
+
port = 22;
9
+
target.port = 22;
10
+
}];
11
+
secretKey = "${config.krebs.secret.directory}/ssh-tor.priv";
12
+
};
13
+
controlSocket.enable = true;
14
+
client.enable = true;
15
+
};
16
+
}
17
+
+194
nixos/2configs/tv.nix
+194
nixos/2configs/tv.nix
···
1
+
{ config, pkgs, ... }: let
2
+
3
+
nginxCfg = pkgs.writeText "nginx.conf" ''
4
+
daemon off;
5
+
pid /var/lib/rtmp/nginx.pid;
6
+
events {
7
+
use epoll;
8
+
worker_connections 128;
9
+
}
10
+
error_log stderr info;
11
+
12
+
http {
13
+
client_body_temp_path /var/lib/rtmp/nginx_cache_client_body;
14
+
proxy_temp_path /var/lib/rtmp/nginx_cache_proxy;
15
+
fastcgi_temp_path /var/lib/rtmp/nginx_cache_fastcgi;
16
+
uwsgi_temp_path /var/lib/rtmp/nginx_cache_uwsgi;
17
+
scgi_temp_path /var/lib/rtmp/nginx_cache_scgi;
18
+
19
+
server {
20
+
listen 8080;
21
+
root /var/lib/rtmp;
22
+
access_log stderr;
23
+
error_log stderr;
24
+
25
+
# This URL provides RTMP statistics in XML
26
+
location /stat {
27
+
rtmp_stat all;
28
+
}
29
+
}
30
+
}
31
+
32
+
rtmp {
33
+
server {
34
+
access_log stderr;
35
+
listen 1935;
36
+
ping 30s;
37
+
notify_method get;
38
+
39
+
application stream {
40
+
live on;
41
+
42
+
hls on;
43
+
hls_path /var/lib/rtmp/tmp/hls;
44
+
hls_fragment 1;
45
+
hls_playlist_length 10;
46
+
47
+
dash on;
48
+
dash_path /var/lib/rtmp/tmp/dash;
49
+
}
50
+
}
51
+
}
52
+
'';
53
+
54
+
in {
55
+
56
+
services.nginx = {
57
+
enable = true;
58
+
virtualHosts."streaming.lassul.us" = {
59
+
enableACME = true;
60
+
addSSL = true;
61
+
locations."/hls".extraConfig = ''
62
+
# Serve HLS fragments
63
+
types {
64
+
application/vnd.apple.mpegurl m3u8;
65
+
video/mp2t ts;
66
+
}
67
+
root /var/lib/rtmp/tmp;
68
+
69
+
# Allow CORS preflight requests
70
+
if ($request_method = 'OPTIONS') {
71
+
add_header 'Access-Control-Allow-Origin' '*';
72
+
add_header 'Access-Control-Max-Age' 1728000;
73
+
add_header 'Content-Type' 'text/plain charset=UTF-8';
74
+
add_header 'Content-Length' 0;
75
+
return 204;
76
+
}
77
+
78
+
if ($request_method != 'OPTIONS') {
79
+
add_header Cache-Control no-cache;
80
+
81
+
# CORS setup
82
+
add_header 'Access-Control-Allow-Origin' '*' always;
83
+
add_header 'Access-Control-Expose-Headers' 'Content-Length';
84
+
}
85
+
'';
86
+
locations."/dash".extraConfig = ''
87
+
# Serve DASH fragments
88
+
types {
89
+
application/dash+xml mpd;
90
+
video/mp4 mp4;
91
+
}
92
+
root /var/lib/rtmp/tmp;
93
+
94
+
# Allow CORS preflight requests
95
+
if ($request_method = 'OPTIONS') {
96
+
add_header 'Access-Control-Allow-Origin' '*';
97
+
add_header 'Access-Control-Max-Age' 1728000;
98
+
add_header 'Content-Type' 'text/plain charset=UTF-8';
99
+
add_header 'Content-Length' 0;
100
+
return 204;
101
+
}
102
+
if ($request_method != 'OPTIONS') {
103
+
add_header Cache-Control no-cache;
104
+
105
+
# CORS setup
106
+
add_header 'Access-Control-Allow-Origin' '*' always;
107
+
add_header 'Access-Control-Expose-Headers' 'Content-Length';
108
+
}
109
+
'';
110
+
locations."= /dash.all.min.js".extraConfig = ''
111
+
default_type "text/javascript";
112
+
alias ${pkgs.fetchurl {
113
+
url = "http://cdn.dashjs.org/v3.2.0/dash.all.min.js";
114
+
sha256 = "16f0b40gdqsnwqi01s5sz9f1q86dwzscgc3m701jd1sczygi481c";
115
+
}};
116
+
'';
117
+
locations."= /player".extraConfig = ''
118
+
default_type "text/html";
119
+
alias ${pkgs.writeText "player.html" ''
120
+
<!DOCTYPE html>
121
+
<html lang="en">
122
+
<head>
123
+
<meta charset="utf-8">
124
+
<title>lassulus livestream</title>
125
+
</head>
126
+
<body>
127
+
<div>
128
+
<video id="player" controls></video>
129
+
</video>
130
+
</div>
131
+
<script src="/dash.all.min.js"></script>
132
+
<script>
133
+
(function(){
134
+
var url = "/dash/nixos.mpd";
135
+
var player = dashjs.MediaPlayer().create();
136
+
player.initialize(document.querySelector("#player"), url, true);
137
+
})();
138
+
</script>
139
+
</body>
140
+
</html>
141
+
''};
142
+
'';
143
+
locations."/records".extraConfig = ''
144
+
autoindex on;
145
+
root /var/lib/rtmp;
146
+
'';
147
+
};
148
+
};
149
+
150
+
fileSystems."/var/lib/rtmp/tmp" = {
151
+
device = "tmpfs";
152
+
fsType = "tmpfs";
153
+
options = [ "nosuid" "nodev" "noatime" ];
154
+
};
155
+
156
+
users.users.rtmp = {
157
+
home = "/var/lib/rtmp";
158
+
uid = genid_uint31 "rtmp";
159
+
isNormalUser = true;
160
+
createHome = true;
161
+
openssh.authorizedKeys.keys = with config.krebs.users; [
162
+
mic92.pubkey
163
+
palo.pubkey
164
+
];
165
+
};
166
+
167
+
systemd.services.nginx-rtmp = {
168
+
wantedBy = [ "multi-user.target" ];
169
+
after = [ "network.target" ];
170
+
restartIfChanged = true;
171
+
script = ''
172
+
${pkgs.nginx.override {
173
+
modules = [
174
+
pkgs.nginxModules.rtmp
175
+
];
176
+
}}/bin/nginx -c ${nginxCfg} -p /var/lib/rtmp
177
+
'';
178
+
serviceConfig = {
179
+
ExecStartPre = pkgs.writers.writeDash "setup-rtmp" ''
180
+
mkdir -p /var/lib/rtmp/tmp/hls
181
+
mkdir -p /var/lib/rtmp/tmp/dash
182
+
chown rtmp:users /var/lib/rtmp/tmp/hls
183
+
chown rtmp:users /var/lib/rtmp/tmp/dash
184
+
chmod 755 /var/lib/rtmp/tmp/hls
185
+
chmod 755 /var/lib/rtmp/tmp/dash
186
+
'';
187
+
User = "rtmp";
188
+
};
189
+
};
190
+
191
+
krebs.iptables.tables.filter.INPUT.rules = [
192
+
{ predicate = "-p tcp --dport 1935"; target = "ACCEPT"; }
193
+
];
194
+
}
+52
nixos/2configs/ubik-host.nix
+52
nixos/2configs/ubik-host.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
krebs.sync-containers3.containers.ubik = {
4
+
sshKey = "${config.krebs.secret.directory}/ubik.sync.key";
5
+
};
6
+
containers.ubik.bindMounts."/var/lib" = {
7
+
hostPath = "/var/lib/sync-containers3/ubik/state";
8
+
isReadOnly = false;
9
+
};
10
+
containers.ubik.bindMounts."/var/lib/nextcloud/data" = {
11
+
hostPath = "/var/ubik";
12
+
isReadOnly = false;
13
+
};
14
+
services.nginx.virtualHosts."c.apanowicz.de" = {
15
+
enableACME = true;
16
+
acmeFallbackHost = "ubik.r";
17
+
forceSSL = true;
18
+
locations."/" = {
19
+
recommendedProxySettings = true;
20
+
proxyWebsockets = true;
21
+
proxyPass = "https://ubik.r";
22
+
extraConfig = ''
23
+
client_max_body_size 9001M;
24
+
# fix abort after 1GB download
25
+
# https://trac.nginx.org/nginx/ticket/1472
26
+
proxy_max_temp_file_size 0;
27
+
'';
28
+
};
29
+
};
30
+
services.nginx.virtualHosts."mail.ubikmedia.eu" = {
31
+
enableACME = true;
32
+
forceSSL = true;
33
+
acmeFallbackHost = "ubik.r";
34
+
locations."/" = {
35
+
recommendedProxySettings = true;
36
+
proxyWebsockets = true;
37
+
proxyPass = "https://ubik.r";
38
+
};
39
+
};
40
+
41
+
services.nginx.virtualHosts."karlaskop.de" = {
42
+
serverAliases = [ "www.karlaskop.de" ];
43
+
enableACME = true;
44
+
forceSSL = true;
45
+
acmeFallbackHost = "prism.r";
46
+
locations."/" = {
47
+
recommendedProxySettings = true;
48
+
proxyWebsockets = true;
49
+
proxyPass = "https://prism.r";
50
+
};
51
+
};
52
+
}
+22
nixos/2configs/umts.nix
+22
nixos/2configs/umts.nix
···
1
+
{
2
+
environment.etc."ppp/options-mobile".text = ''
3
+
ttyACM2
4
+
921600
5
+
lock
6
+
crtscts
7
+
modem
8
+
passive
9
+
novj
10
+
defaultroute
11
+
noipdefault
12
+
usepeerdns
13
+
noauth
14
+
hide-password
15
+
persist
16
+
holdoff 10
17
+
maxfail 0
18
+
debug
19
+
'';
20
+
21
+
environment.etc."ppp/peers/provider".text
22
+
+36
nixos/2configs/urxvt.nix
+36
nixos/2configs/urxvt.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
{
4
+
services.urxvtd.enable = true;
5
+
6
+
krebs.xresources.resources.urxvt = ''
7
+
URxvt.saveLines: 10000
8
+
URxvt.scrollBar: false
9
+
URxvt.urgentOnBell: true
10
+
URxvt.perl-ext: default,matcher
11
+
12
+
URxvt.url-launcher: /run/current-system/sw/bin/browser-select
13
+
URxvt.matcher.pattern.1: \\bwww\\.[\\w-]+\\.[\\w./?&@#-]*[\\w/-]
14
+
15
+
URxvt.keysym.M-Escape: perl:keyboard-select:activate
16
+
URxvt.keysym.M-s: perl:keyboard-select:search
17
+
URxvt.keysym.M-u: matcher:select
18
+
URxvt.keysym.M-i: matcher:list
19
+
20
+
URxvt.keysym.M-F1: command:\033]710;${config.lass.fonts.regular}\007\033]711;${config.lass.fonts.bold}\007
21
+
URxvt.keysym.M-F2: command:\033]710;xft:Monospace:size=12\007\033]711;xft:Monospace:size=15:bold\007
22
+
URxvt.keysym.M-F3: command:\033]710;xft:Monospace:size=18\007\033]711;xft:Monospace:size=20:bold\007
23
+
URxvt.keysym.M-F4: command:\033]710;xft:Monospace:size=25\007\033]711;xft:Monospace:size=25:bold\007
24
+
URxvt.keysym.M-F5: command:\033]710;xft:Monospace:size=30\007\033]711;xft:Monospace:size=30:bold\007
25
+
26
+
URxvt.intensityStyles: false
27
+
28
+
URxvt*background: #000000
29
+
URxvt*foreground: #ffffff
30
+
31
+
!change unreadable blue
32
+
URxvt*color4: #268bd2
33
+
34
+
URxvt*color0: #232342
35
+
'';
36
+
}
+349
nixos/2configs/vim.nix
+349
nixos/2configs/vim.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
let
4
+
out = {
5
+
environment.systemPackages = [
6
+
(lib.hiPrio vim)
7
+
];
8
+
9
+
environment.etc.vimrc.source = vimrc;
10
+
environment.etc.vim.source = vim;
11
+
12
+
environment.variables.EDITOR = lib.mkForce "vim";
13
+
environment.variables.VIMINIT = ":so /etc/vimrc";
14
+
};
15
+
16
+
vimrc = pkgs.writeText "vimrc" ''
17
+
set nocompatible
18
+
19
+
set autoindent
20
+
set backspace=indent,eol,start
21
+
set backup
22
+
set backupdir=${dirs.backupdir}/
23
+
set directory=${dirs.swapdir}//
24
+
set list listchars=tab:⇥\ ,extends:❯,precedes:❮,nbsp:␣,trail:· showbreak=¬
25
+
set hlsearch
26
+
set incsearch
27
+
set ttymouse=sgr
28
+
set mouse=a
29
+
set ruler
30
+
set pastetoggle=<INS>
31
+
set runtimepath=${extra-runtimepath},$VIMRUNTIME
32
+
set shortmess+=I
33
+
set showcmd
34
+
set showmatch
35
+
set ttimeoutlen=0
36
+
set undodir=${dirs.undodir}
37
+
set undofile
38
+
set undolevels=1000000
39
+
set undoreload=1000000
40
+
set viminfo='20,<1000,s100,h,n${files.viminfo}
41
+
set visualbell
42
+
set wildignore+=*.o,*.class,*.hi,*.dyn_hi,*.dyn_o
43
+
set wildmenu
44
+
set wildmode=longest,full
45
+
46
+
" enable better-whitespace
47
+
let g:better_whitespace_enabled=1
48
+
49
+
set title
50
+
set titleold=
51
+
set titlestring=(vim)\ %t%(\ %M%)%(\ (%{expand(\"%:p:h\")})%)%(\ %a%)\ -\ %{v:servername}
52
+
53
+
set et ts=2 sts=2 sw=2
54
+
55
+
filetype plugin indent on
56
+
57
+
set t_Co=256
58
+
colorscheme dim
59
+
syntax on
60
+
61
+
au Syntax * syn match Garbage containedin=ALL /\s\+$/
62
+
\ | syn match TabStop containedin=ALL /\t\+/
63
+
\ | syn keyword Todo containedin=ALL TODO
64
+
\ | syn match NBSP '\%xa0'
65
+
\ | syn match NarrowNBSP '\%u202F'
66
+
67
+
au BufRead,BufNewFile *.hs so ${hs.vim}
68
+
69
+
au BufRead,BufNewFile *.nix so ${nix.vim}
70
+
71
+
au BufRead,BufNewFile /dev/shm/* set nobackup nowritebackup noswapfile
72
+
73
+
nnoremap <F5> :call LanguageClient_contextMenu()<CR>
74
+
set hidden
75
+
let g:LanguageClient_serverCommands = {
76
+
\ 'python': ['pyls'],
77
+
\ 'go': ['~/go/bin/go-langserver']
78
+
\ }
79
+
80
+
let g:LanguageClient_diagnosticsDisplay = {
81
+
\ 1: { "signText": "E" },
82
+
\ 2: { "signText": "W" }
83
+
\ }
84
+
85
+
nmap <esc>q :buffer
86
+
nmap <M-q> :buffer
87
+
88
+
cnoremap <C-A> <Home>
89
+
90
+
noremap <C-c> :q<cr>
91
+
vnoremap < <gv
92
+
vnoremap > >gv
93
+
94
+
nnoremap <esc>[5^ :tabp<cr>
95
+
nnoremap <esc>[6^ :tabn<cr>
96
+
nnoremap <esc>[5@ :tabm -1<cr>
97
+
nnoremap <esc>[6@ :tabm +1<cr>
98
+
99
+
nnoremap <f1> :tabp<cr>
100
+
nnoremap <f2> :tabn<cr>
101
+
inoremap <f1> <esc>:tabp<cr>
102
+
inoremap <f2> <esc>:tabn<cr>
103
+
104
+
" <C-{Up,Down,Right,Left>
105
+
noremap <esc>Oa <nop> | noremap! <esc>Oa <nop>
106
+
noremap <esc>Ob <nop> | noremap! <esc>Ob <nop>
107
+
noremap <esc>Oc <nop> | noremap! <esc>Oc <nop>
108
+
noremap <esc>Od <nop> | noremap! <esc>Od <nop>
109
+
" <[C]S-{Up,Down,Right,Left>
110
+
noremap <esc>[a <nop> | noremap! <esc>[a <nop>
111
+
noremap <esc>[b <nop> | noremap! <esc>[b <nop>
112
+
noremap <esc>[c <nop> | noremap! <esc>[c <nop>
113
+
noremap <esc>[d <nop> | noremap! <esc>[d <nop>
114
+
115
+
" search with ack
116
+
let g:ackprg = 'ag --vimgrep'
117
+
cnoreabbrev Ack Ack!
118
+
119
+
" copy/paste from/to xclipboard
120
+
set clipboard=unnamedplus
121
+
122
+
" use fzf to switch files
123
+
nnoremap <C-p> :FZF<CR>
124
+
nnoremap <C-l> :Rg<CR>
125
+
let g:fzf_layout = { 'down': '~15%' }
126
+
'';
127
+
128
+
extra-runtimepath = lib.concatMapStringsSep "," (pkg: "${pkg.rtp}") [
129
+
pkgs.vimPlugins.copilot-vim
130
+
pkgs.vimPlugins.undotree
131
+
pkgs.vimPlugins.fzf-vim
132
+
pkgs.vimPlugins.fzfWrapper
133
+
pkgs.vimPlugins.vim-better-whitespace
134
+
(pkgs.vimUtils.buildVimPlugin {
135
+
name = "file-line-1.0";
136
+
src = pkgs.fetchFromGitHub {
137
+
owner = "bogado";
138
+
repo = "file-line";
139
+
rev = "1.0";
140
+
sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0";
141
+
};
142
+
})
143
+
(pkgs.vimUtils.buildVimPlugin {
144
+
name = "vim-dim-1.1.0";
145
+
src = pkgs.fetchFromGitHub {
146
+
owner = "jeffkreeftmeijer";
147
+
repo = "vim-dim";
148
+
rev = "1.1.0";
149
+
sha256 = "sha256-lyTZUgqUEEJRrzGo1FD8/t8KBioPrtB3MmGvPeEVI/g=";
150
+
};
151
+
})
152
+
((rtp: rtp // { inherit rtp; }) (pkgs.writeTextFile (let
153
+
name = "showsyntax";
154
+
in {
155
+
name = "vim-plugin-${name}-1.0.0";
156
+
destination = "/plugin/${name}.vim";
157
+
text = /* vim */ ''
158
+
if exists('g:loaded_showsyntax')
159
+
finish
160
+
endif
161
+
let g:loaded_showsyntax = 0
162
+
163
+
fu! ShowSyntax()
164
+
let id = synID(line("."), col("."), 1)
165
+
let name = synIDattr(id, "name")
166
+
let transName = synIDattr(synIDtrans(id),"name")
167
+
if name != transName
168
+
let name .= " (" . transName . ")"
169
+
endif
170
+
echo "Syntax: " . name
171
+
endfu
172
+
173
+
command! -n=0 -bar ShowSyntax :call ShowSyntax()
174
+
'';
175
+
})))
176
+
];
177
+
178
+
dirs = {
179
+
backupdir = "$HOME/.cache/vim/backup";
180
+
swapdir = "$HOME/.cache/vim/swap";
181
+
undodir = "$HOME/.cache/vim/undo";
182
+
};
183
+
files = {
184
+
viminfo = "$HOME/.cache/vim/info";
185
+
};
186
+
187
+
mkdirs = let
188
+
dirOf = s: let out = lib.concatStringsSep "/" (lib.init (lib.splitString "/" s));
189
+
in assert out != ""; out;
190
+
alldirs = lib.attrValues dirs ++ map dirOf (lib.attrValues files);
191
+
in lib.unique (lib.sort lib.lessThan alldirs);
192
+
193
+
vim = pkgs.symlinkJoin {
194
+
name = "vim";
195
+
paths = [
196
+
(pkgs.writers.writeDashBin "vim" ''
197
+
set -efu
198
+
export PATH=$PATH:${lib.makeBinPath [
199
+
pkgs.nodejs
200
+
]}
201
+
(umask 0077; exec ${pkgs.coreutils}/bin/mkdir -p ${toString mkdirs})
202
+
exec ${pkgs.vim}/bin/vim "$@"
203
+
'')
204
+
pkgs.vim
205
+
];
206
+
};
207
+
208
+
hs.vim = pkgs.writeText "hs.vim" ''
209
+
syn region String start=+\[[[:alnum:]]*|+ end=+|]+
210
+
211
+
hi link ConId Identifier
212
+
hi link VarId Identifier
213
+
hi link hsDelimiter Delimiter
214
+
'';
215
+
216
+
nix.vim = pkgs.writeText "nix.vim" ''
217
+
setf nix
218
+
219
+
" Ref <nix/src/libexpr/lexer.l>
220
+
syn match NixID /[a-zA-Z\_][a-zA-Z0-9\_\'\-]*/
221
+
syn match NixINT /\<[0-9]\+\>/
222
+
syn match NixPATH /[a-zA-Z0-9\.\_\-\+]*\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/
223
+
syn match NixHPATH /\~\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/
224
+
syn match NixSPATH /<[a-zA-Z0-9\.\_\-\+]\+\(\/[a-zA-Z0-9\.\_\-\+]\+\)*>/
225
+
syn match NixURI /[a-zA-Z][a-zA-Z0-9\+\-\.]*:[a-zA-Z0-9\%\/\?\:\@\&\=\+\$\,\-\_\.\!\~\*\']\+/
226
+
syn region NixSTRING
227
+
\ matchgroup=NixSTRING
228
+
\ start='"'
229
+
\ skip='\\"'
230
+
\ end='"'
231
+
syn region NixIND_STRING
232
+
\ matchgroup=NixIND_STRING
233
+
\ start="'''"
234
+
\ skip="'''\('\|[$]\|\\[nrt]\)"
235
+
\ end="'''"
236
+
237
+
syn match NixOther /[():/;=.,?\[\]]/
238
+
239
+
syn match NixCommentMatch /\(^\|\s\)#.*/
240
+
syn region NixCommentRegion start="/\*" end="\*/"
241
+
242
+
hi link NixCode Statement
243
+
hi link NixData Constant
244
+
hi link NixComment Comment
245
+
246
+
hi link NixCommentMatch NixComment
247
+
hi link NixCommentRegion NixComment
248
+
hi link NixID NixCode
249
+
hi link NixINT NixData
250
+
hi link NixPATH NixData
251
+
hi link NixHPATH NixData
252
+
hi link NixSPATH NixData
253
+
hi link NixURI NixData
254
+
hi link NixSTRING NixData
255
+
hi link NixIND_STRING NixData
256
+
257
+
hi link NixEnter NixCode
258
+
hi link NixOther NixCode
259
+
hi link NixQuote NixData
260
+
261
+
syn cluster nix_has_dollar_curly contains=@nix_ind_strings,@nix_strings
262
+
syn cluster nix_ind_strings contains=NixIND_STRING
263
+
syn cluster nix_strings contains=NixSTRING
264
+
265
+
${lib.concatStringsSep "\n" (lib.mapAttrsToList (lang: { extraStart ? null }: let
266
+
startAlts = lib.filter lib.isString [
267
+
''/\* ${lang} \*/''
268
+
extraStart
269
+
];
270
+
sigil = ''\(${lib.concatStringsSep ''\|'' startAlts}\)[ \t\r\n]*'';
271
+
in /* vim */ ''
272
+
syn include @nix_${lang}_syntax syntax/${lang}.vim
273
+
unlet b:current_syntax
274
+
275
+
syn match nix_${lang}_sigil
276
+
\ X${lib.replaceStrings ["X"] ["\\X"] sigil}\ze\('''\|"\)X
277
+
\ nextgroup=nix_${lang}_region_IND_STRING,nix_${lang}_region_STRING
278
+
\ transparent
279
+
280
+
syn region nix_${lang}_region_STRING
281
+
\ matchgroup=NixSTRING
282
+
\ start='"'
283
+
\ skip='\\"'
284
+
\ end='"'
285
+
\ contained
286
+
\ contains=@nix_${lang}_syntax
287
+
\ transparent
288
+
289
+
syn region nix_${lang}_region_IND_STRING
290
+
\ matchgroup=NixIND_STRING
291
+
\ start="'''"
292
+
\ skip="'''\('\|[$]\|\\[nrt]\)"
293
+
\ end="'''"
294
+
\ contained
295
+
\ contains=@nix_${lang}_syntax
296
+
\ transparent
297
+
298
+
syn cluster nix_ind_strings
299
+
\ add=nix_${lang}_region_IND_STRING
300
+
301
+
syn cluster nix_strings
302
+
\ add=nix_${lang}_region_STRING
303
+
304
+
syn cluster nix_has_dollar_curly
305
+
\ add=@nix_${lang}_syntax
306
+
'') {
307
+
c = {};
308
+
cabal = {};
309
+
haskell = {};
310
+
sh.extraStart = ''write\(Ba\|Da\)sh[^ \t\r\n]*[ \t\r\n]*"[^"]*"'';
311
+
vim.extraStart =
312
+
''write[^ \t\r\n]*[ \t\r\n]*"\(\([^"]*\.\)\?vimrc\|[^"]*\.vim\)"'';
313
+
})}
314
+
315
+
" Clear syntax that interferes with nixINSIDE_DOLLAR_CURLY.
316
+
syn clear shVarAssign
317
+
318
+
syn region nixINSIDE_DOLLAR_CURLY
319
+
\ matchgroup=NixEnter
320
+
\ start="[$]{"
321
+
\ end="}"
322
+
\ contains=TOP
323
+
\ containedin=@nix_has_dollar_curly
324
+
\ transparent
325
+
326
+
syn region nix_inside_curly
327
+
\ matchgroup=NixEnter
328
+
\ start="{"
329
+
\ end="}"
330
+
\ contains=TOP
331
+
\ containedin=nixINSIDE_DOLLAR_CURLY,nix_inside_curly
332
+
\ transparent
333
+
334
+
syn match NixQuote /'''\([''$']\|\\.\)/he=s+2
335
+
\ containedin=@nix_ind_strings
336
+
\ contained
337
+
338
+
syn match NixQuote /\\./he=s+1
339
+
\ containedin=@nix_strings
340
+
\ contained
341
+
342
+
syn sync fromstart
343
+
344
+
let b:current_syntax = "nix"
345
+
346
+
set isk=@,48-57,_,192-255,-,'
347
+
'';
348
+
in
349
+
out
+24
nixos/2configs/virtualbox.nix
+24
nixos/2configs/virtualbox.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
let
4
+
mainUser = config.users.extraUsers.mainUser;
5
+
6
+
in {
7
+
#services.virtualboxHost.enable = true;
8
+
virtualisation.virtualbox.host.enable = true;
9
+
virtualisation.virtualbox.host.enableHardening = false;
10
+
11
+
users.extraUsers = {
12
+
virtual = {
13
+
name = "virtual";
14
+
description = "user for running VirtualBox";
15
+
home = "/home/virtual";
16
+
useDefaultShell = true;
17
+
extraGroups = [ "vboxusers" "audio" "video" ];
18
+
createHome = true;
19
+
};
20
+
};
21
+
security.sudo.extraConfig = ''
22
+
${mainUser.name} ALL=(virtual) NOPASSWD: ALL
23
+
'';
24
+
}
+214
nixos/2configs/weechat.nix
+214
nixos/2configs/weechat.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
3
+
weechat-configured = pkgs.weechat-declarative.override {
4
+
config = {
5
+
scripts = [
6
+
pkgs.weechatScripts.weechat-matrix
7
+
pkgs.weechatScripts.wee-slack
8
+
];
9
+
settings = {
10
+
irc.server_default.nicks = [ "lassulus" "hackulus" ];
11
+
irc.server.bitlbee = {
12
+
addresses = "localhost/6666";
13
+
command = "msg &bitlbee identify \${sec.data.bitlbee}";
14
+
};
15
+
irc.server.hackint = {
16
+
addresses = "irc.hackint.org/6697";
17
+
autojoin = [
18
+
"#c3-gsm"
19
+
"#panthermoderns"
20
+
"#feldoffice"
21
+
"#36c3"
22
+
"#cccac"
23
+
"#nixos"
24
+
"#krebs"
25
+
"#krebstel"
26
+
"#c-base"
27
+
"#afra"
28
+
"#tvl"
29
+
"#eloop"
30
+
"#systemdultras"
31
+
"#rc3"
32
+
"#krebs-announce"
33
+
"#the_playlist"
34
+
"#germany"
35
+
"#hackint"
36
+
"#dezentrale"
37
+
"#hackerfleet \${sec.data.c3-gsm}" # TODO support channel passwords in a cooler way
38
+
];
39
+
ssl = true;
40
+
sasl_fail = "reconnect";
41
+
sasl_username = "lassulus";
42
+
sasl_password = "\${sec.data.hackint_sasl}";
43
+
};
44
+
irc.server.r = {
45
+
addresses = "irc.r";
46
+
autojoin = [
47
+
"#xxx"
48
+
"#autowifi"
49
+
"#brockman"
50
+
"#flix"
51
+
"#kollkoll"
52
+
"#noise"
53
+
"#mukke"
54
+
];
55
+
sasl_fail = "reconnect";
56
+
sasl_username = "lassulus";
57
+
sasl_password = "\${sec.data.r_sasl}";
58
+
anti_flood_prio_high = 0;
59
+
anti_flood_prio_low = 0;
60
+
};
61
+
irc.server.libera = {
62
+
addresses = "irc.libera.chat/6697";
63
+
autojoin = [
64
+
"#shackspace"
65
+
"#nixos"
66
+
"#krebs"
67
+
"#dezentrale"
68
+
"#tinc"
69
+
"#nixos-de"
70
+
"#fysi"
71
+
"#hillhacks"
72
+
"#nixos-rc3"
73
+
"#binaergewitter"
74
+
"#hackerfleet"
75
+
"#weechat"
76
+
];
77
+
ssl = true;
78
+
sasl_username = "lassulus";
79
+
sasl_fail = "reconnect";
80
+
sasl_password = "\${sec.data.libera_sasl}";
81
+
};
82
+
irc.server.news = {
83
+
addresses = "news.r";
84
+
autojoin = [
85
+
"#all"
86
+
"#aluhut"
87
+
"#querdenkos"
88
+
"#news"
89
+
"#drachengame"
90
+
];
91
+
anti_flood_prio_high = 0;
92
+
anti_flood_prio_low = 0;
93
+
};
94
+
matrix.server.lassulus = {
95
+
address = "matrix.lassul.us";
96
+
username = "lassulus";
97
+
password = "\${sec.data.matrix_lassulus}";
98
+
device_name = config.networking.hostName;
99
+
};
100
+
plugins.var.python.go.short_name = true;
101
+
plugins.var.python.go.short_name_server = true;
102
+
plugins.var.python.go.fuzzy_search = true;
103
+
relay.network.password = "xxx"; # secret?
104
+
relay.port.weechat = 9998;
105
+
relay.weechat.commands = "*,!exec,!quit";
106
+
weechat.look.buffer_time_format = "%m-%d_%H:%M:%S";
107
+
weechat.look.item_time_format = "%m-%d_%H:%M:%S";
108
+
irc.look.color_nicks_in_names = true;
109
+
irc.look.color_nicks_in_nicklist = true;
110
+
logger.file.mask = "$plugin.$name/%Y-%m-%d.weechatlog";
111
+
logger.file.path = "/var/state/weechat_logs";
112
+
logger.look.backlog = 1000;
113
+
weechat.notify.irc.news."#all" = "highlight";
114
+
115
+
# setting logger levels for channels is currently not possible declarativly
116
+
# because of already defined
117
+
logger.level.core.weechat = 0;
118
+
logger.level.irc = 3;
119
+
logger.level.python = 3;
120
+
weechat.bar.title.color_bg = 0;
121
+
weechat.bar.status.color_bg = 0;
122
+
alias.cmd.reload = "exec -oc cat /etc/weechat.set";
123
+
script.scripts.download_enabled = true;
124
+
weechat.look.prefix_align = "left";
125
+
weechat.look.prefix_align_max = 20;
126
+
irc.look.server_buffer = "independent";
127
+
matrix.look.server_buffer = "independent";
128
+
weechat.bar.buflist.size_max = 20;
129
+
weechat.color.chat_nick_colors = [
130
+
1 2 3 4 5 6 9
131
+
10 11 12 13 14
132
+
28 29
133
+
30 31 32 33 34 35 36 37 38 39
134
+
70
135
+
94
136
+
101 102 103 104 105 106 107
137
+
130 131 133 134 135 136 137
138
+
140 141 142 143
139
+
160 161 162 163 165 166 167 168 169
140
+
170 171 172 173 174 175
141
+
196 197 198 199
142
+
200 201 202 203 204 205 206 208 209 209
143
+
210 211 212
144
+
];
145
+
};
146
+
extraCommands = ''
147
+
/script upgrade
148
+
/script install go.py
149
+
/script install nickregain.pl
150
+
/script install autosort.py
151
+
/key bind meta-q /go
152
+
/key bind meta-t /bar toggle nicklist
153
+
/key bind meta-y /bar toggle buflist
154
+
/filter addreplace irc_smart * irc_smart_filter *
155
+
/filter addreplace playlist_topic irc.*.#the_playlist irc_topic *
156
+
/filter addreplace xxx_joinpart irc.r.#xxx irc_join,irc_part,irc_quit *
157
+
/set logger.level.irc.news 0
158
+
/set logger.level.python.server.nixos_dev = 0;
159
+
/set logger.level.irc.hackint.#the_playlist = 0;
160
+
/connect bitlbee
161
+
/connect r
162
+
/connect news
163
+
/connect libera
164
+
/connect hackint
165
+
/matrix connect nixos_dev
166
+
/matrix connect lassulus
167
+
'';
168
+
files."sec.conf" = toString (pkgs.writeText "sec.conf" ''
169
+
[crypt]
170
+
cipher = aes256
171
+
hash_algo = sha256
172
+
passphrase_command = "cat $CREDENTIALS_DIRECTORY/WEECHAT_PASSPHRASE"
173
+
salt = on
174
+
175
+
[data]
176
+
__passphrase__ = on
177
+
hackint_sasl = "5CA242E92E7A09B180711B50C4AE2E65C42934EB4E584EC82BC1281D8C72CD411D590C16CC435687C0DA13759873CC"
178
+
libera_sasl = "9500B5AC3B29F9CAA273F1B89DC99550E038AF95C4B47442B1FB4CB9F0D6B86B26015988AD39E642CA9C4A78DED7F42D1F409B268C93E778"
179
+
r_sasl = "CB6FB1421ED5A9094CD2C05462DB1FA87C4A675628ABD9AEC9928A1A6F3F96C07D9F26472331BAF80B7B73270680EB1BBEFD"
180
+
c3-gsm = "C49DD845900CFDFA93EEBCE4F1ABF4A963EF6082B7DA6410FA701CC77A04BB6C201FCB864988C4F2B97ED7D44D5A28F162"
181
+
bitlbee = "814ECAC59D9CF6E8340B566563E5D7E92AB92209B49C1EDE4CAAC32DD0DF1EC511D97C75E840C45D69BB9E3D03E79C"
182
+
matrix_lassulus = "0CA5C0F70A9F893881370F4A665B4CC40FBB1A41E53BC94916CD92B029103528611EC0B390116BE60FA79AE10F486E96E17B0824BE2DE1C97D87B88F5407330DAD70C044147533C36B09B7030CAD97"
183
+
'');
184
+
};
185
+
};
186
+
187
+
in {
188
+
users.users.mainUser.packages = [
189
+
weechat-configured
190
+
];
191
+
environment.etc."weechat.set".source = "${weechat-configured}/weechat.set";
192
+
systemd.tmpfiles.rules = [
193
+
"d /var/state/weechat_logs 0700 lass users -"
194
+
"d /var/state/weechat 0700 lass users -"
195
+
"d /var/state/weechat_cfg 0700 lass users -"
196
+
"L+ /home/lass/.local/share/weechat - - - - ../../../../var/state/weechat"
197
+
"L+ /home/lass/.config/weechat - - - - ../../../../var/state/weechat_cfg"
198
+
];
199
+
200
+
systemd.services.weechat = {
201
+
wantedBy = [ "multi-user.target" ];
202
+
restartIfChanged = false;
203
+
serviceConfig = {
204
+
User = "lass";
205
+
RemainAfterExit = true;
206
+
Type = "oneshot";
207
+
LoadCredential = [
208
+
"WEECHAT_PASSPHRASE:${config.krebs.secret.directory}/weechat_passphrase"
209
+
];
210
+
ExecStart = "${pkgs.tmux}/bin/tmux -2 new-session -d -s IM ${weechat-configured}/bin/weechat";
211
+
ExecStop = "${pkgs.tmux}/bin/tmux kill-session -t IM"; # TODO run save in weechat
212
+
};
213
+
};
214
+
}
+25
nixos/2configs/wine.nix
+25
nixos/2configs/wine.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
let
4
+
mainUser = config.users.extraUsers.mainUser;
5
+
6
+
in {
7
+
users.users= {
8
+
wine = {
9
+
home = "/home/wine";
10
+
useDefaultShell = true;
11
+
extraGroups = [
12
+
"audio"
13
+
"video"
14
+
];
15
+
createHome = true;
16
+
packages = [
17
+
pkgs.winePackages.minimal
18
+
];
19
+
isNormalUser = true;
20
+
};
21
+
};
22
+
security.sudo.extraConfig = ''
23
+
${mainUser.name} ALL=(wine) NOPASSWD: ALL
24
+
'';
25
+
}
+58
nixos/2configs/wiregrill.nix
+58
nixos/2configs/wiregrill.nix
···
1
+
{ config, lib, pkgs, ... }: with lib; let
2
+
3
+
self = config.krebs.build.host.nets.wiregrill;
4
+
isRouter = !isNull self.via;
5
+
6
+
in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
7
+
#hack for modprobe inside containers
8
+
systemd.services."wireguard-wiregrill".path = mkIf config.boot.isContainer (mkBefore [
9
+
(pkgs.writeDashBin "modprobe" ":")
10
+
]);
11
+
12
+
boot.kernel.sysctl = mkIf isRouter {
13
+
"net.ipv6.conf.all.forwarding" = 1;
14
+
};
15
+
krebs.iptables.tables.filter.INPUT.rules = [
16
+
{ predicate = "-p udp --dport ${toString self.wireguard.port}"; target = "ACCEPT"; }
17
+
];
18
+
krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter (mkBefore [
19
+
{ predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; }
20
+
{ predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
21
+
{ predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
22
+
{ predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; }
23
+
{ predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
24
+
]);
25
+
systemd.network.networks.wiregrill = {
26
+
matchConfig.Name = "wiregrill";
27
+
address =
28
+
(optional (!isNull self.ip4) "${self.ip4.addr}/16") ++
29
+
(optional (!isNull self.ip6) "${self.ip6.addr}/48")
30
+
;
31
+
networkConfig = {
32
+
IgnoreCarrierLoss = "10s";
33
+
};
34
+
};
35
+
36
+
networking.wireguard.interfaces.wiregrill = {
37
+
ips =
38
+
(optional (!isNull self.ip4 && !config.systemd.network.enable) self.ip4.addr) ++
39
+
(optional (!isNull self.ip6 && !config.systemd.network.enable) self.ip6.addr);
40
+
listenPort = 51820;
41
+
privateKeyFile = "${config.krebs.secret.directory}/wiregrill.key";
42
+
allowedIPsAsRoutes = true;
43
+
peers = mapAttrsToList
44
+
(name: host: {
45
+
# inherit name;
46
+
allowedIPs = if isRouter then
47
+
(optional (!isNull host.nets.wiregrill.ip4) host.nets.wiregrill.ip4.addr) ++
48
+
(optional (!isNull host.nets.wiregrill.ip6) host.nets.wiregrill.ip6.addr)
49
+
else
50
+
host.nets.wiregrill.wireguard.subnets
51
+
;
52
+
endpoint = mkIf (!isNull host.nets.wiregrill.via) (host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}");
53
+
persistentKeepalive = mkIf (!isNull host.nets.wiregrill.via) 61;
54
+
publicKey = (replaceStrings ["\n"] [""] host.nets.wiregrill.wireguard.pubkey);
55
+
})
56
+
(filterAttrs (_: h: hasAttr "wiregrill" h.nets) config.krebs.hosts);
57
+
};
58
+
}
+67
nixos/2configs/xdg-open.nix
+67
nixos/2configs/xdg-open.nix
···
1
+
{ config, pkgs, lib, ... }: let
2
+
3
+
xdg-open-wrapper = pkgs.writeDashBin "xdg-open" ''
4
+
exec ${xdg-open}/bin/xdg-open "$@" >> /tmp/xdg-debug.log 2>&1
5
+
'';
6
+
7
+
xdg-open = pkgs.writeBashBin "xdg-open" ''
8
+
set -xe
9
+
FILE="$1"
10
+
PATH=/run/current-system/sw/bin
11
+
mime=
12
+
13
+
case "$FILE" in
14
+
http://*|https://*)
15
+
mime=text/html
16
+
;;
17
+
mailto:*)
18
+
mime=special/mailaddress
19
+
;;
20
+
magnet:*)
21
+
mime=application/x-bittorrent
22
+
;;
23
+
irc:*)
24
+
mime=x-scheme-handler/irc
25
+
;;
26
+
*)
27
+
# it’s a file
28
+
29
+
# strip possible protocol
30
+
FILE=''${FILE#file://}
31
+
mime=''$(file -E --brief --mime-type "$FILE") \
32
+
|| (echo "$mime" 1>&2; exit 1)
33
+
# ^ echo the error message of file
34
+
;;
35
+
esac
36
+
37
+
case "$mime" in
38
+
special/mailaddress)
39
+
alacritty --execute vim "$FILE" ;;
40
+
text/html)
41
+
firefox "$FILE" ;;
42
+
text/xml)
43
+
firefox "$FILE" ;;
44
+
text/*)
45
+
alacritty --execute vim "$FILE" ;;
46
+
image/*)
47
+
sxiv "$FILE" ;;
48
+
application/x-bittorrent)
49
+
env DISPLAY=:0 transgui "$FILE" ;;
50
+
application/pdf)
51
+
zathura "$FILE" ;;
52
+
inode/directory)
53
+
alacritty --execute mc "$FILE" ;;
54
+
*)
55
+
# open dmenu and ask for program to open with
56
+
runner=$(print -rC1 -- ''${(ko)commands} | dmenu)
57
+
exec $runner "$FILE";;
58
+
esac
59
+
'';
60
+
in {
61
+
environment.systemPackages = [ xdg-open-wrapper ];
62
+
63
+
security.sudo.extraConfig = ''
64
+
cr ALL=(lass) NOPASSWD: ${xdg-open}/bin/xdg-open *
65
+
ff ALL=(lass) NOPASSWD: ${xdg-open}/bin/xdg-open *
66
+
'';
67
+
}
+236
nixos/2configs/xmonad.nix
+236
nixos/2configs/xmonad.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
services.xserver.windowManager.xmonad = {
5
+
enable = true;
6
+
extraPackages = hs: [
7
+
hs.extra
8
+
hs.xmonad-contrib
9
+
];
10
+
config = /* haskell */ ''
11
+
{-# LANGUAGE LambdaCase #-}
12
+
13
+
14
+
module Main where
15
+
import XMonad
16
+
17
+
import qualified XMonad.StackSet as W
18
+
import Control.Monad.Extra (whenJustM)
19
+
import Data.List (isInfixOf)
20
+
import Data.Monoid (Endo)
21
+
import System.Environment (getArgs, lookupEnv)
22
+
import System.Exit (exitFailure)
23
+
import System.IO (hPutStrLn, stderr)
24
+
import System.Posix.Process (executeFile)
25
+
import Data.Ratio
26
+
27
+
import XMonad.Actions.Commands (defaultCommands, runCommand)
28
+
import XMonad.Actions.CopyWindow (copy, copyToAll, kill1)
29
+
import XMonad.Actions.CycleWS (toggleWS)
30
+
import XMonad.Actions.DynamicWorkspaces ( addWorkspacePrompt, renameWorkspace, removeEmptyWorkspace)
31
+
import XMonad.Actions.DynamicWorkspaces (withWorkspace)
32
+
import XMonad.Actions.GridSelect (GSConfig(..), gridselectWorkspace, navNSearch)
33
+
import XMonad.Actions.Minimize (minimizeWindow, maximizeWindow, withLastMinimized)
34
+
import XMonad.Hooks.EwmhDesktops (ewmh)
35
+
import XMonad.Hooks.FloatNext (floatNext)
36
+
import XMonad.Hooks.FloatNext (floatNextHook)
37
+
import XMonad.Hooks.ManageDocks (avoidStruts, ToggleStruts(ToggleStruts))
38
+
import XMonad.Hooks.ManageHelpers (doCenterFloat, doRectFloat, (-?>))
39
+
import XMonad.Hooks.Place (placeHook, smart)
40
+
import XMonad.Hooks.UrgencyHook (focusUrgent)
41
+
import XMonad.Hooks.UrgencyHook (withUrgencyHook, UrgencyHook(..))
42
+
import XMonad.Layout.BoringWindows (boringWindows, focusDown, focusUp)
43
+
import XMonad.Layout.FixedColumn (FixedColumn(..))
44
+
import XMonad.Layout.Grid (Grid(..))
45
+
import XMonad.Layout.Minimize (minimize)
46
+
import XMonad.Layout.NoBorders (smartBorders, noBorders)
47
+
import XMonad.Layout.MouseResizableTile (mouseResizableTile)
48
+
import XMonad.Layout.SimplestFloat (simplestFloat)
49
+
import XMonad.Layout.StateFull
50
+
import XMonad.ManageHook (composeAll)
51
+
import XMonad.Prompt (autoComplete, font, height, searchPredicate, XPConfig)
52
+
import XMonad.Prompt.Window (windowPromptGoto, windowPromptBringCopy)
53
+
import XMonad.Util.EZConfig (additionalKeysP)
54
+
import XMonad.Util.NamedWindows (getName)
55
+
import XMonad.Util.Run (safeSpawn)
56
+
import XMonad.Util.Ungrab (unGrab)
57
+
import XMonad.Util.Paste (sendKey)
58
+
59
+
data LibNotifyUrgencyHook = LibNotifyUrgencyHook deriving (Read, Show)
60
+
61
+
instance UrgencyHook LibNotifyUrgencyHook where
62
+
urgencyHook LibNotifyUrgencyHook w = do
63
+
name <- getName w
64
+
Just idx <- fmap (W.findTag w) $ gets windowset
65
+
66
+
safeSpawn "${pkgs.libnotify}/bin/notify-send" [show name, "workspace " ++ idx]
67
+
68
+
myTerm :: FilePath
69
+
myTerm = "/run/current-system/sw/bin/alacritty"
70
+
71
+
myFont :: String
72
+
myFont = "${config.lass.fonts.regular}"
73
+
74
+
main :: IO ()
75
+
main = do
76
+
xmonad $ ewmh
77
+
$ withUrgencyHook LibNotifyUrgencyHook
78
+
$ def
79
+
{ terminal = myTerm
80
+
, modMask = mod4Mask
81
+
, layoutHook = myLayoutHook
82
+
, manageHook = floatHooks
83
+
, startupHook =
84
+
whenJustM (liftIO (lookupEnv "XMONAD_STARTUP_HOOK"))
85
+
(\path -> forkFile path [] Nothing)
86
+
, normalBorderColor = "#1c1c1c"
87
+
, focusedBorderColor = "#ff0000"
88
+
, workspaces = [ "dashboard", "sys", "wp" ]
89
+
} `additionalKeysP` myKeyMap
90
+
91
+
myLayoutHook = defLayout
92
+
where
93
+
defLayout = smartBorders $
94
+
minimize .
95
+
boringWindows $
96
+
(
97
+
noBorders StateFull |||
98
+
(avoidStruts $ Mirror (Tall 1 (3/100) (1/2))) |||
99
+
FixedColumn 2 80 80 1 |||
100
+
Tall 1 (3/100) (1/2) |||
101
+
simplestFloat |||
102
+
mouseResizableTile |||
103
+
Grid
104
+
)
105
+
106
+
floatHooks = composeAll
107
+
[ className =? "Pinentry" --> doCenterFloat
108
+
, className =? "Pager" --> doCenterFloat
109
+
, title =? "pager" --> doCenterFloat
110
+
, title =? "fzfmenu" --> doCenterFloat
111
+
, title =? "glxgears" --> doCenterFloat
112
+
, resource =? "Dialog" --> doFloat
113
+
, title =? "Upload to Imgur" -->
114
+
doRectFloat (W.RationalRect 0 0 (1 % 8) (1 % 8))
115
+
, placeHook (smart (1,0))
116
+
, floatNextHook
117
+
]
118
+
119
+
myKeyMap :: [([Char], X ())]
120
+
myKeyMap =
121
+
[ ("M4-p", forkFile "${pkgs.pass}/bin/passmenu" [ "--type" ] Nothing)
122
+
, ("M4-S-p", forkFile "${pkgs.otpmenu}/bin/otpmenu" [] Nothing)
123
+
, ("M4-z", forkFile "${pkgs.unimenu}/bin/unimenu" [] Nothing)
124
+
125
+
, ("M4-S-q", restart "xmonad" True)
126
+
127
+
, ("<XF86AudioMute>", spawn "${pkgs.pulseaudio.out}/bin/pactl -- set-sink-mute @DEFAULT_SINK@ toggle")
128
+
, ("<XF86AudioRaiseVolume>", spawn "${pkgs.pulseaudio.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ +4%")
129
+
, ("<XF86AudioLowerVolume>", spawn "${pkgs.pulseaudio.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ -4%")
130
+
, ("<XF86MonBrightnessDown>", spawn "${pkgs.acpilight}/bin/xbacklight -time 0 -dec 1")
131
+
, ("<XF86MonBrightnessUp>", spawn "${pkgs.acpilight}/bin/xbacklight -time 0 -inc 1")
132
+
, ("M4-C-k", spawn "${pkgs.xorg.xkill}/bin/xkill")
133
+
134
+
, ("M4-<Tab>", focusDown)
135
+
, ("M4-S-<Tab>", focusUp)
136
+
, ("M4-j", focusDown)
137
+
, ("M4-k", focusUp)
138
+
139
+
, ("M4-a", focusUrgent)
140
+
, ("M4-S-r", renameWorkspace myXPConfig)
141
+
, ("M4-S-a", addWorkspacePrompt myXPConfig)
142
+
, ("M4-S-<Backspace>", removeEmptyWorkspace)
143
+
, ("M4-S-c", kill1)
144
+
, ("M4-<Esc>", toggleWS)
145
+
, ("M4-S-<Enter>", spawn myTerm)
146
+
, ("M4-x", floatNext True >> spawn myTerm)
147
+
, ("M4-c", spawn "/run/current-system/sw/bin/emacsclient -c")
148
+
-- , ("M4-c", unGrab)
149
+
, ("M4-f", floatNext True)
150
+
, ("M4-b", spawn "/run/current-system/sw/bin/klem")
151
+
152
+
, ("M4-c", defaultCommands >>= runCommand)
153
+
-- , ("M4-v", spawn "${pkgs.pager}/bin/pager view")
154
+
-- , ("M4-S-v", spawn "${pkgs.pager}/bin/pager shift")
155
+
, ("M4-v", withWorkspace autoXPConfig (windows . W.greedyView))
156
+
, ("M4-S-v", withWorkspace autoXPConfig (windows . W.shift))
157
+
, ("M4-C-v", withWorkspace autoXPConfig (windows . copy))
158
+
159
+
, ("M4-m", withFocused minimizeWindow)
160
+
, ("M4-S-m", withLastMinimized maximizeWindow)
161
+
162
+
, ("M4-q", windowPromptGoto infixAutoXPConfig)
163
+
, ("M4-C-q", windowPromptBringCopy infixAutoXPConfig)
164
+
165
+
, ("M4-S-q", return ())
166
+
167
+
, ("M4-d", floatNext True >> spawn "${pkgs.writers.writeDash "clipmenu" ''
168
+
PATH=${lib.makeBinPath [
169
+
pkgs.coreutils
170
+
pkgs.gawk
171
+
pkgs.dmenu
172
+
]}
173
+
${pkgs.clipmenu}/bin/clipmenu
174
+
''}")
175
+
176
+
, ("M4-<Insert>", spawn "${pkgs.writers.writeDash "paste" ''
177
+
${pkgs.coreutils}/bin/sleep 0.4
178
+
${pkgs.xclip}/bin/xclip -o | ${pkgs.xdotool}/bin/xdotool type -f -
179
+
''}")
180
+
181
+
, ("M4-<F1>", spawn "/run/current-system/sw/bin/gamepad_mouse_toggle")
182
+
, ("M4-<F2>", windows copyToAll)
183
+
, ("M4-<F4>", spawn "${pkgs.nm-dmenu}/bin/nm-dmenu")
184
+
, ("M4-<F5>", spawn "${pkgs.acpilight}/bin/xbacklight -set 1")
185
+
, ("M4-<F6>", spawn "${pkgs.acpilight}/bin/xbacklight -set 10")
186
+
, ("M4-<F7>", spawn "${pkgs.acpilight}/bin/xbacklight -set 33")
187
+
, ("M4-<F8>", spawn "${pkgs.acpilight}/bin/xbacklight -set 100")
188
+
189
+
, ("M4-<F9>", spawn "${pkgs.redshift}/bin/redshift -O 4000 -g 0.9:0.8:0.8")
190
+
, ("M4-<F10>", spawn "${pkgs.redshift}/bin/redshift -x")
191
+
192
+
, ("M4-<F11>", spawn "${config.lass.screenlock.command}")
193
+
194
+
, ("M4-u", spawn "${pkgs.xcalib}/bin/xcalib -invert -alter")
195
+
, ("M4-y", spawn "/run/current-system/sw/bin/switch-theme toggle")
196
+
197
+
${lib.optionalString (builtins.hasAttr "warpd" pkgs) '', ("M4-s", spawn "${pkgs.warpd}/bin/warpd --hint")''}
198
+
, ("M4-i", spawn "/run/current-system/sw/bin/screenshot")
199
+
200
+
--, ("M4-w", screenWorkspace 0 >>= (windows . W.greedyView))
201
+
--, ("M4-e", screenWorkspace 1 >>= (windows . W.greedyView))
202
+
--, ("M4-r", screenWorkspace 2 >>= (windows . W.greedyView))
203
+
]
204
+
205
+
forkFile :: FilePath -> [String] -> Maybe [(String, String)] -> X ()
206
+
forkFile path args env =
207
+
xfork (executeFile path True args env) >> return ()
208
+
209
+
myXPConfig :: XPConfig
210
+
myXPConfig = def
211
+
{ font = myFont
212
+
, height = 40
213
+
}
214
+
215
+
autoXPConfig :: XPConfig
216
+
autoXPConfig = myXPConfig
217
+
{ autoComplete = Just 5000
218
+
}
219
+
220
+
infixAutoXPConfig :: XPConfig
221
+
infixAutoXPConfig = autoXPConfig
222
+
{ searchPredicate = isInfixOf
223
+
}
224
+
225
+
gridConfig :: GSConfig WorkspaceId
226
+
gridConfig = def
227
+
{ gs_cellwidth = 100
228
+
, gs_cellheight = 30
229
+
, gs_cellpadding = 2
230
+
, gs_navigate = navNSearch
231
+
, gs_font = myFont
232
+
}
233
+
234
+
'';
235
+
};
236
+
}
+7
nixos/2configs/xonsh.nix
+7
nixos/2configs/xonsh.nix
+62
nixos/2configs/yubikey.nix
+62
nixos/2configs/yubikey.nix
···
1
+
{ self, config, lib, pkgs, ... }:
2
+
{
3
+
environment.systemPackages = with pkgs; [
4
+
yubikey-personalization
5
+
yubikey-manager
6
+
pinentry-curses pinentry-qt
7
+
];
8
+
9
+
services.udev.packages = with pkgs; [ yubikey-personalization ];
10
+
systemd.user.sockets.gpg-agent-ssh.wantedBy = [ "sockets.target" ];
11
+
12
+
services.pcscd.enable = true;
13
+
systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" ''
14
+
set -x
15
+
mkdir -p $HOME/.gnupg
16
+
${pkgs.coreutils}/bin/ln -sf ${pkgs.writeText "scdaemon.conf" ''
17
+
disable-ccid
18
+
pcsc-driver ${pkgs.pcsclite.out}/lib/libpcsclite.so.1
19
+
card-timeout 1
20
+
21
+
# Always try to use yubikey as the first reader
22
+
# even when other smart card readers are connected
23
+
# Name of the reader can be found using the pcsc_scan command
24
+
# If you have problems with gpg not recognizing the Yubikey
25
+
# then make sure that the string here matches exacly pcsc_scan
26
+
# command output. Also check journalctl -f for errors.
27
+
reader-port Yubico YubiKey
28
+
''} $HOME/.gnupg/scdaemon.conf
29
+
'';
30
+
systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
31
+
${pkgs.gnupg}/bin/gpg --import ${self.inputs.stockholm.outPath + "/kartei/lass/pgp/yubikey.pgp"} >/dev/null
32
+
echo -e '5\ny\n' | gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || :
33
+
'';
34
+
35
+
security.polkit.extraConfig = ''
36
+
polkit.addRule(function(action, subject) {
37
+
if (
38
+
(
39
+
action.id == "org.debian.pcsc-lite.access_pcsc" ||
40
+
action.id == "org.debian.pcsc-lite.access_card"
41
+
) && subject.user == "lass"
42
+
) {
43
+
return polkit.Result.YES;
44
+
}
45
+
});
46
+
polkit.addRule(function(action, subject) {
47
+
polkit.log("subject: " + subject + " action: " + action);
48
+
});
49
+
'';
50
+
51
+
# allow nix to acces remote builders via yubikey
52
+
systemd.services.nix-daemon.environment.SSH_AUTH_SOCK = "/run/user/1337/gnupg/S.gpg-agent.ssh";
53
+
54
+
programs = {
55
+
ssh.startAgent = false;
56
+
gnupg.agent = {
57
+
enable = true;
58
+
pinentryFlavor = "qt";
59
+
enableSSHSupport = true;
60
+
};
61
+
};
62
+
}
+144
nixos/2configs/zsh.nix
+144
nixos/2configs/zsh.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
environment.systemPackages = with pkgs; [
4
+
atuin
5
+
direnv
6
+
fzf
7
+
];
8
+
environment.variables.ATUIN_CONFIG_DIR = toString (pkgs.writeTextDir "/config.toml" ''
9
+
auto_sync = true
10
+
update_check = false
11
+
sync_address = "http://green.r:8888"
12
+
sync_frequency = 0
13
+
style = "compact"
14
+
'');
15
+
programs.zsh = {
16
+
enable = true;
17
+
shellInit = ''
18
+
#disable config wizard
19
+
zsh-newuser-install() { :; }
20
+
'';
21
+
interactiveShellInit = ''
22
+
unsetopt nomatch # no matches found urls
23
+
setopt autocd extendedglob
24
+
bindkey -e
25
+
26
+
27
+
# # setopt inc_append_history
28
+
# bindkey '^R' history-incremental-search-backward
29
+
30
+
#C-x C-e open line in editor
31
+
autoload -z edit-command-line
32
+
zle -N edit-command-line
33
+
bindkey "^X^E" edit-command-line
34
+
35
+
#fzf inclusion
36
+
source ${pkgs.fzf}/share/fzf/completion.zsh
37
+
source ${pkgs.fzf}/share/fzf/key-bindings.zsh
38
+
39
+
# atuin distributed shell history
40
+
export ATUIN_NOBIND="true" # disable all keybdinings of atuin
41
+
eval "$(atuin init zsh)"
42
+
bindkey '^r' _atuin_search_widget # bind ctrl+r to atuin
43
+
# use zsh only session history
44
+
fc -p
45
+
46
+
#completion magic
47
+
autoload -Uz compinit
48
+
compinit
49
+
zstyle ':completion:*' menu select
50
+
51
+
#enable automatic rehashing of $PATH
52
+
zstyle ':completion:*' rehash true
53
+
54
+
# fancy mv which interactively gets the second argument if not given
55
+
function mv() {
56
+
if [[ "$#" -ne 1 ]] || [[ ! -e "$1" ]]; then
57
+
command mv -v "$@"
58
+
return
59
+
fi
60
+
61
+
newfilename="$1"
62
+
vared newfilename
63
+
command mv -v -- "$1" "$newfilename"
64
+
}
65
+
66
+
#beautiful colors
67
+
eval $(dircolors -b ${pkgs.fetchFromGitHub {
68
+
owner = "trapd00r";
69
+
repo = "LS_COLORS";
70
+
rev = "a75fca8545f91abb8a5f802981033ef54bf1eac0";
71
+
sha256="1lzj0qnj89mzh76ha137mnz2hf86k278rh0y9x124ghxj9yqsnb4";
72
+
}}/LS_COLORS)
73
+
zstyle ':completion:*:default' list-colors ''${(s.:.)LS_COLORS}
74
+
75
+
#emacs bindings
76
+
bindkey "[7~" beginning-of-line
77
+
bindkey "[8~" end-of-line
78
+
bindkey "Oc" emacs-forward-word
79
+
bindkey "Od" emacs-backward-word
80
+
81
+
# direnv integration
82
+
eval "$(${pkgs.direnv}/bin/direnv hook zsh)"
83
+
'';
84
+
promptInit = ''
85
+
autoload -U promptinit
86
+
promptinit
87
+
88
+
p_error='%(?..%F{red}%?%f )'
89
+
t_error='%(?..%? )'
90
+
91
+
case $UID in
92
+
0)
93
+
p_username='%F{red}root%f'
94
+
t_username='root'
95
+
;;
96
+
1337)
97
+
p_username=""
98
+
t_username=""
99
+
;;
100
+
*)
101
+
p_username='%F{blue}%n%f'
102
+
t_username='%n'
103
+
;;
104
+
esac
105
+
106
+
if test -n "$SSH_CLIENT"; then
107
+
p_hostname='@%F{magenta}%M%f '
108
+
t_hostname='@%M '
109
+
else
110
+
p_hostname=""
111
+
t_hostname=""
112
+
fi
113
+
114
+
#check if in nix shell
115
+
if test -n "$IN_NIX_SHELL"; then
116
+
p_nixshell='%F{green}[s]%f '
117
+
t_nixshell='[s] '
118
+
else
119
+
p_nixshell=""
120
+
t_nixshell=""
121
+
fi
122
+
123
+
PROMPT="$p_error$p_username$p_hostname$p_nixshell%~ "
124
+
TITLE="$t_error$t_username$t_hostname$t_nixshell%~"
125
+
case $TERM in
126
+
(*xterm* | *rxvt*)
127
+
function precmd {
128
+
PROMPT_EVALED=$(print -P "$TITLE")
129
+
echo -ne "\033]0;$$ $PROMPT_EVALED\007"
130
+
}
131
+
# This seems broken for some reason
132
+
# # This is seen while the shell waits for a command to complete.
133
+
# function preexec {
134
+
# PROMPT_EVALED=$(print -P "$TITLE")
135
+
# echo -ne "\033]0;$$ $PROMPT_EVALED $1\007"
136
+
# }
137
+
;;
138
+
esac
139
+
'';
140
+
};
141
+
environment.shellAliases.ns = "nix-shell --command zsh";
142
+
143
+
users.defaultUserShell = "/run/current-system/sw/bin/zsh";
144
+
}
+14
nixos/3modules/default.nix
+14
nixos/3modules/default.nix
+48
nixos/3modules/dnsmasq.nix
+48
nixos/3modules/dnsmasq.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
with builtins;
4
+
with lib;
5
+
6
+
let
7
+
cfg = config.lass.dnsmasq;
8
+
9
+
out = {
10
+
options.lass.dnsmasq = api;
11
+
config = mkIf cfg.enable imp;
12
+
};
13
+
14
+
api = {
15
+
enable = mkEnableOption "dnsmasq";
16
+
config = mkOption {
17
+
type = types.str;
18
+
#TODO: find a good default
19
+
default = ''
20
+
'';
21
+
description = "configuration dnsmasq is started with";
22
+
};
23
+
};
24
+
25
+
configFile = pkgs.writeText "dnsmasq.conf" cfg.config;
26
+
27
+
imp = {
28
+
29
+
systemd.services.dnsmasq = {
30
+
description = "dnsmasq";
31
+
after = [ "network.target" ];
32
+
wantedBy = [ "multi-user.target" ];
33
+
34
+
path = with pkgs; [
35
+
dnsmasq
36
+
];
37
+
38
+
39
+
restartIfChanged = true;
40
+
41
+
serviceConfig = {
42
+
Restart = "always";
43
+
ExecStart = "${pkgs.dnsmasq}/bin/dnsmasq -k -C ${configFile}";
44
+
};
45
+
};
46
+
};
47
+
48
+
in out
+159
nixos/3modules/drbd.nix
+159
nixos/3modules/drbd.nix
···
1
+
{ config, lib, pkgs, self, ... }: let
2
+
cfg = config.lass.drbd;
3
+
slib = self.inputs.stockholm.lib;
4
+
in {
5
+
options = {
6
+
lass.drbd = lib.mkOption {
7
+
default = {};
8
+
type = lib.types.attrsOf (lib.types.submodule ({ config, ... }: {
9
+
options = {
10
+
name = lib.mkOption {
11
+
type = lib.types.str;
12
+
default = config._module.args.name;
13
+
};
14
+
blockMinor = lib.mkOption {
15
+
type = lib.types.int;
16
+
default = lib.mod (slib.genid config.name) 16000; # TODO get max_id fron drbd
17
+
};
18
+
port = lib.mkOption {
19
+
type = lib.types.int;
20
+
default = 20000 + config.blockMinor;
21
+
};
22
+
peers = lib.mkOption {
23
+
type = lib.types.listOf slib.types.host;
24
+
};
25
+
disk = lib.mkOption {
26
+
type = lib.types.str;
27
+
default = "/dev/loop${toString config.blockMinor}";
28
+
};
29
+
drbdConfig = lib.mkOption {
30
+
type = lib.types.path;
31
+
internal = true;
32
+
default = pkgs.writeText "drbd-${config.name}.conf" ''
33
+
resource ${config.name} {
34
+
net {
35
+
protocol a;
36
+
ping-int 10;
37
+
csums-alg crc32c;
38
+
connect-int 3;
39
+
after-sb-0pri discard-older-primary;
40
+
after-sb-1pri discard-secondary;
41
+
42
+
# seems to be drbd-proxy premium feature
43
+
on-congestion pull-ahead;
44
+
congestion-fill 1G;
45
+
congestion-extents 500;
46
+
47
+
sndbuf-size 10M;
48
+
max-epoch-size 20000;
49
+
}
50
+
device minor ${toString config.blockMinor};
51
+
disk ${config.disk};
52
+
meta-disk internal;
53
+
${slib.indent (lib.concatStrings (lib.imap1 (i: peer: /* shell */ ''
54
+
on ${peer.name} {
55
+
address ${peer.nets.retiolum.ip4.addr}:${toString config.port};
56
+
node-id ${toString i};
57
+
}
58
+
'') config.peers))}
59
+
connection-mesh {
60
+
hosts ${lib.concatMapStringsSep " " (peer: peer.name) config.peers};
61
+
}
62
+
}
63
+
'';
64
+
};
65
+
};
66
+
}));
67
+
};
68
+
};
69
+
config = lib.mkIf (cfg != {}) {
70
+
boot.extraModulePackages = [
71
+
(pkgs.linuxPackages.callPackage ../5pkgs/drbd9/default.nix {})
72
+
];
73
+
boot.extraModprobeConfig = ''
74
+
options drbd usermode_helper=/run/current-system/sw/bin/drbdadm
75
+
'';
76
+
services.udev.packages = [ pkgs.drbd ];
77
+
boot.kernelModules = [ "drbd" ];
78
+
79
+
environment.systemPackages = [
80
+
pkgs.drbd
81
+
(pkgs.writers.writeDashBin "drbd-change-nodeid" ''
82
+
# https://linbit.com/drbd-user-guide/drbd-guide-9_0-en/#s-using-truck-based-replication
83
+
set -efux
84
+
85
+
if [ "$#" -ne 2 ]; then
86
+
echo '$1 needs to be drbd volume name'
87
+
echo '$2 needs to be new node id'
88
+
exit 1
89
+
fi
90
+
91
+
92
+
TMPDIR=$(mktemp -d)
93
+
trap 'rm -rf $TMPDIR' EXIT
94
+
95
+
V=$1
96
+
NODE_TO=$2
97
+
META_DATA_LOCATION=internal
98
+
99
+
${pkgs.drbd}/bin/drbdadm -- --force dump-md $V > "$TMPDIR"/md_orig.txt
100
+
NODE_FROM=$(cat "$TMPDIR"/md_orig.txt | ${pkgs.gnused}/bin/sed -n 's/^node-id \(.*\);$/\1/p')
101
+
${pkgs.gnused}/bin/sed -e "s/node-id $NODE_FROM/node-id $NODE_TO/" \
102
+
-e "s/^peer.$NODE_FROM. /peer-NEW /" \
103
+
-e "s/^peer.$NODE_TO. /peer[$NODE_FROM] /" \
104
+
-e "s/^peer-NEW /peer[$NODE_TO] /" \
105
+
< "$TMPDIR"/md_orig.txt > "$TMPDIR"/md.txt
106
+
107
+
drbdmeta --force $(drbdadm sh-minor $V) v09 $(drbdadm sh-md-dev $V) $META_DATA_LOCATION restore-md "$TMPDIR"/md.txt
108
+
'')
109
+
];
110
+
111
+
networking.firewall.allowedTCPPorts = map (device: device.port) (lib.attrValues cfg);
112
+
systemd.services = lib.mapAttrs' (_: device:
113
+
lib.nameValuePair "drbd-${device.name}" {
114
+
after = [ "systemd-udev.settle.service" "network.target" "retiolum.service" ];
115
+
wants = [ "systemd-udev.settle.service" ];
116
+
wantedBy = [ "multi-user.target" ];
117
+
serviceConfig = {
118
+
RemainAfterExit = true;
119
+
ExecStart = pkgs.writers.writeDash "start-drbd-${device.name}" ''
120
+
set -efux
121
+
mkdir -p /var/lib/sync-containers2
122
+
${lib.optionalString (device.disk == "/dev/loop${toString device.blockMinor}") ''
123
+
if ! test -e /var/lib/sync-containers2/${device.name}.disk; then
124
+
truncate -s 10G /var/lib/sync-containers2/${device.name}.disk
125
+
fi
126
+
if ! ${pkgs.util-linux}/bin/losetup /dev/loop${toString device.blockMinor}; then
127
+
${pkgs.util-linux}/bin/losetup /dev/loop${toString device.blockMinor} /var/lib/sync-containers2/${device.name}.disk
128
+
fi
129
+
''}
130
+
if ! ${pkgs.drbd}/bin/drbdadm adjust ${device.name}; then
131
+
${pkgs.drbd}/bin/drbdadm down ${device.name}
132
+
${pkgs.drbd}/bin/drbdadm create-md ${device.name}/0 --max-peers 31
133
+
${pkgs.drbd}/bin/drbdadm up ${device.name}
134
+
fi
135
+
'';
136
+
ExecStop = pkgs.writers.writeDash "stop-drbd-${device.name}" ''
137
+
set -efux
138
+
${pkgs.drbd}/bin/drbdadm -c ${device.drbdConfig} down ${device.name}
139
+
${lib.optionalString (device.disk == "/dev/loop${toString device.blockMinor}") ''
140
+
${pkgs.util-linux}/bin/losetup -d /dev/loop${toString device.blockMinor}
141
+
''}
142
+
'';
143
+
};
144
+
}
145
+
) cfg;
146
+
147
+
148
+
environment.etc."drbd.conf".text = ''
149
+
global {
150
+
usage-count yes;
151
+
}
152
+
153
+
${lib.concatMapStrings (device: /* shell */ ''
154
+
include ${device.drbdConfig};
155
+
'') (lib.attrValues cfg)}
156
+
'';
157
+
};
158
+
}
159
+
+104
nixos/3modules/folderPerms.nix
+104
nixos/3modules/folderPerms.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
#TODO: implement recursive mode maybe?
4
+
# enable different mods for files and folders
5
+
6
+
let
7
+
inherit (pkgs)
8
+
writeScript
9
+
;
10
+
11
+
inherit (lib)
12
+
concatMapStringsSep
13
+
concatStringsSep
14
+
mkEnableOption
15
+
mkIf
16
+
mkOption
17
+
types
18
+
;
19
+
20
+
cfg = config.lass.folderPerms;
21
+
22
+
out = {
23
+
options.lass.folderPerms = api;
24
+
config = mkIf cfg.enable imp;
25
+
};
26
+
27
+
api = {
28
+
enable = mkEnableOption "folder permissions";
29
+
permissions = mkOption {
30
+
type = with types; listOf (submodule ({
31
+
options = {
32
+
path = mkOption {
33
+
type = str;
34
+
};
35
+
permission = mkOption {
36
+
type = nullOr str;
37
+
example = "755";
38
+
description = ''
39
+
basically anything that chmod takes as permission
40
+
'';
41
+
default = null;
42
+
};
43
+
owner = mkOption {
44
+
type = nullOr str;
45
+
example = "root:root";
46
+
description = ''
47
+
basically anything that chown takes as owner
48
+
'';
49
+
default = null;
50
+
};
51
+
};
52
+
}));
53
+
};
54
+
};
55
+
56
+
imp = {
57
+
systemd.services.lass-folderPerms = {
58
+
description = "lass-folderPerms";
59
+
wantedBy = [ "multi-user.target" ];
60
+
61
+
path = with pkgs; [
62
+
coreutils
63
+
];
64
+
65
+
restartIfChanged = true;
66
+
67
+
serviceConfig = {
68
+
type = "simple";
69
+
RemainAfterExit = true;
70
+
Restart = "always";
71
+
ExecStart = "@${startScript}";
72
+
};
73
+
};
74
+
};
75
+
76
+
startScript = writeScript "lass-folderPerms" ''
77
+
${concatMapStringsSep "\n" writeCommand cfg.permissions}
78
+
'';
79
+
80
+
writeCommand = fperm:
81
+
concatStringsSep "\n" [
82
+
(buildPermission fperm)
83
+
(buildOwner fperm)
84
+
];
85
+
86
+
buildPermission = perm:
87
+
#TODO: create folder maybe
88
+
#TODO: check if permission is valid
89
+
if (perm.permission == null) then
90
+
""
91
+
else
92
+
"chmod ${perm.permission} ${perm.path}"
93
+
;
94
+
95
+
buildOwner = perm:
96
+
#TODO: create folder maybe
97
+
#TODO: check if owner/group valid
98
+
if (perm.owner == null) then
99
+
""
100
+
else
101
+
"chown ${perm.owner} ${perm.path}"
102
+
;
103
+
104
+
in out
+12
nixos/3modules/hosts.nix
+12
nixos/3modules/hosts.nix
+24
nixos/3modules/icecast.nix
+24
nixos/3modules/icecast.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
cfg = config.lass.icecast;
4
+
5
+
format = pkgs.formats.json {};
6
+
in
7
+
{
8
+
options.lass.icecast = {
9
+
enable = lib.mkEnableOption "icecast";
10
+
configFile = lib.mkOption {
11
+
type = pkgs.stockholm.lib.types.absolute-pathname;
12
+
default = pkgs.writeText "icecast.xml" ''
13
+
<icecast>
14
+
</icecast>
15
+
'';
16
+
};
17
+
settings = lib.mkOption {
18
+
description = lib.mdDoc "icecast.xml as a nix attrset."
19
+
type = lib.types.submodule {
20
+
freeformType = format.type;
21
+
}
22
+
};
23
+
};
24
+
}
+76
nixos/3modules/klem.nix
+76
nixos/3modules/klem.nix
···
1
+
{ self, config, lib, pkgs, ... }: with lib; let
2
+
cfg = config.lass.klem;
3
+
slib = self.inputs.stockholm.lib;
4
+
in {
5
+
options.lass.klem = mkOption {
6
+
default = {};
7
+
type = types.attrsOf (types.submodule ({ config, ...}: {
8
+
options = {
9
+
target = mkOption {
10
+
default = ".*";
11
+
description = ''
12
+
regex of valid targets
13
+
can be shown with xclip -selection clipboard -t TARGETS
14
+
the first hit is taken as target argument
15
+
'';
16
+
type = types.str;
17
+
};
18
+
script = mkOption {
19
+
description = ''
20
+
file to run if entry is selected
21
+
'';
22
+
type = types.path;
23
+
};
24
+
label = mkOption {
25
+
default = config._module.args.name;
26
+
description = ''
27
+
label to show in dmenu for this script
28
+
'';
29
+
type = types.str;
30
+
};
31
+
};
32
+
}));
33
+
};
34
+
config = let
35
+
klem = pkgs.writers.writeDashBin "klem" ''
36
+
set -x
37
+
38
+
labels=""
39
+
# match filetype against patterns
40
+
${concatMapStringsSep "\n" (script: ''
41
+
${pkgs.xclip}/bin/xclip -selection clipboard -target TARGETS -out \
42
+
| ${pkgs.gnugrep}/bin/grep -q '${script.target}'
43
+
if [ $? -eq 0 ]; then
44
+
labels="$labels:${script.label}"
45
+
fi
46
+
'') (attrValues cfg)}
47
+
48
+
#remove empty line, feed into dmenu
49
+
script=$(echo "$labels" \
50
+
| ${pkgs.gnused}/bin/sed 's/^://;s/:/\n/g' \
51
+
| ${pkgs.dmenu}/bin/dmenu)
52
+
53
+
#run the chosen script
54
+
case $script in
55
+
${concatMapStringsSep "\n" (script: slib.indent ''
56
+
${script.label})
57
+
target=$(${pkgs.xclip}/bin/xclip -selection clipboard -target TARGETS -out \
58
+
| ${pkgs.gnugrep}/bin/grep '${script.target}' \
59
+
| ${pkgs.gnugrep}/bin/grep -v TARGETS \
60
+
| ${pkgs.coreutils}/bin/head -1)
61
+
${pkgs.xclip}/bin/xclip -selection clipboard -target "$target" -out \
62
+
| ${script.script} \
63
+
| ${pkgs.xclip}/bin/xclip -selection clipboard -in
64
+
;;
65
+
'') (attrValues cfg)}
66
+
esac
67
+
'';
68
+
in mkIf (cfg != {}) {
69
+
environment.systemPackages = [ klem ];
70
+
nixpkgs.overlays = [
71
+
(self: super: {
72
+
klem = klem;
73
+
})
74
+
];
75
+
};
76
+
}
+86
nixos/3modules/mysql-backup.nix
+86
nixos/3modules/mysql-backup.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
with lib;
4
+
5
+
let
6
+
7
+
cfg = config.lass.mysqlBackup;
8
+
9
+
out = {
10
+
options.lass.mysqlBackup = api;
11
+
config = mkIf cfg.enable imp;
12
+
};
13
+
14
+
api = {
15
+
enable = mkEnableOption "mysqlBackup";
16
+
config = mkOption {
17
+
type = with types; attrsOf (submodule ({ config, ... }: {
18
+
options = {
19
+
name = mkOption {
20
+
type = types.str;
21
+
default = config._module.args.name;
22
+
};
23
+
startAt = mkOption {
24
+
type = with types; nullOr str; # TODO systemd.time(7)'s calendar event
25
+
default = "*-*-* 01:15:00";
26
+
};
27
+
user = mkOption {
28
+
type = str;
29
+
default = "root";
30
+
};
31
+
password = mkOption {
32
+
type = nullOr str;
33
+
default = null;
34
+
description = ''
35
+
path to a file containing the mysqlPassword for the specified user.
36
+
'';
37
+
};
38
+
databases = mkOption {
39
+
type = listOf str;
40
+
default = [];
41
+
};
42
+
location = mkOption {
43
+
type = str;
44
+
default = "/backups/sql_dumps";
45
+
};
46
+
};
47
+
}));
48
+
description = "configuration for mysqlBackup";
49
+
};
50
+
};
51
+
52
+
imp = {
53
+
54
+
services.mysql.ensureUsers = [
55
+
{ ensurePermissions = { "*.*" = "ALL"; }; name = "root"; }
56
+
];
57
+
58
+
systemd.services =
59
+
mapAttrs' (_: plan: nameValuePair "mysqlBackup-${plan.name}" {
60
+
path = with pkgs; [
61
+
mysql
62
+
gzip
63
+
];
64
+
serviceConfig = rec {
65
+
ExecStart = start plan;
66
+
SyslogIdentifier = ExecStart.name;
67
+
Type = "oneshot";
68
+
User = plan.user;
69
+
};
70
+
startAt = plan.startAt;
71
+
}) cfg.config;
72
+
};
73
+
74
+
75
+
start = plan: let
76
+
backupScript = plan: db: ''
77
+
mkdir -p ${plan.location}
78
+
mysqldump -u ${plan.user} ${optionalString (plan.password != null) "-p$(cat ${plan.password})"} ${db} | gzip -c > ${plan.location}/${db}.gz
79
+
'';
80
+
81
+
in pkgs.pkgs.writeDash "mysqlBackup.${plan.name}" ''
82
+
${concatMapStringsSep "\n" (backupScript plan) plan.databases}
83
+
'';
84
+
85
+
86
+
in out
+161
nixos/3modules/nichtparasoup.nix
+161
nixos/3modules/nichtparasoup.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
with lib;
4
+
5
+
{
6
+
options.lass.nichtparasoup = {
7
+
enable = mkEnableOption "nichtparasoup funny image page";
8
+
config = mkOption {
9
+
type = types.str;
10
+
default = ''
11
+
[General]
12
+
Port: 5001
13
+
IP: 0.0.0.0
14
+
Useragent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25
15
+
16
+
[Cache]
17
+
Images_min_limit: 15
18
+
19
+
[Logging]
20
+
;; possible destinations: file syslog
21
+
Destination: syslog
22
+
Verbosity: ERROR
23
+
24
+
[Sites]
25
+
SoupIO: everyone
26
+
Pr0gramm: new,top
27
+
Reddit: ${lib.concatStringsSep "," [
28
+
"2healthbars"
29
+
"abandonedporn"
30
+
"animalsbeingderps"
31
+
"ANormalDayInRussia"
32
+
"assholedesign"
33
+
"AwesomeOffBrands"
34
+
"bizarrebuildings"
35
+
"bonehurtingjuice"
36
+
"boottoobig"
37
+
"bossfight"
38
+
"bravofotogeschichten"
39
+
"breathinginformation"
40
+
"buddhistmemes"
41
+
"cablefail"
42
+
"cableporn"
43
+
"catastrophicfailure"
44
+
"chairsunderwater"
45
+
"clevercomebacks"
46
+
"confusingperspective"
47
+
"conni"
48
+
"crappydesign"
49
+
"cursedcomments"
50
+
"desirepath"
51
+
"doenerverbrechen"
52
+
"dontdeadopeninside"
53
+
"educationalgifs"
54
+
"EngineeringPorn"
55
+
"eyebleach"
56
+
"forbiddensnacks"
57
+
"funnyanimals"
58
+
"gifs"
59
+
"Gittertiere"
60
+
"goodboomerhumor"
61
+
"grssk"
62
+
"halthoch"
63
+
"hmm"
64
+
"hmmm"
65
+
"holdmybeer"
66
+
"holup"
67
+
"iamatotalpieceofshit"
68
+
"ichbin40undlustig"
69
+
"idiotsincars"
70
+
"illegallysmolcats"
71
+
"infokriegerkutschen"
72
+
"instagramreality"
73
+
"instant_regret"
74
+
"itrunsdoom"
75
+
"itsaunixsystem"
76
+
"kamikazebywords"
77
+
"keming"
78
+
"kidsarefuckingstupid"
79
+
"kitchenconfidential"
80
+
"laughingbuddha"
81
+
"LiminalSpace"
82
+
"loadingicon"
83
+
"MachinePorn"
84
+
"mallninjashit"
85
+
"michaelbaygifs"
86
+
"mildlyinfuriating"
87
+
"miscatculations"
88
+
"natureisfuckinglit"
89
+
"nononoyesno"
90
+
"notinteresting"
91
+
"notliketheothergirls"
92
+
"oddlysatisfying"
93
+
"ofcoursethatsathing"
94
+
"okbuddylinux"
95
+
"OSHA"
96
+
"PeopleFuckingDying"
97
+
"Perfectfit"
98
+
"perfectloops"
99
+
"PerfectTiming"
100
+
"picsofunusualbirds"
101
+
"PixelArt"
102
+
"pizzacrimes"
103
+
"prequelmemes"
104
+
"Prisonwallet"
105
+
"reactiongifs"
106
+
"RealFakeDoors"
107
+
"reallifedoodles"
108
+
"RetroFuturism"
109
+
"robotsbeingjerks"
110
+
"SchizophreniaRides"
111
+
"scriptedasiangifs"
112
+
"shitposting"
113
+
"shittyfoodporn"
114
+
"shittyrobots"
115
+
"softwaregore"
116
+
"specializedtools"
117
+
"spicypillows"
118
+
"StallmanWasRight"
119
+
"startledcats"
120
+
"startrekstabilized"
121
+
"stupidfood"
122
+
"techsupportgore"
123
+
"thathappened"
124
+
"ThingsCutInHalfPorn"
125
+
"totallynotrobots"
126
+
"trippinthroughtime"
127
+
"Unexpected"
128
+
"urbanexploration"
129
+
"wasletztepreis"
130
+
"wellthatsucks"
131
+
"wertekinder"
132
+
"wewantplates"
133
+
"whatcouldgowrong"
134
+
"whatsthisbug"
135
+
"whatsthisplant"
136
+
"whatswrongwithyourdog"
137
+
"whenthe"
138
+
"yesyesyesyesno"
139
+
"youseeingthisshit"
140
+
]}
141
+
NineGag: geeky,wtf,hot,trending
142
+
Instagram: nature,wtf
143
+
Fourchan: sci
144
+
'';
145
+
};
146
+
};
147
+
148
+
config = mkIf config.lass.nichtparasoup.enable {
149
+
systemd.services.nichtparasoup = {
150
+
description = "nichtparasoup";
151
+
after = [ "network.target" ];
152
+
wantedBy = [ "multi-user.target" ];
153
+
154
+
restartIfChanged = true;
155
+
serviceConfig = {
156
+
Restart = "always";
157
+
ExecStart = "${pkgs.nichtparasoup}/bin/nichtparasoup -c ${pkgs.writeText "config.ini" config.lass.nichtparasoup.config}";
158
+
};
159
+
};
160
+
};
161
+
}
+37
nixos/3modules/screenlock.nix
+37
nixos/3modules/screenlock.nix
···
1
+
{ pkgs, lib, config, ... }:
2
+
let
3
+
cfg = config.lass.screenlock;
4
+
5
+
out = {
6
+
options.lass.screenlock = api;
7
+
config = lib.mkIf cfg.enable imp;
8
+
};
9
+
10
+
api = {
11
+
enable = lib.mkEnableOption "screenlock";
12
+
command = lib.mkOption {
13
+
type = lib.types.path;
14
+
default = pkgs.writers.writeDash "screenlock" ''
15
+
${pkgs.xlockmore}/bin/xlock -mode life1d -size 1
16
+
sleep 3
17
+
'';
18
+
};
19
+
};
20
+
21
+
imp = {
22
+
systemd.services.screenlock = {
23
+
before = [ "sleep.target" ];
24
+
requiredBy = [ "sleep.target" ];
25
+
environment = {
26
+
DISPLAY = ":${toString config.services.xserver.display}";
27
+
};
28
+
serviceConfig = {
29
+
SyslogIdentifier = "screenlock";
30
+
ExecStart = cfg.command;
31
+
Type = "simple";
32
+
User = "lass";
33
+
};
34
+
};
35
+
};
36
+
37
+
in out
+148
nixos/3modules/usershadow.nix
+148
nixos/3modules/usershadow.nix
···
1
+
{ config, lib, pkgs, ... }@args: with lib; let
2
+
3
+
cfg = config.lass.usershadow;
4
+
5
+
out = {
6
+
options.lass.usershadow = api;
7
+
config = lib.mkIf cfg.enable imp;
8
+
};
9
+
10
+
api = {
11
+
enable = mkEnableOption "usershadow";
12
+
pattern = mkOption {
13
+
type = types.str;
14
+
default = "/home/%/.shadow";
15
+
};
16
+
path = mkOption {
17
+
type = types.str;
18
+
};
19
+
};
20
+
21
+
debugscript = pkgs.writeDash "testpam" ''
22
+
env > /tmp/xxx
23
+
echo xxx >> /tmp/xxx
24
+
${pkgs.coreutils}/bin/cat /home/testuser/.shadow >> /tmp/xxx
25
+
echo yyy >> /tmp/xxx
26
+
env >> /tmp/xxx
27
+
exit 23
28
+
'';
29
+
30
+
imp = {
31
+
environment.systemPackages = [ usershadow ];
32
+
lass.usershadow.path = "${usershadow}";
33
+
security.pam.services.sshd.text = ''
34
+
auth required pam_exec.so expose_authtok /run/wrappers/bin/shadow_verify_pam ${cfg.pattern}
35
+
auth required pam_permit.so
36
+
account required pam_permit.so
37
+
session required pam_permit.so
38
+
'';
39
+
40
+
security.pam.services.dovecot2.text = ''
41
+
auth required pam_exec.so expose_authtok /run/wrappers/bin/shadow_verify_pam ${cfg.pattern}
42
+
auth required pam_permit.so
43
+
account required pam_permit.so
44
+
session required pam_permit.so
45
+
'';
46
+
47
+
security.wrappers.shadow_verify_pam = {
48
+
setuid = true;
49
+
source = "${usershadow}/bin/verify_pam";
50
+
owner = "root";
51
+
group = "root";
52
+
};
53
+
security.wrappers.shadow_verify_arg = {
54
+
setuid = true;
55
+
source = "${usershadow}/bin/verify_arg";
56
+
owner = "root";
57
+
group = "root";
58
+
};
59
+
};
60
+
61
+
usershadow = let {
62
+
deps = [
63
+
"pwstore-fast"
64
+
"bytestring"
65
+
];
66
+
body = pkgs.writeHaskellPackage "passwords" {
67
+
ghc-options = [
68
+
"-rtsopts"
69
+
"-Wall"
70
+
];
71
+
executables.verify_pam = {
72
+
extra-depends = deps;
73
+
text = ''
74
+
import System.IO
75
+
import Data.Char (chr)
76
+
import System.Environment (getEnv, getArgs)
77
+
import Crypto.PasswordStore (verifyPasswordWith, pbkdf2)
78
+
import qualified Data.ByteString.Char8 as BS8
79
+
import System.Exit (exitFailure, exitSuccess)
80
+
81
+
main :: IO ()
82
+
main = do
83
+
user <- getEnv "PAM_USER"
84
+
shadowFilePattern <- head <$> getArgs
85
+
let shadowFile = lhs <> user <> tail rhs
86
+
(lhs, rhs) = span (/= '%') shadowFilePattern
87
+
hash <- readFile shadowFile
88
+
password <- takeWhile (/= (chr 0)) <$> hGetLine stdin
89
+
let res = verifyPasswordWith pbkdf2 (2^) (BS8.pack password) (BS8.pack hash)
90
+
if res then exitSuccess else exitFailure
91
+
'';
92
+
};
93
+
executables.verify_arg = {
94
+
extra-depends = deps;
95
+
text = ''
96
+
import System.Environment (getArgs)
97
+
import Crypto.PasswordStore (verifyPasswordWith, pbkdf2)
98
+
import qualified Data.ByteString.Char8 as BS8
99
+
import System.Exit (exitFailure, exitSuccess)
100
+
101
+
main :: IO ()
102
+
main = do
103
+
argsList <- getArgs
104
+
let shadowFilePattern = argsList !! 0
105
+
let user = argsList !! 1
106
+
let password = argsList !! 2
107
+
let shadowFile = lhs <> user <> tail rhs
108
+
(lhs, rhs) = span (/= '%') shadowFilePattern
109
+
hash <- readFile shadowFile
110
+
let res = verifyPasswordWith pbkdf2 (2^) (BS8.pack password) (BS8.pack hash)
111
+
if res then do (putStr "yes") else exitFailure
112
+
'';
113
+
};
114
+
executables.passwd = {
115
+
extra-depends = deps;
116
+
text = ''
117
+
import System.Environment (getEnv)
118
+
import Crypto.PasswordStore (makePasswordWith, pbkdf2)
119
+
import qualified Data.ByteString.Char8 as BS8
120
+
import System.IO (stdin, stdout, hSetEcho, hFlush, putStr, putStrLn)
121
+
import Control.Exception (bracket_)
122
+
123
+
main :: IO ()
124
+
main = do
125
+
home <- getEnv "HOME"
126
+
mb_password <- bracket_ (hSetEcho stdin False) (hSetEcho stdin True) $ do
127
+
putStr "Enter new UNIX password: "
128
+
hFlush stdout
129
+
password <- BS8.hGetLine stdin
130
+
putStrLn ""
131
+
putStr "Retype new UNIX password: "
132
+
hFlush stdout
133
+
password2 <- BS8.hGetLine stdin
134
+
return $ if password == password2
135
+
then Just password
136
+
else Nothing
137
+
case mb_password of
138
+
Just password -> do
139
+
hash <- makePasswordWith pbkdf2 password 10
140
+
BS8.writeFile (home ++ "/.shadow") hash
141
+
putStrLn "passwd: all authentication tokens updated successfully."
142
+
Nothing -> putStrLn "Sorry, passwords do not match"
143
+
'';
144
+
};
145
+
};
146
+
};
147
+
148
+
in out
+10
nixos/4lib/default.nix
+10
nixos/4lib/default.nix
+24
nixos/5pkgs/default.nix
+24
nixos/5pkgs/default.nix
···
1
+
self: super: let
2
+
lib = super.lib;
3
+
4
+
# This callPackage will try to detect obsolete overrides.
5
+
callPackage = path: args: let
6
+
override = super.callPackage path args;
7
+
upstream = lib.optionalAttrs (override ? "name")
8
+
(super.${(builtins.parseDrvName override.name).name} or {});
9
+
in if upstream ? "name" &&
10
+
override ? "name" &&
11
+
builtins.compareVersions upstream.name override.name != -1
12
+
then
13
+
builtins.trace
14
+
"Upstream `${upstream.name}' gets overridden by `${override.name}'."
15
+
override
16
+
else override;
17
+
18
+
subdirsOf = path:
19
+
lib.mapAttrs (name: _: path + "/${name}")
20
+
(lib.filterAttrs (_: x: x == "directory") (builtins.readDir path));
21
+
22
+
in lib.mapAttrs (_: lib.flip callPackage {})
23
+
(lib.filterAttrs (_: dir: lib.pathExists (dir + "/default.nix"))
24
+
(subdirsOf ./.))
+39
nixos/2configs/antimicrox/default.nix
+39
nixos/2configs/antimicrox/default.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
systemd.services.antimicrox = {
4
+
after = [ "display-manager.service" ];
5
+
wantedBy = [ "multi-user.target" ];
6
+
environment = {
7
+
DISPLAY = ":0";
8
+
};
9
+
serviceConfig = {
10
+
User = config.users.users.mainUser.name;
11
+
ExecStartPre = lib.singleton (pkgs.writeDash "init_state" "echo 0 > /tmp/gamepad.state");
12
+
ExecStart = "${pkgs.antimicrox}/bin/antimicrox --hidden --profile ${./mouse.gamecontroller.amgp}";
13
+
};
14
+
};
15
+
16
+
services.udev.extraRules = ''
17
+
KERNEL=="uinput", MODE="0660", GROUP="input", OPTIONS+="static_node=uinput"
18
+
'';
19
+
20
+
environment.systemPackages = [
21
+
pkgs.antimicrox
22
+
(pkgs.writers.writeDashBin "gamepad_mouse_disable" ''
23
+
echo 1 > /tmp/gamepad.state
24
+
${pkgs.antimicrox}/bin/antimicrox --profile ${./empty.gamecontroller.amgp}
25
+
'')
26
+
(pkgs.writers.writeDashBin "gamepad_mouse_enable" ''
27
+
echo 0 > /tmp/gamepad.state
28
+
${pkgs.antimicrox}/bin/antimicrox --profile ${./mouse.gamecontroller.amgp}
29
+
'')
30
+
(pkgs.writers.writeDashBin "gamepad_mouse_toggle" ''
31
+
state=$(${pkgs.coreutils}/bin/cat /tmp/gamepad.state)
32
+
if [ "$state" = 1 ]; then
33
+
/run/current-system/sw/bin/gamepad_mouse_enable
34
+
else
35
+
/run/current-system/sw/bin/gamepad_mouse_disable
36
+
fi
37
+
'')
38
+
];
39
+
}
+20
nixos/2configs/antimicrox/empty.gamecontroller.amgp
+20
nixos/2configs/antimicrox/empty.gamecontroller.amgp
···
1
+
<?xml version="1.0" encoding="UTF-8"?>
2
+
<gamecontroller configversion="19" appversion="3.3.2">
3
+
<!--The SDL name for a joystick is included for informational purposes only.-->
4
+
<sdlname>XInput Controller</sdlname>
5
+
<!--The Unique ID for a joystick is included for informational purposes only.-->
6
+
<uniqueID>030000005e0400008e020000010100001118654</uniqueID>
7
+
<stickAxisAssociation index="2" xAxis="3" yAxis="4"/>
8
+
<stickAxisAssociation index="1" xAxis="1" yAxis="2"/>
9
+
<vdpadButtonAssociations index="1">
10
+
<vdpadButtonAssociation axis="0" button="12" direction="1"/>
11
+
<vdpadButtonAssociation axis="0" button="13" direction="4"/>
12
+
<vdpadButtonAssociation axis="0" button="14" direction="8"/>
13
+
<vdpadButtonAssociation axis="0" button="15" direction="2"/>
14
+
</vdpadButtonAssociations>
15
+
<names>
16
+
<controlstickname index="2">R Stick</controlstickname>
17
+
<controlstickname index="1">L Stick</controlstickname>
18
+
</names>
19
+
<sets/>
20
+
</gamecontroller>
+281
nixos/2configs/antimicrox/mouse.gamecontroller.amgp
+281
nixos/2configs/antimicrox/mouse.gamecontroller.amgp
···
1
+
<?xml version="1.0" encoding="UTF-8"?>
2
+
<gamecontroller configversion="19" appversion="3.3.2">
3
+
<!--The SDL name for a joystick is included for informational purposes only.-->
4
+
<sdlname>XInput Controller</sdlname>
5
+
<!--The Unique ID for a joystick is included for informational purposes only.-->
6
+
<uniqueID>030000005e0400008e020000010100001118654</uniqueID>
7
+
<stickAxisAssociation index="2" xAxis="3" yAxis="4"/>
8
+
<stickAxisAssociation index="1" xAxis="1" yAxis="2"/>
9
+
<vdpadButtonAssociations index="1">
10
+
<vdpadButtonAssociation axis="0" button="12" direction="1"/>
11
+
<vdpadButtonAssociation axis="0" button="13" direction="4"/>
12
+
<vdpadButtonAssociation axis="0" button="14" direction="8"/>
13
+
<vdpadButtonAssociation axis="0" button="15" direction="2"/>
14
+
</vdpadButtonAssociations>
15
+
<names>
16
+
<controlstickname index="2">Stick 2</controlstickname>
17
+
<controlstickname index="1">Stick 1</controlstickname>
18
+
</names>
19
+
<sets>
20
+
<set index="1">
21
+
<stick index="2">
22
+
<deadZone>1</deadZone>
23
+
<maxZone>29501</maxZone>
24
+
<modifierZone>1412</modifierZone>
25
+
<diagonalRange>90</diagonalRange>
26
+
<squareStick>100</squareStick>
27
+
<stickbutton index="1">
28
+
<mousespeedx>74</mousespeedx>
29
+
<mousespeedy>74</mousespeedy>
30
+
<accelerationmultiplier>4</accelerationmultiplier>
31
+
<startaccelmultiplier>20</startaccelmultiplier>
32
+
<minaccelthreshold>3</minaccelthreshold>
33
+
<extraaccelerationcurve>easeoutquad</extraaccelerationcurve>
34
+
<slots>
35
+
<slot>
36
+
<code>1</code>
37
+
<mode>mousemovement</mode>
38
+
</slot>
39
+
</slots>
40
+
</stickbutton>
41
+
<stickbutton index="3">
42
+
<mousespeedx>74</mousespeedx>
43
+
<mousespeedy>74</mousespeedy>
44
+
<accelerationmultiplier>4</accelerationmultiplier>
45
+
<startaccelmultiplier>20</startaccelmultiplier>
46
+
<minaccelthreshold>3</minaccelthreshold>
47
+
<extraaccelerationcurve>easeoutquad</extraaccelerationcurve>
48
+
<slots>
49
+
<slot>
50
+
<code>4</code>
51
+
<mode>mousemovement</mode>
52
+
</slot>
53
+
</slots>
54
+
</stickbutton>
55
+
<stickbutton index="2">
56
+
<mousespeedx>74</mousespeedx>
57
+
<mousespeedy>74</mousespeedy>
58
+
</stickbutton>
59
+
<stickbutton index="5">
60
+
<mousespeedx>74</mousespeedx>
61
+
<mousespeedy>74</mousespeedy>
62
+
<accelerationmultiplier>4</accelerationmultiplier>
63
+
<startaccelmultiplier>20</startaccelmultiplier>
64
+
<minaccelthreshold>3</minaccelthreshold>
65
+
<extraaccelerationcurve>easeoutquad</extraaccelerationcurve>
66
+
<slots>
67
+
<slot>
68
+
<code>2</code>
69
+
<mode>mousemovement</mode>
70
+
</slot>
71
+
</slots>
72
+
</stickbutton>
73
+
<stickbutton index="4">
74
+
<mousespeedx>74</mousespeedx>
75
+
<mousespeedy>74</mousespeedy>
76
+
</stickbutton>
77
+
<stickbutton index="7">
78
+
<mousespeedx>74</mousespeedx>
79
+
<mousespeedy>74</mousespeedy>
80
+
<accelerationmultiplier>4</accelerationmultiplier>
81
+
<startaccelmultiplier>20</startaccelmultiplier>
82
+
<minaccelthreshold>3</minaccelthreshold>
83
+
<extraaccelerationcurve>easeoutquad</extraaccelerationcurve>
84
+
<slots>
85
+
<slot>
86
+
<code>3</code>
87
+
<mode>mousemovement</mode>
88
+
</slot>
89
+
</slots>
90
+
</stickbutton>
91
+
<stickbutton index="6">
92
+
<mousespeedx>74</mousespeedx>
93
+
<mousespeedy>74</mousespeedy>
94
+
</stickbutton>
95
+
<stickbutton index="8">
96
+
<mousespeedx>74</mousespeedx>
97
+
<mousespeedy>74</mousespeedy>
98
+
</stickbutton>
99
+
</stick>
100
+
<stick index="1">
101
+
<deadZone>2578</deadZone>
102
+
<maxZone>30799</maxZone>
103
+
<stickbutton index="1">
104
+
<mouseacceleration>linear</mouseacceleration>
105
+
<slots>
106
+
<slot>
107
+
<code>4</code>
108
+
<mode>mousebutton</mode>
109
+
</slot>
110
+
</slots>
111
+
</stickbutton>
112
+
<stickbutton index="3">
113
+
<mouseacceleration>linear</mouseacceleration>
114
+
<slots>
115
+
<slot>
116
+
<code>7</code>
117
+
<mode>mousebutton</mode>
118
+
</slot>
119
+
</slots>
120
+
</stickbutton>
121
+
<stickbutton index="2">
122
+
<mouseacceleration>linear</mouseacceleration>
123
+
</stickbutton>
124
+
<stickbutton index="5">
125
+
<mouseacceleration>linear</mouseacceleration>
126
+
<slots>
127
+
<slot>
128
+
<code>5</code>
129
+
<mode>mousebutton</mode>
130
+
</slot>
131
+
</slots>
132
+
</stickbutton>
133
+
<stickbutton index="4">
134
+
<mouseacceleration>linear</mouseacceleration>
135
+
</stickbutton>
136
+
<stickbutton index="7">
137
+
<mouseacceleration>linear</mouseacceleration>
138
+
<slots>
139
+
<slot>
140
+
<code>6</code>
141
+
<mode>mousebutton</mode>
142
+
</slot>
143
+
</slots>
144
+
</stickbutton>
145
+
<stickbutton index="6">
146
+
<mouseacceleration>linear</mouseacceleration>
147
+
</stickbutton>
148
+
<stickbutton index="8">
149
+
<mouseacceleration>linear</mouseacceleration>
150
+
</stickbutton>
151
+
</stick>
152
+
<dpad index="1">
153
+
<dpadbutton index="12">
154
+
<wheelspeedx>2</wheelspeedx>
155
+
<wheelspeedy>10</wheelspeedy>
156
+
</dpadbutton>
157
+
<dpadbutton index="1">
158
+
<wheelspeedx>10</wheelspeedx>
159
+
<wheelspeedy>10</wheelspeedy>
160
+
<slots>
161
+
<slot>
162
+
<code>0x1000013</code>
163
+
<mode>keyboard</mode>
164
+
</slot>
165
+
</slots>
166
+
</dpadbutton>
167
+
<dpadbutton index="3">
168
+
<wheelspeedx>2</wheelspeedx>
169
+
<wheelspeedy>10</wheelspeedy>
170
+
</dpadbutton>
171
+
<dpadbutton index="2">
172
+
<wheelspeedx>2</wheelspeedx>
173
+
<wheelspeedy>10</wheelspeedy>
174
+
<slots>
175
+
<slot>
176
+
<code>0x1000014</code>
177
+
<mode>keyboard</mode>
178
+
</slot>
179
+
</slots>
180
+
</dpadbutton>
181
+
<dpadbutton index="4">
182
+
<wheelspeedx>2</wheelspeedx>
183
+
<wheelspeedy>10</wheelspeedy>
184
+
<slots>
185
+
<slot>
186
+
<code>0x1000015</code>
187
+
<mode>keyboard</mode>
188
+
</slot>
189
+
</slots>
190
+
</dpadbutton>
191
+
<dpadbutton index="6">
192
+
<wheelspeedx>2</wheelspeedx>
193
+
<wheelspeedy>10</wheelspeedy>
194
+
</dpadbutton>
195
+
<dpadbutton index="9">
196
+
<wheelspeedx>2</wheelspeedx>
197
+
<wheelspeedy>10</wheelspeedy>
198
+
</dpadbutton>
199
+
<dpadbutton index="8">
200
+
<wheelspeedx>2</wheelspeedx>
201
+
<wheelspeedy>10</wheelspeedy>
202
+
<slots>
203
+
<slot>
204
+
<code>0x1000012</code>
205
+
<mode>keyboard</mode>
206
+
</slot>
207
+
</slots>
208
+
</dpadbutton>
209
+
</dpad>
210
+
<trigger index="6">
211
+
<deadZone>2000</deadZone>
212
+
<throttle>positivehalf</throttle>
213
+
<triggerbutton index="1">
214
+
<mousespeedx>100</mousespeedx>
215
+
<mousespeedy>100</mousespeedy>
216
+
</triggerbutton>
217
+
<triggerbutton index="2">
218
+
<mousespeedx>100</mousespeedx>
219
+
<mousespeedy>100</mousespeedy>
220
+
<slots>
221
+
<slot>
222
+
<code>250</code>
223
+
<mode>mousespeedmod</mode>
224
+
</slot>
225
+
</slots>
226
+
</triggerbutton>
227
+
</trigger>
228
+
<trigger index="5">
229
+
<throttle>positivehalf</throttle>
230
+
</trigger>
231
+
<button index="11">
232
+
<slots>
233
+
<slot>
234
+
<code>1</code>
235
+
<mode>mousebutton</mode>
236
+
</slot>
237
+
</slots>
238
+
</button>
239
+
<button index="2">
240
+
<slots>
241
+
<slot>
242
+
<code>3</code>
243
+
<mode>mousebutton</mode>
244
+
</slot>
245
+
</slots>
246
+
</button>
247
+
<button index="1">
248
+
<slots>
249
+
<slot>
250
+
<code>1</code>
251
+
<mode>mousebutton</mode>
252
+
</slot>
253
+
</slots>
254
+
</button>
255
+
<button index="4">
256
+
<slots>
257
+
<slot>
258
+
<code>0x1000004</code>
259
+
<mode>keyboard</mode>
260
+
</slot>
261
+
</slots>
262
+
</button>
263
+
<button index="3">
264
+
<slots>
265
+
<slot>
266
+
<code>2</code>
267
+
<mode>mousebutton</mode>
268
+
</slot>
269
+
</slots>
270
+
</button>
271
+
<button index="5">
272
+
<slots>
273
+
<slot>
274
+
<code>1</code>
275
+
<mode>mousebutton</mode>
276
+
</slot>
277
+
</slots>
278
+
</button>
279
+
</set>
280
+
</sets>
281
+
</gamecontroller>
+57
nixos/2configs/bgt-bot/bgt-check.sh
+57
nixos/2configs/bgt-bot/bgt-check.sh
···
1
+
#!/bin/sh
2
+
# needs in path:
3
+
# curl gnugrep jq
4
+
# creates and manages $PWD/state
5
+
set -xeuf
6
+
7
+
send_reaktor(){
8
+
# usage: send_reaktor "text"
9
+
echo "send_reaktor: $1"
10
+
curl -fsS "http://localhost:$REAKTOR_PORT" \
11
+
-H content-type:application/json \
12
+
-d "$(jq -n \
13
+
--arg text "$1" \
14
+
--arg channel "$IRC_CHANNEL" \
15
+
'{
16
+
command:"PRIVMSG",
17
+
params:[$channel,$text]
18
+
}'
19
+
)"
20
+
}
21
+
22
+
live=$(shuf -n1 <<EOF
23
+
Binärgewitter Liveshow hat begonnen! http://stream.radiotux.de:8000/binaergewitter.mp3
24
+
EOF
25
+
)
26
+
27
+
offline=$(shuf -n1 <<EOF
28
+
Live stream vorbei
29
+
EOF
30
+
)
31
+
error=$(shuf -n1 <<EOF
32
+
something went wrong
33
+
EOF
34
+
)
35
+
36
+
if curl -Ss http://stream.radiotux.de:8000 | grep -q 'Mount Point /binaergewitter'; then
37
+
state='live'
38
+
else
39
+
state='offline'
40
+
fi
41
+
prevstate=$(cat state ||:)
42
+
43
+
if test "$state" == "$(cat state)";then
44
+
#echo "current and last state is the same ($state), doing nothing"
45
+
:
46
+
else
47
+
echo "API state and last state differ ( '$state' != '$prevstate')"
48
+
if test "$state" == 'live';then
49
+
send_reaktor "$live"
50
+
elif test "$state" == 'offline';then
51
+
send_reaktor "$offline"
52
+
else
53
+
send_reaktor "$error"
54
+
fi
55
+
echo 'updating state'
56
+
printf "%s" "$state" > state
57
+
fi
+44
nixos/2configs/bgt-bot/default.nix
+44
nixos/2configs/bgt-bot/default.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
4
+
bot_port = "7654";
5
+
irc_channel = "#binaergewitter";
6
+
in
7
+
{
8
+
krebs.reaktor2.bgt-announce = {
9
+
hostname = "irc.libera.chat";
10
+
port = "6697";
11
+
nick = "bgt-announce";
12
+
API.listen = "inet://127.0.0.1:${bot_port}";
13
+
plugins = [
14
+
{
15
+
plugin = "register";
16
+
config = {
17
+
channels = [
18
+
irc_channel
19
+
];
20
+
};
21
+
}
22
+
];
23
+
};
24
+
systemd.services.check_bgt_show = {
25
+
startAt = "*:0/5";
26
+
environment = {
27
+
IRC_CHANNEL = irc_channel;
28
+
REAKTOR_PORT = bot_port;
29
+
};
30
+
path = with pkgs; [
31
+
curl
32
+
gnugrep
33
+
jq
34
+
];
35
+
script = builtins.readFile ./bgt-check.sh;
36
+
serviceConfig = {
37
+
DynamicUser = true;
38
+
StateDirectory = "bgt-announce";
39
+
WorkingDirectory = "/var/lib/bgt-announce";
40
+
PrivateTmp = true;
41
+
};
42
+
};
43
+
}
44
+
+17
nixos/2configs/binary-cache/client.nix
+17
nixos/2configs/binary-cache/client.nix
···
1
+
{ config, ... }:
2
+
3
+
{
4
+
nix = {
5
+
binaryCaches = [
6
+
"http://cache.prism.r"
7
+
"http://cache.neoprism.r"
8
+
"https://cache.nixos.org/"
9
+
];
10
+
binaryCachePublicKeys = [
11
+
"cache.prism-1:+S+6Lo/n27XEtvdlQKuJIcb1yO5NUqUCE2lolmTgNJU="
12
+
"cache.prism-2:YwmCm3/s/D+SxrPKN/ETjlpw/219pNUbpnluatp6FKI="
13
+
"hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs="
14
+
];
15
+
};
16
+
}
17
+
+13
nixos/2configs/binary-cache/proxy.nix
+13
nixos/2configs/binary-cache/proxy.nix
+31
nixos/2configs/binary-cache/server.nix
+31
nixos/2configs/binary-cache/server.nix
···
1
+
{ config, lib, pkgs, ...}:
2
+
{
3
+
# nixpkgs.config.packageOverrides = p: {
4
+
# nix-serve = p.haskellPackages.nix-serve-ng;
5
+
# };
6
+
# generate private key with:
7
+
# nix-store --generate-binary-cache-key my-secret-key my-public-key
8
+
services.nix-serve = {
9
+
enable = true;
10
+
secretKeyFile = "${config.krebs.secret.directory}/nix-serve.key";
11
+
port = 5005;
12
+
};
13
+
14
+
services.nginx = {
15
+
enable = true;
16
+
virtualHosts.nix-serve = {
17
+
serverAliases = [ "cache.${config.networking.hostName}.r" ];
18
+
locations."/".extraConfig = ''
19
+
proxy_pass http://localhost:${toString config.services.nix-serve.port};
20
+
'';
21
+
locations."= /nix-cache-info".extraConfig = ''
22
+
alias ${pkgs.writeText "cache-info" ''
23
+
StoreDir: /nix/store
24
+
WantMassQuery: 1
25
+
Priority: 42
26
+
''};
27
+
'';
28
+
};
29
+
};
30
+
}
31
+
+10
nixos/2configs/boot/coreboot.nix
+10
nixos/2configs/boot/coreboot.nix
+8
nixos/2configs/boot/stock-x220.nix
+8
nixos/2configs/boot/stock-x220.nix
+11
nixos/2configs/boot/universal.nix
+11
nixos/2configs/boot/universal.nix
+93
nixos/2configs/green-hosts/cryfs.nix
+93
nixos/2configs/green-hosts/cryfs.nix
···
1
+
# seems to work, very slow though
2
+
3
+
{ config, lib, pkgs, ... }:
4
+
let
5
+
6
+
cname = "green-cryfs";
7
+
8
+
in {
9
+
imports = [
10
+
<stockholm/lass/2configs/container-networking.nix>
11
+
<stockholm/lass/2configs/syncthing.nix>
12
+
];
13
+
14
+
programs.fuse.userAllowOther = true;
15
+
16
+
services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/cryfs" = {
17
+
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
18
+
ignorePerms = false;
19
+
};
20
+
21
+
lass.bindfs."/var/lib/sync-containers/${cname}/cryfs" = {
22
+
source = "/var/lib/sync-containers/${cname}/cryfs";
23
+
options = [
24
+
"-M ${toString config.users.users.syncthing.uid} -u root -g root"
25
+
];
26
+
};
27
+
28
+
29
+
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
30
+
containers.${cname} = {
31
+
config = { ... }: {
32
+
environment.systemPackages = [
33
+
pkgs.git
34
+
pkgs.rxvt-unicode-unwrapped.terminfo
35
+
];
36
+
services.openssh.enable = true;
37
+
users.users.root.openssh.authorizedKeys.keys = [
38
+
config.krebs.users.lass.pubkey
39
+
];
40
+
system.activationScripts.fuse = {
41
+
text = ''
42
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
43
+
'';
44
+
deps = [];
45
+
};
46
+
};
47
+
allowedDevices = [
48
+
{ modifier = "rwm"; node = "/dev/fuse"; }
49
+
];
50
+
autoStart = false;
51
+
enableTun = true;
52
+
privateNetwork = true;
53
+
hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
54
+
localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
55
+
};
56
+
57
+
environment.systemPackages = [
58
+
(pkgs.writeDashBin "init-${cname}" ''
59
+
set -euf
60
+
set -x
61
+
62
+
mkdir -p /var/lib/sync-containers/${cname}/cryfs
63
+
'')
64
+
(pkgs.writeDashBin "start-${cname}" ''
65
+
set -euf
66
+
set -x
67
+
68
+
mkdir -p /var/lib/containers/${cname}/var/state
69
+
70
+
STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
71
+
if [ "$STATE" = 'down' ]; then
72
+
${pkgs.nixos-container}/bin/nixos-container start ${cname}
73
+
fi
74
+
75
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
76
+
set -x
77
+
78
+
mkdir -p /var/state/var_src
79
+
ln -sfTr /var/state/var_src /var/src
80
+
touch /etc/NIXOS
81
+
''}
82
+
83
+
if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
84
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
85
+
fi
86
+
'')
87
+
(pkgs.writeDashBin "stop-${cname}" ''
88
+
set -euf
89
+
90
+
${pkgs.nixos-container}/bin/nixos-container stop ${cname}
91
+
'')
92
+
];
93
+
}
+96
nixos/2configs/green-hosts/ecryptfs.nix
+96
nixos/2configs/green-hosts/ecryptfs.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
4
+
cname = "green";
5
+
6
+
in {
7
+
imports = [
8
+
<stockholm/lass/2configs/container-networking.nix>
9
+
<stockholm/lass/2configs/syncthing.nix>
10
+
];
11
+
12
+
programs.fuse.userAllowOther = true;
13
+
14
+
services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/ecryptfs" = {
15
+
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
16
+
ignorePerms = false;
17
+
};
18
+
19
+
krebs.permown."/var/lib/sync-containers/${cname}/ecryptfs" = {
20
+
file-mode = "u+rw";
21
+
directory-mode = "u+rwx";
22
+
owner = "syncthing";
23
+
keepGoing = false;
24
+
};
25
+
26
+
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
27
+
containers.${cname} = {
28
+
config = { ... }: {
29
+
environment.systemPackages = [
30
+
pkgs.git
31
+
pkgs.rxvt-unicode-unwrapped.terminfo
32
+
];
33
+
services.openssh.enable = true;
34
+
users.users.root.openssh.authorizedKeys.keys = [
35
+
config.krebs.users.lass.pubkey
36
+
];
37
+
system.activationScripts.fuse = {
38
+
text = ''
39
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
40
+
'';
41
+
deps = [];
42
+
};
43
+
};
44
+
allowedDevices = [
45
+
{ modifier = "rwm"; node = "/dev/fuse"; }
46
+
];
47
+
autoStart = false;
48
+
enableTun = true;
49
+
privateNetwork = true;
50
+
hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
51
+
localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
52
+
};
53
+
54
+
environment.systemPackages = [
55
+
pkgs.ecryptfs
56
+
pkgs.keyutils
57
+
(pkgs.writeDashBin "start-${cname}" ''
58
+
set -euf
59
+
set -x
60
+
61
+
mkdir -p /var/lib/containers/${cname}/var/state
62
+
63
+
if ! mount | grep -q '/var/lib/sync-containers/${cname}/ecryptfs on /var/lib/containers/${cname}/var/state type ecryptfs'; then
64
+
if [ -e /var/lib/sync-containers/${cname}/ecryptfs/.cfg.json ]; then
65
+
${pkgs.ecrypt}/bin/ecrypt mount /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
66
+
else
67
+
${pkgs.ecrypt}/bin/ecrypt init /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
68
+
fi
69
+
fi
70
+
71
+
STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
72
+
if [ "$STATE" = 'down' ]; then
73
+
${pkgs.nixos-container}/bin/nixos-container start ${cname}
74
+
fi
75
+
76
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
77
+
set -x
78
+
79
+
mkdir -p /var/state/var_src
80
+
ln -sfTr /var/state/var_src /var/src
81
+
touch /etc/NIXOS
82
+
''}
83
+
84
+
if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
85
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
86
+
fi
87
+
'')
88
+
(pkgs.writeDashBin "stop-${cname}" ''
89
+
set -euf
90
+
91
+
${pkgs.nixos-container}/bin/nixos-container stop ${cname}
92
+
${pkgs.ecrypt}/bin/ecrypt unmount /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
93
+
'')
94
+
];
95
+
}
96
+
+89
nixos/2configs/green-hosts/plain-bindfs.nix
+89
nixos/2configs/green-hosts/plain-bindfs.nix
···
1
+
# this seems to work, sadly there are no inotify events on the state directory because bindfs hides them,
2
+
3
+
{ config, lib, pkgs, ... }:
4
+
5
+
let
6
+
7
+
cname = "green-plain";
8
+
9
+
in {
10
+
imports = [
11
+
<stockholm/lass/2configs/container-networking.nix>
12
+
<stockholm/lass/2configs/syncthing.nix>
13
+
];
14
+
15
+
programs.fuse.userAllowOther = true;
16
+
17
+
services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
18
+
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
19
+
ignorePerms = false;
20
+
};
21
+
22
+
lass.bindfs."/var/lib/containers/${cname}/var/state" = {
23
+
source = "/var/lib/containers/${cname}/var/state";
24
+
options = [
25
+
"-M ${toString config.users.users.syncthing.uid} -u root -g root"
26
+
];
27
+
};
28
+
29
+
30
+
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
31
+
containers.${cname} = {
32
+
config = { ... }: {
33
+
environment.systemPackages = [
34
+
pkgs.git
35
+
pkgs.rxvt-unicode-unwrapped.terminfo
36
+
];
37
+
services.openssh.enable = true;
38
+
users.users.root.openssh.authorizedKeys.keys = [
39
+
config.krebs.users.lass.pubkey
40
+
];
41
+
system.activationScripts.fuse = {
42
+
text = ''
43
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
44
+
'';
45
+
deps = [];
46
+
};
47
+
};
48
+
allowedDevices = [
49
+
{ modifier = "rwm"; node = "/dev/fuse"; }
50
+
];
51
+
autoStart = false;
52
+
enableTun = true;
53
+
privateNetwork = true;
54
+
hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
55
+
localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
56
+
};
57
+
58
+
environment.systemPackages = [
59
+
(pkgs.writeDashBin "start-${cname}" ''
60
+
set -euf
61
+
set -x
62
+
63
+
mkdir -p /var/lib/containers/${cname}/var/state
64
+
65
+
STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
66
+
if [ "$STATE" = 'down' ]; then
67
+
${pkgs.nixos-container}/bin/nixos-container start ${cname}
68
+
fi
69
+
70
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
71
+
set -x
72
+
73
+
mkdir -p /var/state/var_src
74
+
ln -sfTr /var/state/var_src /var/src
75
+
touch /etc/NIXOS
76
+
''}
77
+
78
+
if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
79
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
80
+
fi
81
+
'')
82
+
(pkgs.writeDashBin "stop-${cname}" ''
83
+
set -euf
84
+
85
+
${pkgs.nixos-container}/bin/nixos-container stop ${cname}
86
+
'')
87
+
];
88
+
}
89
+
+87
nixos/2configs/green-hosts/plain-permown.nix
+87
nixos/2configs/green-hosts/plain-permown.nix
···
1
+
# this seems to work fine, downsides are, all state is owned by syncthing and could be read by the guests syncthing
2
+
3
+
4
+
{ config, lib, pkgs, ... }:
5
+
6
+
let
7
+
8
+
cname = "green-plain";
9
+
10
+
in {
11
+
imports = [
12
+
<stockholm/lass/2configs/container-networking.nix>
13
+
<stockholm/lass/2configs/syncthing.nix>
14
+
];
15
+
16
+
services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
17
+
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
18
+
ignorePerms = false;
19
+
};
20
+
21
+
krebs.permown."/var/lib/containers/${cname}/var/state" = {
22
+
file-mode = "u+rw";
23
+
directory-mode = "u+rwx";
24
+
owner = "syncthing";
25
+
keepGoing = true;
26
+
};
27
+
28
+
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
29
+
containers.${cname} = {
30
+
config = { ... }: {
31
+
environment.systemPackages = [
32
+
pkgs.git
33
+
pkgs.rxvt-unicode-unwrapped.terminfo
34
+
];
35
+
services.openssh.enable = true;
36
+
users.users.root.openssh.authorizedKeys.keys = [
37
+
config.krebs.users.lass.pubkey
38
+
];
39
+
system.activationScripts.fuse = {
40
+
text = ''
41
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
42
+
'';
43
+
deps = [];
44
+
};
45
+
};
46
+
allowedDevices = [
47
+
{ modifier = "rwm"; node = "/dev/fuse"; }
48
+
];
49
+
autoStart = false;
50
+
enableTun = true;
51
+
privateNetwork = true;
52
+
hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
53
+
localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
54
+
};
55
+
56
+
environment.systemPackages = [
57
+
(pkgs.writeDashBin "start-${cname}" ''
58
+
set -euf
59
+
set -x
60
+
61
+
mkdir -p /var/lib/containers/${cname}/var/state
62
+
63
+
STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
64
+
if [ "$STATE" = 'down' ]; then
65
+
${pkgs.nixos-container}/bin/nixos-container start ${cname}
66
+
fi
67
+
68
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
69
+
set -x
70
+
71
+
mkdir -p /var/state/var_src
72
+
ln -sfTr /var/state/var_src /var/src
73
+
touch /etc/NIXOS
74
+
''}
75
+
76
+
if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
77
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
78
+
fi
79
+
'')
80
+
(pkgs.writeDashBin "stop-${cname}" ''
81
+
set -euf
82
+
83
+
${pkgs.nixos-container}/bin/nixos-container stop ${cname}
84
+
'')
85
+
];
86
+
}
87
+
+85
nixos/2configs/green-hosts/plain.nix
+85
nixos/2configs/green-hosts/plain.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
4
+
cname = "green-plain";
5
+
6
+
in {
7
+
imports = [
8
+
<stockholm/lass/2configs/container-networking.nix>
9
+
<stockholm/lass/2configs/syncthing.nix>
10
+
];
11
+
12
+
programs.fuse.userAllowOther = true;
13
+
14
+
services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
15
+
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
16
+
ignorePerms = false;
17
+
};
18
+
19
+
krebs.permown."/var/lib/containers/${cname}/var/state" = {
20
+
file-mode = "u+rw";
21
+
directory-mode = "u+rwx";
22
+
owner = "syncthing";
23
+
keepGoing = true;
24
+
};
25
+
26
+
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
27
+
containers.${cname} = {
28
+
config = { ... }: {
29
+
environment.systemPackages = [
30
+
pkgs.git
31
+
pkgs.rxvt-unicode-unwrapped.terminfo
32
+
];
33
+
services.openssh.enable = true;
34
+
users.users.root.openssh.authorizedKeys.keys = [
35
+
config.krebs.users.lass.pubkey
36
+
];
37
+
system.activationScripts.fuse = {
38
+
text = ''
39
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
40
+
'';
41
+
deps = [];
42
+
};
43
+
};
44
+
allowedDevices = [
45
+
{ modifier = "rwm"; node = "/dev/fuse"; }
46
+
];
47
+
autoStart = false;
48
+
enableTun = true;
49
+
privateNetwork = true;
50
+
hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
51
+
localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
52
+
};
53
+
54
+
environment.systemPackages = [
55
+
(pkgs.writeDashBin "start-${cname}" ''
56
+
set -euf
57
+
set -x
58
+
59
+
mkdir -p /var/lib/containers/${cname}/var/state
60
+
61
+
STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
62
+
if [ "$STATE" = 'down' ]; then
63
+
${pkgs.nixos-container}/bin/nixos-container start ${cname}
64
+
fi
65
+
66
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
67
+
set -x
68
+
69
+
mkdir -p /var/state/var_src
70
+
ln -sfTr /var/state/var_src /var/src
71
+
touch /etc/NIXOS
72
+
''}
73
+
74
+
if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
75
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
76
+
fi
77
+
'')
78
+
(pkgs.writeDashBin "stop-${cname}" ''
79
+
set -euf
80
+
81
+
${pkgs.nixos-container}/bin/nixos-container stop ${cname}
82
+
'')
83
+
];
84
+
}
85
+
+99
nixos/2configs/green-hosts/securefs.nix
+99
nixos/2configs/green-hosts/securefs.nix
···
1
+
# broken, muchsync cant sync into the folders which should be handles by bindfs
2
+
# ls -la also does not show the full directory permissions
3
+
{ config, lib, pkgs, ... }:
4
+
let
5
+
6
+
cname = "green";
7
+
8
+
in {
9
+
imports = [
10
+
<stockholm/lass/2configs/container-networking.nix>
11
+
<stockholm/lass/2configs/syncthing.nix>
12
+
];
13
+
14
+
programs.fuse.userAllowOther = true;
15
+
16
+
services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/securefs" = {
17
+
devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
18
+
ignorePerms = false;
19
+
};
20
+
21
+
krebs.permown."/var/lib/sync-containers/${cname}/securefs" = {
22
+
file-mode = "u+rw";
23
+
directory-mode = "u+rwx";
24
+
owner = "syncthing";
25
+
keepGoing = false;
26
+
};
27
+
28
+
systemd.services."container@${cname}".reloadIfChanged = mkForce false;
29
+
containers.${cname} = {
30
+
config = { ... }: {
31
+
environment.systemPackages = [
32
+
pkgs.git
33
+
pkgs.rxvt-unicode-unwrapped.terminfo
34
+
];
35
+
services.openssh.enable = true;
36
+
users.users.root.openssh.authorizedKeys.keys = [
37
+
config.krebs.users.lass.pubkey
38
+
];
39
+
system.activationScripts.fuse = {
40
+
text = ''
41
+
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
42
+
'';
43
+
deps = [];
44
+
};
45
+
};
46
+
allowedDevices = [
47
+
{ modifier = "rwm"; node = "/dev/fuse"; }
48
+
];
49
+
autoStart = false;
50
+
enableTun = true;
51
+
privateNetwork = true;
52
+
hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
53
+
localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
54
+
};
55
+
56
+
environment.systemPackages = [
57
+
(pkgs.writeDashBin "start-${cname}" ''
58
+
set -euf
59
+
set -x
60
+
61
+
mkdir -p /var/lib/containers/${cname}/var/state
62
+
63
+
if ! mount | grep -q 'securefs on /var/lib/containers/${cname}/var/state type fuse.securefs'; then
64
+
if ! ${pkgs.securefs}/bin/securefs info /var/lib/sync-containers/${cname}/securefs; then
65
+
${pkgs.securefs}/bin/securefs create --format 4 /var/lib/sync-containers/${cname}/securefs
66
+
fi
67
+
68
+
${pkgs.securefs}/bin/securefs mount -b \
69
+
-o allow_other -o default_permissions \
70
+
--log /var/lib/sync-containers/${cname}/securefs.log \
71
+
/var/lib/sync-containers/${cname}/securefs /var/lib/containers/${cname}/var/state
72
+
fi
73
+
74
+
STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
75
+
if [ "$STATE" = 'down' ]; then
76
+
${pkgs.nixos-container}/bin/nixos-container start ${cname}
77
+
fi
78
+
79
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
80
+
set -x
81
+
82
+
mkdir -p /var/state/var_src
83
+
ln -sfTr /var/state/var_src /var/src
84
+
touch /etc/NIXOS
85
+
''}
86
+
87
+
if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
88
+
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
89
+
fi
90
+
'')
91
+
(pkgs.writeDashBin "stop-${cname}" ''
92
+
set -euf
93
+
94
+
${pkgs.nixos-container}/bin/nixos-container stop ${cname}
95
+
umount /var/lib/containers/${cname}/var/state
96
+
'')
97
+
];
98
+
}
99
+
+126
nixos/2configs/hass/default.nix
+126
nixos/2configs/hass/default.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
with import ./lib.nix { inherit lib; };
3
+
let
4
+
dwdwfsapi = pkgs.python3Packages.buildPythonPackage rec {
5
+
pname = "dwdwfsapi";
6
+
version = "1.0.3";
7
+
8
+
src = pkgs.python3Packages.fetchPypi {
9
+
inherit pname version;
10
+
sha256 = "0fcv79xiq0qr4kivhd68iqpgrsjc7djxqs2h543pyr0sdgb5nz9x";
11
+
};
12
+
13
+
buildInputs = with pkgs.python3Packages; [
14
+
requests ciso8601
15
+
];
16
+
17
+
# LC_ALL = "en_US.UTF-8";
18
+
};
19
+
20
+
in {
21
+
imports = [
22
+
./pyscript
23
+
./zigbee.nix
24
+
./rooms/bett.nix
25
+
./rooms/essen.nix
26
+
./rooms/nass.nix
27
+
];
28
+
29
+
krebs.iptables.tables.filter.INPUT.rules = [
30
+
{ predicate = "-i int0 -p tcp --dport 1883"; target = "ACCEPT"; } # mosquitto
31
+
{ predicate = "-i docker0 -p tcp --dport 1883"; target = "ACCEPT"; } # mosquitto
32
+
{ predicate = "-i int0 -p tcp --dport 8123"; target = "ACCEPT"; } # hass
33
+
{ predicate = "-i int0 -p tcp --dport 1337"; target = "ACCEPT"; } # zigbee2mqtt frontend
34
+
{ predicate = "-i retiolum -p tcp --dport 8123"; target = "ACCEPT"; } # hass
35
+
{ predicate = "-i retiolum -p tcp --dport 1337"; target = "ACCEPT"; } # zigbee2mqtt frontend
36
+
{ predicate = "-i wiregrill -p tcp --dport 8123"; target = "ACCEPT"; } # hass
37
+
];
38
+
39
+
40
+
services.home-assistant = {
41
+
enable = true;
42
+
configWritable = true;
43
+
lovelaceConfigWritable = true;
44
+
config = let
45
+
tasmota = name: topic: {
46
+
inherit name;
47
+
state_topic = "stat/${topic}/POWER";
48
+
command_topic = "cmnd/${topic}/POWER";
49
+
payload_on = "ON";
50
+
payload_off = "OFF";
51
+
};
52
+
in {
53
+
homeassistant = {
54
+
name = "Home";
55
+
time_zone = "Europe/Berlin";
56
+
latitude = "52.46187";
57
+
longitude = "13.41489";
58
+
elevation = 90;
59
+
unit_system = "metric";
60
+
# customize = friendly_names;
61
+
};
62
+
config = {};
63
+
sun.elevation = 66;
64
+
shopping_list = {};
65
+
discovery = {};
66
+
frontend = {};
67
+
http = {};
68
+
# mqtt = {
69
+
# broker = "localhost";
70
+
# port = 1883;
71
+
# client_id = "home-assistant";
72
+
# username = "gg23";
73
+
# password = "gg23-mqtt";
74
+
# keepalive = 60;
75
+
# protocol = 3.1;
76
+
77
+
# discovery = true;
78
+
# birth_message = {
79
+
# topic = "/hass/status";
80
+
# payload = "online";
81
+
# };
82
+
# will_message = {
83
+
# topic = "/hass/status";
84
+
# payload = "offline";
85
+
# };
86
+
# };
87
+
sensor = [
88
+
{
89
+
platform = "dwd_weather_warnings";
90
+
region_name = "Berlin";
91
+
}
92
+
];
93
+
mqtt.switch = [
94
+
(tasmota "TV" "tv")
95
+
(tasmota "Drucker Strom" "drucker")
96
+
(tasmota "Waschmaschine" "wasch")
97
+
(tasmota "Stereo Anlage" "stereo")
98
+
(tasmota "Wohnzimmer Lampe" "wohn_lampe")
99
+
];
100
+
mobile_app = {};
101
+
weather = [
102
+
{
103
+
platform = "openweathermap";
104
+
api_key = "XXX"; # TODO put into secrets
105
+
}
106
+
];
107
+
system_health = {};
108
+
history = {};
109
+
shopping_list = {};
110
+
media_player = {
111
+
platform = "snapcast";
112
+
host = "127.0.0.1";
113
+
};
114
+
};
115
+
};
116
+
117
+
services.mosquitto = {
118
+
enable = true;
119
+
listeners = [{
120
+
acl = [ ];
121
+
users.gg23 = { acl = [ "readwrite #" ]; password = "gg23-mqtt"; };
122
+
}];
123
+
};
124
+
125
+
environment.systemPackages = [ pkgs.mosquitto ];
126
+
}
+256
nixos/2configs/hass/lib.nix
+256
nixos/2configs/hass/lib.nix
···
1
+
{ lib, ... }:
2
+
rec {
3
+
lights = {
4
+
bett = "l_bett";
5
+
essen = "l_essen";
6
+
arbeit = "l_arbeit";
7
+
nass = "l_nass";
8
+
};
9
+
10
+
switches = {
11
+
dimmer = {
12
+
bett = "i_bett";
13
+
essen = "i_essen";
14
+
nass = "i_nass";
15
+
};
16
+
};
17
+
18
+
sensors = {
19
+
movement = {
20
+
essen = "s_essen";
21
+
nass = "s_nass";
22
+
};
23
+
};
24
+
25
+
friendly_names =
26
+
lib.mapAttrs' (n: v: lib.nameValuePair "light.${v}" { friendly_name = "l.${n}"; }) lights //
27
+
lib.mapAttrs' (n: v: lib.nameValuePair "binary_sensor.${v}_update_available" { friendly_name = "s.${n}_up"; }) switches.dimmer //
28
+
lib.mapAttrs' (n: v: lib.nameValuePair "binary_sensor.${v}_update_available" { friendly_name = "i.${n}_up"; }) sensors.movement //
29
+
lib.mapAttrs' (n: v: lib.nameValuePair "binary_sensor.${v}_update_available" { friendly_name = "l.${n}_up"; }) lights //
30
+
lib.mapAttrs' (n: v: lib.nameValuePair "sensor.${v}_linkquality" { friendly_name = "s.${n}_link"; }) switches.dimmer //
31
+
lib.mapAttrs' (n: v: lib.nameValuePair "sensor.${v}_linkquality" { friendly_name = "i.${n}_link"; }) sensors.movement //
32
+
lib.mapAttrs' (n: v: lib.nameValuePair "sensor.${v}_linkquality" { friendly_name = "l.${n}_link"; }) lights //
33
+
lib.mapAttrs' (n: v: lib.nameValuePair "sensor.${v}_battery" { friendly_name = "s.${n}_bat"; }) switches.dimmer //
34
+
lib.mapAttrs' (n: v: lib.nameValuePair "sensor.${v}_battery" { friendly_name = "i.${n}_bat"; }) sensors.movement //
35
+
lib.mapAttrs' (n: v: lib.nameValuePair "sensor.${v}_action" { friendly_name = "s.${n}_act"; }) switches.dimmer //
36
+
lib.mapAttrs' (n: v: lib.nameValuePair "binary_sensor.${v}_occupancy" { friendly_name = "i.${n}_move"; }) sensors.movement //
37
+
lib.mapAttrs' (n: v: lib.nameValuePair "binary_sensor.${v}_occupancy" { friendly_name = "i.${n}_move"; }) sensors.movement //
38
+
lib.mapAttrs' (n: v: lib.nameValuePair "sensor.${v}_temperature" { friendly_name = "i.${n}_heat"; }) sensors.movement //
39
+
lib.mapAttrs' (n: v: lib.nameValuePair "sensor.${v}_temperature" { friendly_name = "i.${n}_heat"; }) sensors.movement //
40
+
lib.mapAttrs' (n: v: lib.nameValuePair "sensor.${v}_illuminance" { friendly_name = "i.${n}_lux"; }) sensors.movement //
41
+
lib.mapAttrs' (n: v: lib.nameValuePair "sensor.${v}_illuminance" { friendly_name = "i.${n}_lux"; }) sensors.movement //
42
+
{};
43
+
44
+
detect_movement = name: sensor: light: delay:
45
+
let
46
+
id = name;
47
+
sensor_ = "binary_sensor.${sensor}_occupancy";
48
+
light_ = "light.${light}";
49
+
in {
50
+
input_boolean."${id}" = {
51
+
};
52
+
timer."${id}" = {
53
+
duration = delay;
54
+
};
55
+
automation = [
56
+
# {
57
+
# alias = "debug detect_movement";
58
+
# trigger = {
59
+
# platform = "state";
60
+
# entity_id = sensor_;
61
+
# };
62
+
# action = [
63
+
# {
64
+
# service = "system_log.write";
65
+
# data_template = {
66
+
# message = "XXXXXXXXXXXXXXXXXXXXXX {{ states('input_boolean.${sensor}_${light}_triggered') == 'on' }}";
67
+
# #message = "XXXXXXXXXXXXXXXXXXXXXX {{ state_attr('trigger.to_state.state', 'illuminance') }}";
68
+
# };
69
+
# }
70
+
# ];
71
+
# }
72
+
{
73
+
alias = "movement reset timer ${id}";
74
+
trigger = {
75
+
platform = "state";
76
+
entity_id = sensor_;
77
+
from = "off";
78
+
to = "on";
79
+
};
80
+
action = [
81
+
{
82
+
service = "timer.cancel";
83
+
data_template.entity_id = "timer.${id}";
84
+
}
85
+
];
86
+
}
87
+
{
88
+
alias = "movement on ${id}";
89
+
trigger = {
90
+
platform = "state";
91
+
entity_id = "binary_sensor.${sensor}_occupancy";
92
+
from = "off";
93
+
to = "on";
94
+
};
95
+
condition = {
96
+
condition = "and";
97
+
conditions = [
98
+
{
99
+
condition = "template";
100
+
value_template = "{{ trigger.to_state.attributes.illuminance < 7500 }}";
101
+
}
102
+
{
103
+
condition = "template";
104
+
value_template = "{{ states('${light_}') == 'off' }}";
105
+
}
106
+
];
107
+
};
108
+
action = [
109
+
{
110
+
service = "light.turn_on";
111
+
data_template = {
112
+
entity_id = light_;
113
+
brightness = "100";
114
+
};
115
+
}
116
+
{ delay = "0:00:02"; }
117
+
{
118
+
service = "input_boolean.turn_on";
119
+
data_template.entity_id = "input_boolean.${id}";
120
+
}
121
+
];
122
+
}
123
+
{
124
+
alias = "movement off ${id}";
125
+
trigger = {
126
+
platform = "state";
127
+
entity_id = sensor_;
128
+
from = "on";
129
+
to = "off";
130
+
};
131
+
condition = {
132
+
condition = "template";
133
+
value_template = "{{ states('input_boolean.${id}') == 'on' }}";
134
+
};
135
+
action = [
136
+
{
137
+
service = "timer.start";
138
+
entity_id = "timer.${id}";
139
+
}
140
+
];
141
+
}
142
+
{
143
+
alias = "movement override ${id}";
144
+
trigger = {
145
+
platform = "state";
146
+
entity_id = light_;
147
+
};
148
+
action = [
149
+
{
150
+
service = "input_boolean.turn_off";
151
+
data_template.entity_id = "input_boolean.${id}";
152
+
}
153
+
{
154
+
service = "system_log.write";
155
+
data_template = {
156
+
message = "XXXXXXXXXXXXXXXXXXXXXX {{ trigger }}";
157
+
};
158
+
}
159
+
];
160
+
}
161
+
{
162
+
alias = "movement expired ${id}";
163
+
trigger = {
164
+
platform = "event";
165
+
event_type = "timer.finished";
166
+
event_data.entity_id = "timer.${id}";
167
+
};
168
+
action = [
169
+
{
170
+
service = "light.turn_off";
171
+
data_template = {
172
+
entity_id = light_;
173
+
};
174
+
}
175
+
{
176
+
service = "input_boolean.turn_off";
177
+
data_template.entity_id = "input_boolean.${id}";
178
+
}
179
+
];
180
+
}
181
+
];
182
+
};
183
+
184
+
lightswitch = name: switch: light: {
185
+
automation = [
186
+
{
187
+
alias = "lightswitch ${name} turn on";
188
+
trigger = {
189
+
platform = "mqtt";
190
+
topic = "zigbee/${switch}";
191
+
};
192
+
condition = {
193
+
condition = "or";
194
+
conditions = [
195
+
{
196
+
condition = "template";
197
+
value_template = "{{ trigger.payload_json.action == 'on-press' }}";
198
+
}
199
+
{
200
+
condition = "template";
201
+
value_template = "{{ trigger.payload_json.action == 'up-press' }}";
202
+
}
203
+
{
204
+
condition = "and";
205
+
conditions = [
206
+
{
207
+
condition = "template";
208
+
value_template = "{{ trigger.payload_json.action == 'down-press' }}";
209
+
}
210
+
{
211
+
condition = "template";
212
+
value_template = "{{ trigger.payload_json.brightness > 30 }}";
213
+
}
214
+
];
215
+
}
216
+
];
217
+
};
218
+
action = [
219
+
{
220
+
service = "light.turn_on";
221
+
data_template = {
222
+
entity_id = "light.${light}";
223
+
brightness = "{{ trigger.payload_json.brightness }}";
224
+
};
225
+
}
226
+
];
227
+
}
228
+
{
229
+
alias = "lightswitch ${name} turn off";
230
+
trigger = {
231
+
platform = "mqtt";
232
+
topic = "zigbee/${switch}";
233
+
};
234
+
condition = {
235
+
condition = "or";
236
+
conditions = [
237
+
{
238
+
condition = "template";
239
+
value_template = "{{ trigger.payload_json.action == 'off-press' }}";
240
+
}
241
+
{
242
+
condition = "template";
243
+
value_template = "{{ trigger.payload_json.brightness < 30 }}";
244
+
}
245
+
];
246
+
};
247
+
action = {
248
+
service = "light.turn_off";
249
+
data_template = {
250
+
entity_id = "light.${light}";
251
+
};
252
+
};
253
+
}
254
+
];
255
+
};
256
+
}
+76
nixos/2configs/hass/zigbee.nix
+76
nixos/2configs/hass/zigbee.nix
···
1
+
{config, pkgs, lib, ...}: let
2
+
3
+
unstable-pkgs = import <nixpkgs-unstable> {};
4
+
5
+
in {
6
+
# symlink the zigbee controller
7
+
services.udev.extraRules = ''
8
+
SUBSYSTEM=="tty", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="16a8", SYMLINK+="cc2531", MODE="0660", GROUP="dialout"
9
+
SUBSYSTEM=="tty", ATTRS{idVendor}=="10c4", ATTRS{idProduct}=="ea60", SYMLINK+="cc2652", MODE="0660", GROUP="dialout"
10
+
'';
11
+
12
+
# needed to use unstable package
13
+
systemd.services.zigbee2mqtt.environment.ZIGBEE2MQTT_DATA = "/var/lib/zigbee2mqtt";
14
+
15
+
services.zigbee2mqtt = {
16
+
enable = true;
17
+
package = unstable-pkgs.zigbee2mqtt;
18
+
settings = {
19
+
homeassistant = true;
20
+
frontend.port = 1337;
21
+
experimental.new_api = true;
22
+
permit_join = false;
23
+
mqtt = {
24
+
discovery = true;
25
+
base_topic = "zigbee";
26
+
server = "mqtt://10.42.0.1";
27
+
user = "gg23";
28
+
password = "gg23-mqtt";
29
+
};
30
+
serial = {
31
+
port = "/dev/cc2652";
32
+
# disable_led = true;
33
+
};
34
+
advanced = {
35
+
pan_id = 4222;
36
+
};
37
+
devices = let
38
+
set_device = id: name:
39
+
lib.nameValuePair id {
40
+
};
41
+
in {
42
+
# lights https://www.zigbee2mqtt.io/devices/9290022166.html#philips-9290022166
43
+
"0x0017880106ed3bd8".friendly_name = "l_bett";
44
+
"0x0017880108327622".friendly_name = "l_essen";
45
+
"0x0017880106ee2865".friendly_name = "l_arbeit";
46
+
"0x00178801082e9f2f".friendly_name = "l_nass";
47
+
48
+
# switches https://www.zigbee2mqtt.io/devices/324131092621.html#philips-324131092621
49
+
"0x00178801086ac38c".friendly_name = "i_bett";
50
+
"0x00178801086ad1fb".friendly_name = "i_essen";
51
+
"0x00178801086ac373".friendly_name = "i_nass";
52
+
53
+
# sensors https://www.zigbee2mqtt.io/devices/9290012607.html#philips-9290012607
54
+
"0x0017880106f772f2".friendly_name = "s_essen";
55
+
"0x0017880106f77f30".friendly_name = "s_nass";
56
+
57
+
# heat https://www.zigbee2mqtt.io/devices/701721.html#popp-701721
58
+
"0x842e14fffe27109a".friendly_name = "t_bett";
59
+
"0x842e14fffe269a73".friendly_name = "t_nass";
60
+
"0x842e14fffe269a56".friendly_name = "t_arbeit";
61
+
62
+
# rotation https://www.zigbee2mqtt.io/devices/E1744.html
63
+
"0x8cf681fffe065493" = {
64
+
friendly_name = "r_test";
65
+
device_id = "r_test";
66
+
simulated_brightness = {
67
+
delta = 2;
68
+
interval = 100;
69
+
};
70
+
};
71
+
72
+
};
73
+
};
74
+
};
75
+
}
76
+
+125
nixos/2configs/hw/brcmfmac4356-pcie.txt
+125
nixos/2configs/hw/brcmfmac4356-pcie.txt
···
1
+
# Sample variables file for BCM94356Z NGFF 22x30mm iPA, iLNA board with PCIe for production package
2
+
NVRAMRev=$Rev: 492104 $
3
+
#4356 chip = 4354 A2 chip
4
+
sromrev=11
5
+
boardrev=0x1102
6
+
boardtype=0x073e
7
+
boardflags=0x02400201
8
+
#0x2000 enable 2G spur WAR
9
+
boardflags2=0x00802000
10
+
boardflags3=0x0000000a
11
+
#boardflags3 0x00000100 /* to read swctrlmap from nvram*/
12
+
#define BFL3_5G_SPUR_WAR 0x00080000 /* enable spur WAR in 5G band */
13
+
#define BFL3_AvVim 0x40000000 /* load AvVim from nvram */
14
+
macaddr=00:90:4c:1a:10:01
15
+
ccode=0x5854
16
+
regrev=205
17
+
antswitch=0
18
+
pdgain5g=4
19
+
pdgain2g=4
20
+
tworangetssi2g=0
21
+
tworangetssi5g=0
22
+
paprdis=0
23
+
femctrl=10
24
+
vendid=0x14e4
25
+
devid=0x43ec
26
+
manfid=0x2d0
27
+
#prodid=0x052e
28
+
nocrc=1
29
+
otpimagesize=502
30
+
xtalfreq=37400
31
+
rxgains2gelnagaina0=0
32
+
rxgains2gtrisoa0=7
33
+
rxgains2gtrelnabypa0=0
34
+
rxgains5gelnagaina0=0
35
+
rxgains5gtrisoa0=11
36
+
rxgains5gtrelnabypa0=0
37
+
rxgains5gmelnagaina0=0
38
+
rxgains5gmtrisoa0=13
39
+
rxgains5gmtrelnabypa0=0
40
+
rxgains5ghelnagaina0=0
41
+
rxgains5ghtrisoa0=12
42
+
rxgains5ghtrelnabypa0=0
43
+
rxgains2gelnagaina1=0
44
+
rxgains2gtrisoa1=7
45
+
rxgains2gtrelnabypa1=0
46
+
rxgains5gelnagaina1=0
47
+
rxgains5gtrisoa1=10
48
+
rxgains5gtrelnabypa1=0
49
+
rxgains5gmelnagaina1=0
50
+
rxgains5gmtrisoa1=11
51
+
rxgains5gmtrelnabypa1=0
52
+
rxgains5ghelnagaina1=0
53
+
rxgains5ghtrisoa1=11
54
+
rxgains5ghtrelnabypa1=0
55
+
rxchain=3
56
+
txchain=3
57
+
aa2g=3
58
+
aa5g=3
59
+
agbg0=2
60
+
agbg1=2
61
+
aga0=2
62
+
aga1=2
63
+
tssipos2g=1
64
+
extpagain2g=2
65
+
tssipos5g=1
66
+
extpagain5g=2
67
+
tempthresh=255
68
+
tempoffset=255
69
+
rawtempsense=0x1ff
70
+
pa2ga0=-147,6192,-705
71
+
pa2ga1=-161,6041,-701
72
+
pa5ga0=-194,6069,-739,-188,6137,-743,-185,5931,-725,-171,5898,-715
73
+
pa5ga1=-190,6248,-757,-190,6275,-759,-190,6225,-757,-184,6131,-746
74
+
subband5gver=0x4
75
+
pdoffsetcckma0=0x4
76
+
pdoffsetcckma1=0x4
77
+
pdoffset40ma0=0x0000
78
+
pdoffset80ma0=0x0000
79
+
pdoffset40ma1=0x0000
80
+
pdoffset80ma1=0x0000
81
+
maxp2ga0=76
82
+
maxp5ga0=74,74,74,74
83
+
maxp2ga1=76
84
+
maxp5ga1=74,74,74,74
85
+
cckbw202gpo=0x0000
86
+
cckbw20ul2gpo=0x0000
87
+
mcsbw202gpo=0x99644422
88
+
mcsbw402gpo=0x99644422
89
+
dot11agofdmhrbw202gpo=0x6666
90
+
ofdmlrbw202gpo=0x0022
91
+
mcsbw205glpo=0x88766663
92
+
mcsbw405glpo=0x88666663
93
+
mcsbw805glpo=0xbb666665
94
+
mcsbw205gmpo=0xd8666663
95
+
mcsbw405gmpo=0x88666663
96
+
mcsbw805gmpo=0xcc666665
97
+
mcsbw205ghpo=0xdc666663
98
+
mcsbw405ghpo=0xaa666663
99
+
mcsbw805ghpo=0xdd666665
100
+
mcslr5glpo=0x0000
101
+
mcslr5gmpo=0x0000
102
+
mcslr5ghpo=0x0000
103
+
sb20in40hrpo=0x0
104
+
sb20in80and160hr5glpo=0x0
105
+
sb40and80hr5glpo=0x0
106
+
sb20in80and160hr5gmpo=0x0
107
+
sb40and80hr5gmpo=0x0
108
+
sb20in80and160hr5ghpo=0x0
109
+
sb40and80hr5ghpo=0x0
110
+
sb20in40lrpo=0x0
111
+
sb20in80and160lr5glpo=0x0
112
+
sb40and80lr5glpo=0x0
113
+
sb20in80and160lr5gmpo=0x0
114
+
sb40and80lr5gmpo=0x0
115
+
sb20in80and160lr5ghpo=0x0
116
+
sb40and80lr5ghpo=0x0
117
+
dot11agduphrpo=0x0
118
+
dot11agduplrpo=0x0
119
+
phycal_tempdelta=255
120
+
temps_period=15
121
+
temps_hysteresis=15
122
+
rssicorrnorm_c0=4,4
123
+
rssicorrnorm_c1=4,4
124
+
rssicorrnorm5g_c0=1,2,3,1,2,3,6,6,8,6,6,8
125
+
rssicorrnorm5g_c1=1,2,3,2,2,2,7,7,8,7,7,8
+28
nixos/2configs/hw/gpd-pocket.nix
+28
nixos/2configs/hw/gpd-pocket.nix
···
1
+
{ pkgs, ... }:
2
+
3
+
let
4
+
dummy_firmware = pkgs.writeTextFile {
5
+
name = "brcmfmac4356-pcie.txt";
6
+
text = builtins.readFile ./brcmfmac4356-pcie.txt;
7
+
destination = "/lib/firmware/brcm/brcmfmac4356-pcie.txt";
8
+
};
9
+
in {
10
+
#imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
11
+
hardware.firmware = [ dummy_firmware ];
12
+
hardware.enableRedistributableFirmware = true;
13
+
14
+
boot.initrd.availableKernelModules = [ "xhci_pci" "usbhid" "usb_storage" "sd_mod" "sdhci_acpi" "sdhci_pci" ];
15
+
boot.kernelPackages = pkgs.linuxPackages_4_14;
16
+
boot.kernelParams = [
17
+
"fbcon=rotate:1"
18
+
];
19
+
services.xserver.displayManager.sessionCommands = ''
20
+
(sleep 2 && ${pkgs.xorg.xrandr}/bin/xrandr --output DSI1 --rotate right)
21
+
(sleep 2 && ${pkgs.xorg.xinput}/bin/xinput set-prop 'Goodix Capacitive TouchScreen' 'Coordinate Transformation Matrix' 0 1 0 -1 0 1 0 0 1)
22
+
'';
23
+
services.xserver.dpi = 200;
24
+
fonts.fontconfig.dpi = 200;
25
+
lass.fonts.regular = "xft:Hack-Regular:pixelsize=22,xft:Symbola";
26
+
lass.fonts.bold = "xft:Hack-Bold:pixelsize=22,xft:Symbola";
27
+
lass.fonts.italic = "xft:Hack-RegularOblique:pixelsize=22,xft:Symbol";
28
+
}
+50
nixos/2configs/hw/x220.nix
+50
nixos/2configs/hw/x220.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
<stockholm/krebs/2configs/hw/x220.nix>
5
+
];
6
+
7
+
boot = {
8
+
initrd.luks.devices.luksroot.device = "/dev/sda3";
9
+
initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
10
+
extraModulePackages = [
11
+
config.boot.kernelPackages.tp_smapi
12
+
config.boot.kernelPackages.acpi_call
13
+
];
14
+
kernelModules = [
15
+
"acpi_call"
16
+
"tp_smapi"
17
+
];
18
+
};
19
+
20
+
environment.systemPackages = [
21
+
pkgs.tpacpi-bat
22
+
];
23
+
24
+
fileSystems = {
25
+
"/" = {
26
+
device = "/dev/mapper/pool-root";
27
+
fsType = "btrfs";
28
+
options = ["defaults" "noatime" "ssd" "compress=lzo"];
29
+
};
30
+
"/boot" = {
31
+
device = "/dev/sda2";
32
+
};
33
+
"/home" = {
34
+
device = "/dev/mapper/pool-home";
35
+
fsType = "btrfs";
36
+
options = ["defaults" "noatime" "ssd" "compress=lzo"];
37
+
};
38
+
};
39
+
40
+
services.logind.lidSwitch = "ignore";
41
+
services.logind.lidSwitchDocked = "ignore";
42
+
43
+
services.tlp.enable = true;
44
+
#services.tlp.extraConfig = ''
45
+
# START_CHARGE_THRESH_BAT0=80
46
+
# STOP_CHARGE_THRESH_BAT0=95
47
+
#'';
48
+
49
+
services.xserver.dpi = 80;
50
+
}
+48
nixos/2configs/mail/internet-gateway.nix
+48
nixos/2configs/mail/internet-gateway.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
security.acme.certs."mail.lassul.us" = {
4
+
group = "lasscert";
5
+
webroot = "/var/lib/acme/acme-challenge";
6
+
};
7
+
users.groups.lasscert.members = [
8
+
"exim"
9
+
"nginx"
10
+
];
11
+
12
+
krebs.exim-smarthost = {
13
+
enable = true;
14
+
primary_hostname = "lassul.us";
15
+
dkim = [
16
+
{ domain = "lassul.us"; }
17
+
];
18
+
ssl_cert = "/var/lib/acme/mail.lassul.us/fullchain.pem";
19
+
ssl_key = "/var/lib/acme/mail.lassul.us/key.pem";
20
+
local_domains = [
21
+
"localhost"
22
+
"lassul.us"
23
+
"ubikmedia.eu"
24
+
"ubikmedia.de"
25
+
"apanowicz.de"
26
+
"alewis.de"
27
+
"jarugadesign.de"
28
+
"beesmooth.ch"
29
+
"event-extra.de"
30
+
"jla-trading.com"
31
+
];
32
+
extraRouters = ''
33
+
forward_lassul_us:
34
+
driver = manualroute
35
+
domains = lassul.us
36
+
transport = remote_smtp
37
+
route_list = * orange.r
38
+
no_more
39
+
40
+
forward_ubik:
41
+
driver = manualroute
42
+
domains = ubikmedia.eu:ubikmedia.de:apanowicz.de:alewis.de:jarugadesign.de:beesmooth.ch:event-extra.de:jla-trading.com
43
+
transport = remote_smtp
44
+
route_list = * ubik.r
45
+
no_more
46
+
'';
47
+
};
48
+
}
+208
nixos/2configs/monitoring/alert-rules.nix
+208
nixos/2configs/monitoring/alert-rules.nix
···
1
+
# inspiration from https://github.com/Mic92/dotfiles/blob/master/nixos/eva/modules/prometheus/alert-rules.nix
2
+
{ lib }:
3
+
4
+
lib.mapAttrsToList
5
+
(name: opts: {
6
+
alert = name;
7
+
expr = opts.condition;
8
+
for = opts.time or "2m";
9
+
labels = { };
10
+
annotations.description = opts.description;
11
+
})
12
+
({
13
+
prometheus_too_many_restarts = {
14
+
condition = ''changes(process_start_time_seconds{job=~"prometheus|pushgateway|alertmanager|telegraf"}[15m]) > 2'';
15
+
description = "Prometheus has restarted more than twice in the last 15 minutes. It might be crashlooping.";
16
+
};
17
+
18
+
alert_manager_config_not_synced = {
19
+
condition = ''count(count_values("config_hash", alertmanager_config_hash)) > 1'';
20
+
description = "Configurations of AlertManager cluster instances are out of sync.";
21
+
};
22
+
23
+
prometheus_not_connected_to_alertmanager = {
24
+
condition = "prometheus_notifications_alertmanagers_discovered < 1";
25
+
description = "Prometheus cannot connect the alertmanager\n VALUE = {{ $value }}\n LABELS = {{ $labels }}";
26
+
};
27
+
28
+
prometheus_rule_evaluation_failures = {
29
+
condition = "increase(prometheus_rule_evaluation_failures_total[3m]) > 0";
30
+
description = "Prometheus encountered {{ $value }} rule evaluation failures, leading to potentially ignored alerts.\n VALUE = {{ $value }}\n LABELS = {{ $labels }}";
31
+
};
32
+
33
+
prometheus_template_expansion_failures = {
34
+
condition = "increase(prometheus_template_text_expansion_failures_total[3m]) > 0";
35
+
time = "0m";
36
+
description = "Prometheus encountered {{ $value }} template text expansion failures\n VALUE = {{ $value }}\n LABELS = {{ $labels }}";
37
+
};
38
+
39
+
promtail_request_errors = {
40
+
condition = ''100 * sum(rate(promtail_request_duration_seconds_count{status_code=~"5..|failed"}[1m])) by (namespace, job, route, instance) / sum(rate(promtail_request_duration_seconds_count[1m])) by (namespace, job, route, instance) > 10'';
41
+
time = "15m";
42
+
description = ''{{ $labels.job }} {{ $labels.route }} is experiencing {{ printf "%.2f" $value }}% errors.'';
43
+
};
44
+
45
+
promtail_file_lagging = {
46
+
condition = ''abs(promtail_file_bytes_total - promtail_read_bytes_total) > 1e6'';
47
+
time = "15m";
48
+
description = ''{{ $labels.instance }} {{ $labels.job }} {{ $labels.path }} has been lagging by more than 1MB for more than 15m.'';
49
+
};
50
+
51
+
filesystem_full_80percent = {
52
+
condition = ''disk_used_percent{mode!="ro"} >= 95'';
53
+
time = "10m";
54
+
description = "{{$labels.instance}} device {{$labels.device}} on {{$labels.path}} got less than 20% space left on its filesystem.";
55
+
};
56
+
57
+
filesystem_full_krebs = {
58
+
condition = ''disk_used_percent{mode!="ro", org="krebs"} >= 95'';
59
+
time = "10m";
60
+
description = "{{$labels.instance}} device {{$labels.device}} on {{$labels.path}} got less than 5% space left on its filesystem.";
61
+
};
62
+
63
+
filesystem_inodes_full = {
64
+
condition = ''disk_inodes_free / disk_inodes_total < 0.10'';
65
+
time = "10m";
66
+
description = "{{$labels.instance}} device {{$labels.device}} on {{$labels.path}} got less than 10% inodes left on its filesystem.";
67
+
};
68
+
69
+
daily_task_not_run = {
70
+
# give 6 hours grace period
71
+
condition = ''time() - task_last_run{state="ok",frequency="daily"} > (24 + 6) * 60 * 60'';
72
+
description = "{{$labels.host}}: {{$labels.name}} was not run in the last 24h";
73
+
};
74
+
75
+
daily_task_failed = {
76
+
condition = ''task_last_run{state="fail"}'';
77
+
description = "{{$labels.host}}: {{$labels.name}} failed to run";
78
+
};
79
+
80
+
swap_using_30percent = {
81
+
condition = "mem_swap_total - (mem_swap_cached + mem_swap_free) > mem_swap_total * 0.3";
82
+
time = "30m";
83
+
description = "{{$labels.host}} is using 30% of its swap space for at least 30 minutes.";
84
+
};
85
+
86
+
systemd_service_failed = {
87
+
condition = ''systemd_units_active_code{name!~"nixpkgs-update-.*.service"} == 3'';
88
+
description = "{{$labels.host}} failed to (re)start service {{$labels.name}}.";
89
+
};
90
+
91
+
service_not_running = {
92
+
condition = ''systemd_units_active_code{name=~"teamspeak3-server.service|tt-rss.service", sub!="running"}'';
93
+
description = "{{$labels.host}} should have a running {{$labels.name}}.";
94
+
};
95
+
96
+
nfs_export_not_present = {
97
+
condition = "nfs_export_present == 0";
98
+
time = "1h";
99
+
description = "{{$labels.host}} cannot reach nfs export [{{$labels.server}}]:{{$labels.path}}";
100
+
};
101
+
102
+
ram_using_90percent = {
103
+
condition = "mem_buffered + mem_free + mem_cached < mem_total * 0.1";
104
+
time = "1h";
105
+
description = "{{$labels.host}} is using at least 90% of its RAM for at least 1 hour.";
106
+
};
107
+
load15 = {
108
+
condition = ''system_load15 / system_n_cpus{org!="nix-community"} >= 2.0'';
109
+
time = "10m";
110
+
description = "{{$labels.host}} is running with load15 > 1 for at least 5 minutes: {{$value}}";
111
+
};
112
+
reboot = {
113
+
condition = "system_uptime < 300";
114
+
description = "{{$labels.host}} just rebooted.";
115
+
};
116
+
uptime = {
117
+
# too scared to upgrade matchbox
118
+
condition = ''system_uptime {host!~"^(matchbox|grandalf)$"} > 2592000'';
119
+
description = "Uptime monster: {{$labels.host}} has been up for more than 30 days.";
120
+
};
121
+
telegraf_down = {
122
+
condition = ''min(up{job=~"telegraf",type!='mobile'}) by (source, job, instance, org) == 0'';
123
+
time = "3m";
124
+
description = "{{$labels.instance}}: {{$labels.job}} telegraf exporter from {{$labels.source}} is down.";
125
+
};
126
+
ping = {
127
+
condition = "ping_result_code{type!='mobile'} != 0";
128
+
description = "{{$labels.url}}: ping from {{$labels.instance}} has failed!";
129
+
};
130
+
ping_high_latency = {
131
+
condition = "ping_average_response_ms{type!='mobile'} > 5000";
132
+
description = "{{$labels.instance}}: ping probe from {{$labels.source}} is encountering high latency!";
133
+
};
134
+
http = {
135
+
condition = "http_response_result_code != 0";
136
+
description = "{{$labels.server}} : http request failed from {{$labels.instance}}: {{$labels.result}}!";
137
+
};
138
+
http_match_failed = {
139
+
condition = "http_response_response_string_match == 0";
140
+
description = "{{$labels.server}} : http body not as expected; status code: {{$labels.status_code}}!";
141
+
};
142
+
dns_query = {
143
+
condition = "dns_query_result_code != 0";
144
+
description = "{{$labels.domain}} : could retrieve A record {{$labels.instance}} from server {{$labels.server}}: {{$labels.result}}!";
145
+
};
146
+
secure_dns_query = {
147
+
condition = "secure_dns_state != 0";
148
+
description = "{{$labels.domain}} : could retrieve A record {{$labels.instance}} from server {{$labels.server}}: {{$labels.result}} for protocol {{$labels.protocol}}!";
149
+
};
150
+
connection_failed = {
151
+
condition = "net_response_result_code != 0";
152
+
description = "{{$labels.server}}: connection to {{$labels.port}}({{$labels.protocol}}) failed from {{$labels.instance}}";
153
+
};
154
+
healthchecks = {
155
+
condition = "hc_check_up == 0";
156
+
description = "{{$labels.instance}}: healtcheck {{$labels.job}} fails!";
157
+
};
158
+
cert_expiry = {
159
+
condition = "x509_cert_expiry < 7*24*3600";
160
+
description = "{{$labels.instance}}: The TLS certificate from {{$labels.source}} will expire in less than 7 days: {{$value}}s";
161
+
};
162
+
163
+
postfix_queue_length = {
164
+
condition = "avg_over_time(postfix_queue_length[1h]) > 10";
165
+
description = "{{$labels.instance}}: postfix mail queue has undelivered {{$value}} items";
166
+
};
167
+
168
+
zfs_errors = {
169
+
condition = "zfs_arcstats_l2_io_error + zfs_dmu_tx_error + zfs_arcstats_l2_writes_error > 0";
170
+
description = "{{$labels.instance}} reports: {{$value}} ZFS IO errors.";
171
+
};
172
+
173
+
# ignore devices that disabled S.M.A.R.T (example if attached via USB)
174
+
smart_errors = {
175
+
condition = ''smart_device_health_ok{enabled!="Disabled"} != 1'';
176
+
description = "{{$labels.instance}}: S.M.A.R.T reports: {{$labels.device}} ({{$labels.model}}) has errors.";
177
+
};
178
+
179
+
oom_kills = {
180
+
condition = "increase(kernel_vmstat_oom_kill[5m]) > 0";
181
+
description = "{{$labels.instance}}: OOM kill detected";
182
+
};
183
+
184
+
unusual_disk_read_latency = {
185
+
condition = "rate(diskio_read_time[1m]) / rate(diskio_reads[1m]) > 0.1 and rate(diskio_reads[1m]) > 0";
186
+
description = "{{$labels.instance}}: Disk latency is growing (read operations > 100ms)\n";
187
+
};
188
+
189
+
unusual_disk_write_latency = {
190
+
condition = "rate(diskio_write_time[1m]) / rate(diskio_write[1m]) > 0.1 and rate(diskio_write[1m]) > 0";
191
+
description = "{{$labels.instance}}: Disk latency is growing (write operations > 100ms)\n";
192
+
};
193
+
194
+
host_memory_under_memory_pressure = {
195
+
condition = "rate(node_vmstat_pgmajfault[1m]) > 1000";
196
+
description = "{{$labels.instance}}: The node is under heavy memory pressure. High rate of major page faults: {{$value}}";
197
+
};
198
+
199
+
ext4_errors = {
200
+
condition = "ext4_errors_value > 0";
201
+
description = "{{$labels.instance}}: ext4 has reported {{$value}} I/O errors: check /sys/fs/ext4/*/errors_count";
202
+
};
203
+
204
+
alerts_silences_changed = {
205
+
condition = ''abs(delta(alertmanager_silences{state="active"}[1h])) >= 1'';
206
+
description = "alertmanager: number of active silences has changed: {{$value}}";
207
+
};
208
+
})
+110
nixos/2configs/monitoring/prometheus.nix
+110
nixos/2configs/monitoring/prometheus.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
#prometheus
4
+
krebs.iptables = {
5
+
enable = true;
6
+
tables.filter.INPUT.rules = [
7
+
{ predicate = "-i retiolum -p tcp --dport 80"; target = "ACCEPT"; } # nginx
8
+
# { predicate = "-i retiolum -p tcp --dport 3012"; target = "ACCEPT"; } # grafana
9
+
# { predicate = "-i retiolum -p tcp --dport 9093"; target = "ACCEPT"; } # alertmanager
10
+
# { predicate = "-i retiolum -p tcp --dport 9223"; target = "ACCEPT"; } # alertmanager
11
+
];
12
+
};
13
+
14
+
services.nginx = {
15
+
enable = true;
16
+
virtualHosts = {
17
+
"prometheus.lass.r" = {
18
+
locations."/".proxyPass = "http://localhost:9090";
19
+
};
20
+
"alert.lass.r" = {
21
+
locations."/".proxyPass = "http://localhost:9093";
22
+
};
23
+
"grafana.lass.r" = {
24
+
locations."/".proxyPass = "http://localhost:3012";
25
+
};
26
+
};
27
+
};
28
+
29
+
services.grafana = {
30
+
enable = true;
31
+
addr = "0.0.0.0";
32
+
port = 3012;
33
+
auth.anonymous = {
34
+
enable = true;
35
+
org_role = "Admin";
36
+
};
37
+
};
38
+
services.prometheus = {
39
+
enable = true;
40
+
ruleFiles = [
41
+
(pkgs.writeText "prometheus-rules.yml" (builtins.toJSON {
42
+
groups = [{
43
+
name = "alerting-rules";
44
+
rules = import ./alert-rules.nix { inherit lib; };
45
+
}];
46
+
}))
47
+
];
48
+
scrapeConfigs = [
49
+
{
50
+
job_name = "telegraf";
51
+
scrape_interval = "60s";
52
+
metrics_path = "/metrics";
53
+
static_configs = [
54
+
{
55
+
targets = [
56
+
"prism.r:9273"
57
+
"dishfire.r:9273"
58
+
"yellow.r:9273"
59
+
];
60
+
}
61
+
];
62
+
}
63
+
];
64
+
alertmanagers = [
65
+
{ scheme = "http";
66
+
path_prefix = "/";
67
+
static_configs = [ { targets = [ "localhost:9093" ]; } ];
68
+
}
69
+
];
70
+
alertmanager = {
71
+
enable = true;
72
+
webExternalUrl = "https://alert.lass.r";
73
+
listenAddress = "[::1]";
74
+
configuration = {
75
+
global = {
76
+
# The smarthost and SMTP sender used for mail notifications.
77
+
smtp_smarthost = "localhost:587";
78
+
smtp_from = "alertmanager@alert.lass.r";
79
+
# smtp_auth_username = "alertmanager@thalheim.io";
80
+
# smtp_auth_password = "$SMTP_PASSWORD";
81
+
};
82
+
route = {
83
+
receiver = "default";
84
+
routes = [
85
+
{
86
+
group_by = [ "host" ];
87
+
group_wait = "30s";
88
+
group_interval = "2m";
89
+
repeat_interval = "2h";
90
+
receiver = "all";
91
+
}
92
+
];
93
+
};
94
+
receivers = [
95
+
{
96
+
name = "all";
97
+
webhook_configs = [{
98
+
url = "http://127.0.0.1:9223/";
99
+
max_alerts = 5;
100
+
}];
101
+
}
102
+
{
103
+
name = "default";
104
+
}
105
+
];
106
+
};
107
+
};
108
+
};
109
+
110
+
}
+163
nixos/2configs/monitoring/telegraf.nix
+163
nixos/2configs/monitoring/telegraf.nix
···
1
+
{ pkgs, lib, config, ... }:
2
+
# To use this module you also need to allow port 9273 either on the internet or on a vpn interface
3
+
# i.e. networking.firewall.interfaces."vpn0".allowedTCPPorts = [ 9273 ];
4
+
# Example prometheus alert rules:
5
+
# - https://github.com/Mic92/dotfiles/blob/master/nixos/eva/modules/prometheus/alert-rules.nix
6
+
let
7
+
isVM = lib.any (mod: mod == "xen-blkfront" || mod == "virtio_console") config.boot.initrd.kernelModules;
8
+
# potentially wrong if the nvme is not used at boot...
9
+
hasNvme = lib.any (m: m == "nvme") config.boot.initrd.availableKernelModules;
10
+
11
+
ipv6DadCheck = pkgs.writeShellScript "ipv6-dad-check" ''
12
+
${pkgs.iproute2}/bin/ip --json addr | \
13
+
${pkgs.jq}/bin/jq -r 'map(.addr_info) | flatten(1) | map(select(.dadfailed == true)) | map(.local) | @text "ipv6_dad_failures count=\(length)i"'
14
+
'';
15
+
16
+
zfsChecks = lib.optional
17
+
(lib.any (fs: fs == "zfs") config.boot.supportedFilesystems)
18
+
(pkgs.writeScript "zpool-health" ''
19
+
#!${pkgs.gawk}/bin/awk -f
20
+
BEGIN {
21
+
while ("${pkgs.zfs}/bin/zpool status" | getline) {
22
+
if ($1 ~ /pool:/) { printf "zpool_status,name=%s ", $2 }
23
+
if ($1 ~ /state:/) { printf " state=\"%s\",", $2 }
24
+
if ($1 ~ /errors:/) {
25
+
if (index($2, "No")) printf "errors=0i\n"; else printf "errors=%di\n", $2
26
+
}
27
+
}
28
+
}
29
+
'');
30
+
31
+
nfsChecks =
32
+
let
33
+
collectHosts = shares: fs:
34
+
if builtins.elem fs.fsType [ "nfs" "nfs3" "nfs4" ]
35
+
then
36
+
shares
37
+
// (
38
+
let
39
+
# also match ipv6 addresses
40
+
group = builtins.match "\\[?([^\]]+)]?:([^:]+)$" fs.device;
41
+
host = builtins.head group;
42
+
path = builtins.elemAt group 1;
43
+
in
44
+
{
45
+
${host} = (shares.${host} or [ ]) ++ [ path ];
46
+
}
47
+
)
48
+
else shares;
49
+
nfsHosts = lib.foldl collectHosts { } (builtins.attrValues config.fileSystems);
50
+
in
51
+
lib.mapAttrsToList
52
+
(
53
+
host: args:
54
+
(pkgs.writeScript "nfs-health" ''
55
+
#!${pkgs.gawk}/bin/awk -f
56
+
BEGIN {
57
+
for (i = 2; i < ARGC; i++) {
58
+
mounts[ARGV[i]] = 1
59
+
}
60
+
while ("${pkgs.nfs-utils}/bin/showmount -e " ARGV[1] | getline) {
61
+
if (NR == 1) { continue }
62
+
if (mounts[$1] == 1) {
63
+
printf "nfs_export,host=%s,path=%s present=1\n", ARGV[1], $1
64
+
}
65
+
delete mounts[$1]
66
+
}
67
+
for (mount in mounts) {
68
+
printf "nfs_export,host=%s,path=%s present=0\n", ARGV[1], $1
69
+
}
70
+
}
71
+
'')
72
+
+ " ${host} ${builtins.concatStringsSep " " args}"
73
+
)
74
+
nfsHosts;
75
+
76
+
in
77
+
{
78
+
79
+
systemd.services.telegraf.path = lib.optional (!isVM && hasNvme) pkgs.nvme-cli;
80
+
81
+
services.telegraf = {
82
+
enable = true;
83
+
extraConfig = {
84
+
agent.interval = "60s";
85
+
inputs = {
86
+
prometheus.urls = lib.mkIf config.services.promtail.enable [
87
+
# default promtail port
88
+
"http://localhost:9080/metrics"
89
+
];
90
+
prometheus.metric_version = 2;
91
+
kernel_vmstat = { };
92
+
nginx.urls = lib.mkIf config.services.nginx.statusPage [
93
+
"http://localhost/nginx_status"
94
+
];
95
+
smart = lib.mkIf (!isVM) {
96
+
path_smartctl = pkgs.writeShellScript "smartctl" ''
97
+
exec /run/wrappers/bin/sudo ${pkgs.smartmontools}/bin/smartctl "$@"
98
+
'';
99
+
};
100
+
system = { };
101
+
mem = { };
102
+
file =
103
+
[
104
+
{
105
+
data_format = "influx";
106
+
file_tag = "name";
107
+
files = [ "/var/log/telegraf/*" ];
108
+
}
109
+
]
110
+
++ lib.optional (lib.any (fs: fs == "ext4") config.boot.supportedFilesystems) {
111
+
name_override = "ext4_errors";
112
+
files = [ "/sys/fs/ext4/*/errors_count" ];
113
+
data_format = "value";
114
+
};
115
+
exec = [
116
+
{
117
+
## Commands array
118
+
commands =
119
+
[ ipv6DadCheck ]
120
+
++ zfsChecks
121
+
++ nfsChecks;
122
+
data_format = "influx";
123
+
}
124
+
];
125
+
systemd_units = { };
126
+
swap = { };
127
+
disk.tagdrop = {
128
+
fstype = [ "tmpfs" "ramfs" "devtmpfs" "devfs" "iso9660" "overlay" "aufs" "squashfs" ];
129
+
device = [ "rpc_pipefs" "lxcfs" "nsfs" "borgfs" ];
130
+
};
131
+
diskio = { };
132
+
zfs = {
133
+
poolMetrics = true;
134
+
};
135
+
} // lib.optionalAttrs (if lib.versionAtLeast (lib.versions.majorMinor lib.version) "23.11" then config.boot.swraid.enable else config.boot.initrd.services.swraid.enable) {
136
+
mdstat = { };
137
+
};
138
+
outputs.prometheus_client = {
139
+
listen = ":9273";
140
+
metric_version = 2;
141
+
};
142
+
};
143
+
};
144
+
security.sudo.extraRules = lib.mkIf (!isVM) [
145
+
{
146
+
users = [ "telegraf" ];
147
+
commands = [
148
+
{
149
+
command = "${pkgs.smartmontools}/bin/smartctl";
150
+
options = [ "NOPASSWD" ];
151
+
}
152
+
];
153
+
}
154
+
];
155
+
# avoid logging sudo use
156
+
security.sudo.configFile = ''
157
+
Defaults:telegraf !syslog,!pam_session
158
+
'';
159
+
# create dummy file to avoid telegraf errors
160
+
systemd.tmpfiles.rules = [
161
+
"f /var/log/telegraf/dummy 0444 root root - -"
162
+
];
163
+
}
+47
nixos/2configs/os-templates/CAC-CentOS-6.5-64bit.nix
+47
nixos/2configs/os-templates/CAC-CentOS-6.5-64bit.nix
···
1
+
_:
2
+
3
+
{
4
+
boot.loader.grub = {
5
+
device = "/dev/sda";
6
+
splashImage = null;
7
+
};
8
+
9
+
boot.initrd.availableKernelModules = [
10
+
"ata_piix"
11
+
"vmw_pvscsi"
12
+
];
13
+
14
+
fileSystems."/" = {
15
+
device = "/dev/VolGroup/lv_root";
16
+
fsType = "ext4";
17
+
};
18
+
19
+
fileSystems."/boot" = {
20
+
device = "/dev/sda1";
21
+
fsType = "ext4";
22
+
};
23
+
24
+
swapDevices = [
25
+
{ device = "/dev/VolGroup/lv_swap"; }
26
+
];
27
+
28
+
users.extraGroups = {
29
+
# ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories
30
+
# Loaded: loaded (/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/example/systemd/system/systemd-tmpfiles-setup.service)
31
+
# Active: failed (Result: exit-code) since Mon 2015-03-16 10:29:18 UTC; 4s ago
32
+
# Docs: man:tmpfiles.d(5)
33
+
# man:systemd-tmpfiles(8)
34
+
# Process: 19272 ExecStart=/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev (code=exited, status=1/FAILURE)
35
+
# Main PID: 19272 (code=exited, status=1/FAILURE)
36
+
#
37
+
# Mar 16 10:29:17 cd systemd-tmpfiles[19272]: [/usr/lib/tmpfiles.d/legacy.conf:26] Unknown group 'lock'.
38
+
# Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal configured, ignoring.
39
+
# Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal/7b35116927d74ea58785e00b47ac0f0d configured, ignoring.
40
+
# Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service: main process exited, code=exited, status=1/FAILURE
41
+
# Mar 16 10:29:18 cd systemd[1]: Failed to start Create Volatile Files and Directories.
42
+
# Mar 16 10:29:18 cd systemd[1]: Unit systemd-tmpfiles-setup.service entered failed state.
43
+
# Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service failed.
44
+
# warning: error(s) occured while switching to the new configuration
45
+
lock.gid = 10001;
46
+
};
47
+
}
+47
nixos/2configs/os-templates/CAC-CentOS-7-64bit.nix
+47
nixos/2configs/os-templates/CAC-CentOS-7-64bit.nix
···
1
+
_:
2
+
3
+
{
4
+
boot.loader.grub = {
5
+
device = "/dev/sda";
6
+
splashImage = null;
7
+
};
8
+
9
+
boot.initrd.availableKernelModules = [
10
+
"ata_piix"
11
+
"vmw_pvscsi"
12
+
];
13
+
14
+
fileSystems."/" = {
15
+
device = "/dev/centos/root";
16
+
fsType = "xfs";
17
+
};
18
+
19
+
fileSystems."/boot" = {
20
+
device = "/dev/sda1";
21
+
fsType = "xfs";
22
+
};
23
+
24
+
swapDevices = [
25
+
{ device = "/dev/centos/swap"; }
26
+
];
27
+
28
+
users.extraGroups = {
29
+
# ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories
30
+
# Loaded: loaded (/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/example/systemd/system/systemd-tmpfiles-setup.service)
31
+
# Active: failed (Result: exit-code) since Mon 2015-03-16 10:29:18 UTC; 4s ago
32
+
# Docs: man:tmpfiles.d(5)
33
+
# man:systemd-tmpfiles(8)
34
+
# Process: 19272 ExecStart=/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev (code=exited, status=1/FAILURE)
35
+
# Main PID: 19272 (code=exited, status=1/FAILURE)
36
+
#
37
+
# Mar 16 10:29:17 cd systemd-tmpfiles[19272]: [/usr/lib/tmpfiles.d/legacy.conf:26] Unknown group 'lock'.
38
+
# Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal configured, ignoring.
39
+
# Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal/7b35116927d74ea58785e00b47ac0f0d configured, ignoring.
40
+
# Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service: main process exited, code=exited, status=1/FAILURE
41
+
# Mar 16 10:29:18 cd systemd[1]: Failed to start Create Volatile Files and Directories.
42
+
# Mar 16 10:29:18 cd systemd[1]: Unit systemd-tmpfiles-setup.service entered failed state.
43
+
# Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service failed.
44
+
# warning: error(s) occured while switching to the new configuration
45
+
lock.gid = 10001;
46
+
};
47
+
}
+33
nixos/2configs/ppp/umts-stick.nix
+33
nixos/2configs/ppp/umts-stick.nix
···
1
+
{ pkgs, ... }: {
2
+
3
+
# usage: pppd call stick
4
+
5
+
environment.etc."ppp/peers/stick".text = ''
6
+
/dev/ttyUSB0
7
+
460800
8
+
crtscts
9
+
defaultroute
10
+
holdoff 10
11
+
lock
12
+
maxfail 0
13
+
noauth
14
+
nodetach
15
+
noipdefault
16
+
passive
17
+
persist
18
+
usepeerdns
19
+
connect "${pkgs.ppp}/bin/chat -f ${pkgs.writeText "default.chat" ''
20
+
ABORT "BUSY"
21
+
ABORT "NO CARRIER"
22
+
REPORT CONNECT
23
+
"" "ATDT*99#"
24
+
CONNECT
25
+
''}"
26
+
'';
27
+
28
+
environment.systemPackages = [
29
+
pkgs.ppp
30
+
];
31
+
32
+
}
33
+
+32
nixos/2configs/ppp/x220-modem.nix
+32
nixos/2configs/ppp/x220-modem.nix
···
1
+
{ pkgs, ... }: {
2
+
3
+
# usage: pppd call x220
4
+
5
+
environment.etc."ppp/peers/x220".text = ''
6
+
/dev/ttyACM2
7
+
921600
8
+
crtscts
9
+
defaultroute
10
+
holdoff 10
11
+
lock
12
+
maxfail 0
13
+
noauth
14
+
nodetach
15
+
noipdefault
16
+
passive
17
+
persist
18
+
usepeerdns
19
+
connect "${pkgs.ppp}/bin/chat -f ${pkgs.writeText "default.chat" ''
20
+
ABORT "BUSY"
21
+
ABORT "NO CARRIER"
22
+
REPORT CONNECT
23
+
"" "ATDT*99#"
24
+
CONNECT
25
+
''}"
26
+
'';
27
+
28
+
environment.systemPackages = [
29
+
pkgs.ppp
30
+
];
31
+
32
+
}
+10
nixos/2configs/sync/decsync.nix
+10
nixos/2configs/sync/decsync.nix
···
1
+
{
2
+
services.syncthing.folders.decsync = {
3
+
path = "/home/lass/decsync";
4
+
devices = [ "mors" "blue" "green" "phone" "massulus" ];
5
+
};
6
+
7
+
krebs.acl."/home/lass/decsync"."u:syncthing:X".parents = true;
8
+
krebs.acl."/home/lass/decsync"."u:syncthing:rwX" = {};
9
+
krebs.acl."/home/lass/decsync"."u:lass:rwX" = {};
10
+
}
+17
nixos/2configs/sync/sync.nix
+17
nixos/2configs/sync/sync.nix
···
1
+
{ self, ... }:
2
+
{
3
+
imports = [ self.inputs.stockholm.nixosModules.acl ];
4
+
services.syncthing.folders."/home/lass/sync" = {
5
+
devices = [
6
+
"mors"
7
+
"xerxes"
8
+
"green"
9
+
"blue"
10
+
"coaxmetal"
11
+
"aergia"
12
+
];
13
+
};
14
+
krebs.acl."/home/lass/sync"."u:syncthing:X".parents = true;
15
+
krebs.acl."/home/lass/sync"."u:syncthing:rwX" = {};
16
+
krebs.acl."/home/lass/sync"."u:lass:rwX" = {};
17
+
}
+9
nixos/2configs/sync/the_playlist.nix
+9
nixos/2configs/sync/the_playlist.nix
···
1
+
{
2
+
services.syncthing.folders.the_playlist = {
3
+
path = "/home/lass/tmp/the_playlist";
4
+
devices = [ "mors" "phone" "prism" "omo" "radio" ];
5
+
};
6
+
krebs.acl."/home/lass/tmp/the_playlist"."u:syncthing:X".parents = true;
7
+
krebs.acl."/home/lass/tmp/the_playlist"."u:syncthing:rwX" = {};
8
+
krebs.acl."/home/lass/tmp/the_playlist"."u:lass:rwX" = {};
9
+
}
+6
nixos/2configs/sync/weechat.nix
+6
nixos/2configs/sync/weechat.nix
+35
nixos/2configs/wayland/starter
+35
nixos/2configs/wayland/starter
···
1
+
#!/usr/bin/env bash
2
+
3
+
set -efo pipefail
4
+
5
+
SWAY_FLAGS=()
6
+
7
+
while [[ "$#" -gt 0 ]]; do
8
+
case $1 in
9
+
--)
10
+
shift
11
+
break
12
+
;;
13
+
*)
14
+
SWAY_FLAGS+=($1)
15
+
;;
16
+
esac
17
+
shift
18
+
done
19
+
20
+
$@ &
21
+
pid=$!
22
+
23
+
swaymsg -t subscribe -m '[ "window" ]' \
24
+
| jq --unbuffered --argjson pid "$pid" '.container | select(.pid == $pid) | .id' \
25
+
| xargs -I '@' -- swaymsg "[ con_id=@ ] ${SWAY_FLAGS[@]}" &
26
+
27
+
subscription=$!
28
+
29
+
echo Going into wait state
30
+
31
+
# Wait for our process to close
32
+
tail --pid=$pid -f /dev/null
33
+
34
+
echo Killing subscription
35
+
kill $subscription
+346
nixos/2configs/wayland/sway.nix
+346
nixos/2configs/wayland/sway.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
3
+
term = "/run/current-system/sw/bin/alacritty";
4
+
5
+
in {
6
+
imports = [
7
+
../alacritty.nix
8
+
../mpv.nix
9
+
../power-action.nix
10
+
../urxvt.nix
11
+
../xdg-open.nix
12
+
../yubikey.nix
13
+
../tmux.nix
14
+
../themes.nix
15
+
../fonts.nix
16
+
# ./pipewire.nix
17
+
# ./tty-share.nix
18
+
{
19
+
users.users.mainUser.packages = [
20
+
pkgs.sshuttle
21
+
];
22
+
security.sudo.extraConfig = ''
23
+
lass ALL= (root) NOPASSWD:SETENV: ${pkgs.sshuttle}/bin/.sshuttle-wrapped
24
+
'';
25
+
}
26
+
];
27
+
users.users.mainUser.extraGroups = [ "audio" "pipewire" "video" "input" ];
28
+
29
+
services.clipmenu.enable = true;
30
+
31
+
services.udev.extraRules = ''
32
+
SUBSYSTEM=="backlight", ACTION=="add", \
33
+
RUN+="${pkgs.coreutils}/bin/chgrp video /sys/class/backlight/%k/brightness", \
34
+
RUN+="${pkgs.coreutils}/bin/chmod g+w /sys/class/backlight/%k/brightness"
35
+
'';
36
+
37
+
nixpkgs.config.packageOverrides = super: {
38
+
dmenu = pkgs.writeDashBin "dmenu" ''
39
+
unset TERM
40
+
${pkgs.fzfmenu}/bin/fzfmenu "$@"
41
+
'';
42
+
};
43
+
44
+
environment.systemPackages = [
45
+
(pkgs.writers.writeDashBin "dmenu-wl" ''
46
+
unset TERM
47
+
${pkgs.fzfmenu}/bin/fzfmenu "$@"
48
+
'')
49
+
pkgs.ydotool
50
+
pkgs.wl-clipboard
51
+
pkgs.fzfmenu
52
+
pkgs.glib
53
+
pkgs.dracula-theme
54
+
pkgs.gnome3.adwaita-icon-theme
55
+
];
56
+
57
+
services.dbus.enable = true;
58
+
xdg.portal = {
59
+
enable = true;
60
+
wlr.enable = true;
61
+
# gtk portal needed to make gtk apps happy
62
+
extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
63
+
};
64
+
programs.sway = {
65
+
enable = true;
66
+
wrapperFeatures.gtk = true;
67
+
};
68
+
69
+
environment.etc."sway/config".text = ''
70
+
# Default config for sway
71
+
#
72
+
# Copy this to ~/.config/sway/config and edit it to your liking.
73
+
#
74
+
# Read `man 5 sway` for a complete reference.
75
+
76
+
### Variables
77
+
#
78
+
# Logo key. Use Mod1 for Alt.
79
+
set $mod Mod4
80
+
# Home row direction keys, like vim
81
+
set $left h
82
+
set $down j
83
+
set $up k
84
+
set $right l
85
+
# Your preferred terminal emulator
86
+
set $term ${term}
87
+
# Your preferred application launcher
88
+
# Note: pass the final command to swaymsg so that the resulting window can be opened
89
+
# on the original workspace that the command was run on.
90
+
set $menu ${pkgs.dmenu}/bin/dmenu_path | fzfmenu | xargs swaymsg exec --
91
+
92
+
### Output configuration
93
+
#
94
+
# Default wallpaper (more resolutions are available in @datadir@/backgrounds/sway/)
95
+
# output * bg @datadir@/backgrounds/sway/Sway_Wallpaper_Blue_1920x1080.png fill
96
+
#
97
+
# Example configuration:
98
+
#
99
+
# output HDMI-A-1 resolution 1920x1080 position 1920,0
100
+
#
101
+
# You can get the names of your outputs by running: swaymsg -t get_outputs
102
+
103
+
### Idle configuration
104
+
#
105
+
# Example configuration:
106
+
#
107
+
# exec swayidle -w \
108
+
# timeout 300 'swaylock -f -c 000000' \
109
+
# timeout 600 'swaymsg "output * power off"' resume 'swaymsg "output * power on"' \
110
+
# before-sleep 'swaylock -f -c 000000'
111
+
#
112
+
# This will lock your screen after 300 seconds of inactivity, then turn off
113
+
# your displays after another 300 seconds, and turn your screens back on when
114
+
# resumed. It will also lock your screen before your computer goes to sleep.
115
+
116
+
### Input configuration
117
+
#
118
+
# Example configuration:
119
+
#
120
+
# input "2:14:SynPS/2_Synaptics_TouchPad" {
121
+
# dwt enabled
122
+
# tap enabled
123
+
# natural_scroll enabled
124
+
# middle_emulation enabled
125
+
# }
126
+
#
127
+
# You can get the names of your inputs by running: swaymsg -t get_inputs
128
+
# Read `man 5 sway-input` for more information about this section.
129
+
130
+
### Key bindings
131
+
#
132
+
# Basics:
133
+
#
134
+
# Start a terminal
135
+
bindsym $mod+Shift+Return exec $term
136
+
137
+
# Kill focused window
138
+
bindsym $mod+Shift+c kill
139
+
140
+
# Start your launcher
141
+
bindsym $mod+d exec $menu
142
+
143
+
# Drag floating windows by holding down $mod and left mouse button.
144
+
# Resize them with right mouse button + $mod.
145
+
# Despite the name, also works for non-floating windows.
146
+
# Change normal to inverse to use left mouse button for resizing and right
147
+
# mouse button for dragging.
148
+
floating_modifier $mod normal
149
+
150
+
# Reload the configuration file
151
+
bindsym $mod+Shift+r reload
152
+
153
+
# Exit sway (logs you out of your Wayland session)
154
+
bindsym $mod+Shift+e exec swaynag -t warning -m 'You pressed the exit shortcut. Do you really want to exit sway? This will end your Wayland session.' -B 'Yes, exit sway' 'swaymsg exit'
155
+
#
156
+
# Moving around:
157
+
#
158
+
# Move your focus around
159
+
bindsym $mod+Left focus left
160
+
bindsym $mod+Down focus down
161
+
bindsym $mod+Up focus up
162
+
bindsym $mod+Right focus right
163
+
164
+
# Move the focused window with the same, but add Shift
165
+
bindsym $mod+Shift+Left move left
166
+
bindsym $mod+Shift+Down move down
167
+
bindsym $mod+Shift+Up move up
168
+
bindsym $mod+Shift+Right move right
169
+
# Layout stuff:
170
+
#
171
+
# You can "split" the current object of your focus with
172
+
# $mod+b or $mod+v, for horizontal and vertical splits
173
+
# respectively.
174
+
bindsym $mod+b splith
175
+
bindsym $mod+v splitv
176
+
177
+
# Switch the current container between different layout styles
178
+
bindsym $mod+s layout stacking
179
+
bindsym $mod+w layout tabbed
180
+
bindsym $mod+e layout toggle split
181
+
182
+
# Make the current focus fullscreen
183
+
bindsym $mod+f fullscreen
184
+
185
+
# Toggle the current focus between tiling and floating mode
186
+
bindsym $mod+Shift+space floating toggle
187
+
188
+
# Swap focus between the tiling area and the floating area
189
+
bindsym $mod+space focus mode_toggle
190
+
191
+
# Move focus to the parent container
192
+
bindsym $mod+Shift+a focus parent
193
+
#
194
+
# Scratchpad:
195
+
#
196
+
# Sway has a "scratchpad", which is a bag of holding for windows.
197
+
# You can send windows there and get them back later.
198
+
199
+
# Move the currently focused window to the scratchpad
200
+
bindsym $mod+Shift+minus move scratchpad
201
+
202
+
# Show the next scratchpad window or hide the focused scratchpad window.
203
+
# If there are multiple scratchpad windows, this command cycles through them.
204
+
bindsym $mod+minus scratchpad show
205
+
#
206
+
# Resizing containers:
207
+
#
208
+
mode "resize" {
209
+
# left will shrink the containers width
210
+
# right will grow the containers width
211
+
# up will shrink the containers height
212
+
# down will grow the containers height
213
+
bindsym $left resize shrink width 10px
214
+
bindsym $down resize grow height 10px
215
+
bindsym $up resize shrink height 10px
216
+
bindsym $right resize grow width 10px
217
+
218
+
# Ditto, with arrow keys
219
+
bindsym Left resize shrink width 10px
220
+
bindsym Down resize grow height 10px
221
+
bindsym Up resize shrink height 10px
222
+
bindsym Right resize grow width 10px
223
+
224
+
# Return to default mode
225
+
bindsym Return mode "default"
226
+
bindsym Escape mode "default"
227
+
}
228
+
bindsym $mod+r mode "resize"
229
+
230
+
#
231
+
# Status Bar:
232
+
#
233
+
# Read `man 5 sway-bar` for more information about this section.
234
+
bar {
235
+
position top
236
+
237
+
# When the status_command prints a new line to stdout, swaybar updates.
238
+
# The default just shows the current date and time.
239
+
status_command while date +'%Y-%m-%d %H:%M:%S'; do sleep 1; done
240
+
241
+
colors {
242
+
statusline #ffffff
243
+
background #323232
244
+
inactive_workspace #32323200 #32323200 #5c5c5c
245
+
}
246
+
}
247
+
248
+
default_border pixel 1
249
+
default_floating_border none
250
+
smart_borders on
251
+
252
+
bindsym $mod+q exec ${pkgs.writers.writeDash "goto_workspace" ''
253
+
set -efux
254
+
unset TERM # we want fzfmenu to start a new terminal
255
+
CURRENT_OUTPUT=$(swaymsg -r -t get_outputs | jq '.[] | select(.focused == true).name')
256
+
FZFMENU_FZF_DEFAULT_OPTS="--select-1"
257
+
WS=$(swaymsg -r -t get_workspaces |
258
+
jq -r '.[].name' |
259
+
fzfmenu -p 'Workspace name: '
260
+
)
261
+
if [ -n "$WS" ]; then
262
+
swaymsg workspace "$WS"
263
+
swaymsg move workspace to output "$CURRENT_OUTPUT"
264
+
fi
265
+
''}
266
+
267
+
bindsym $mod+Shift+q exec ${pkgs.writers.writeDash "moveto_workspace" ''
268
+
set -efux
269
+
unset TERM # we want fzfmenu to start a new terminal
270
+
FZFMENU_FZF_DEFAULT_OPTS="--select-1"
271
+
WS=$(swaymsg -r -t get_workspaces |
272
+
jq -r '.[].name' |
273
+
fzfmenu -p 'Workspace name: '
274
+
)
275
+
if [ -n "$WS" ]; then
276
+
swaymsg move container to workspace "$WS"
277
+
fi
278
+
''}
279
+
280
+
bindsym $mod+x exec ${./starter} floating enable -- ${pkgs.alacritty}/bin/alacritty --config-file /var/theme/config/alacritty.yaml
281
+
bindsym $mod+y exec /run/current-system/sw/bin/switch-theme toggle
282
+
283
+
for_window [title="fzfmenu"] floating enable
284
+
bindsym $mod+Tab focus next
285
+
bindsym $mod+Escape workspace back_and_forth
286
+
287
+
bindsym $mod+p exec ${pkgs.writers.writeDash "passmenu" ''
288
+
set -efux
289
+
unset TERM # we want fzfmenu to start a new terminal
290
+
(cd $HOME/.password-store; find -type f -name '*.gpg') |
291
+
sed -e 's/\.gpg$//' |
292
+
fzfmenu -p 'Password: ' |
293
+
xargs -I{} pass show {} |
294
+
tr -d '\n' |
295
+
${pkgs.wtype}/bin/wtype -s 1 -
296
+
''}
297
+
bindsym $mod+Shift+p exec ${pkgs.writers.writeDash "otpmenu" ''
298
+
unset TERM
299
+
${pkgs.otpmenu}/bin/otpmenu
300
+
''}
301
+
302
+
# screenlock
303
+
bindsym $mod+F11 exec ${pkgs.swaylock}/bin/swaylock -f -c 000000
304
+
305
+
# media buttons
306
+
bindsym XF86AudioMute exec ${pkgs.pulseaudio.out}/bin/pactl -- set-sink-mute @DEFAULT_SINK@ toggle
307
+
bindsym XF86AudioRaiseVolume exec ${pkgs.pulseaudio.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ +4%
308
+
bindsym XF86AudioLowerVolume exec ${pkgs.pulseaudio.out}/bin/pactl -- set-sink-volume @DEFAULT_SINK@ -4%
309
+
bindsym XF86MonBrightnessDown exec ${pkgs.acpilight}/bin/xbacklight -time 0 -dec 1
310
+
bindsym XF86MonBrightnessUp exec ${pkgs.acpilight}/bin/xbacklight -time 0 -inc 1
311
+
312
+
# background programs
313
+
exec ydotoold
314
+
exec_always pkill kanshi; exec ${pkgs.kanshi}/bin/kanshi
315
+
316
+
# theme and env specific stuff
317
+
exec_always ${pkgs.writers.writeDash "dbus-sway-environment" ''
318
+
set -efux
319
+
dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP=sway
320
+
systemctl --user stop xdg-desktop-portal xdg-desktop-portal-wlr
321
+
systemctl --user start xdg-desktop-portal xdg-desktop-portal-wlr
322
+
''}
323
+
324
+
exec_always ${let
325
+
schema = pkgs.gsettings-desktop-schemas;
326
+
datadir = "${schema}/share/gsettings-schemas/${schema.name}";
327
+
in pkgs.writers.writeDash "gsettings" ''
328
+
set -efux
329
+
export XDG_DATA_DIRS=${pkgs.gsettings-desktop-schemas}:$XDG_DATA_DIRS
330
+
gnome_schema=org.gnome.desktop.interface
331
+
gsettings set $gnome_schema gtk-theme 'Dracula'
332
+
''}
333
+
334
+
# keyboard
335
+
input type:keyboard {
336
+
xkb_layout us
337
+
xkb_variant altgr-intl
338
+
xkb_options caps:hyper
339
+
}
340
+
341
+
# flameshot
342
+
for_window [app_id="flameshot"] border pixel 0, floating enable, fullscreen disable, move absolute position 0 0
343
+
exec ${pkgs.flameshot}/bin/flameshot
344
+
'';
345
+
346
+
}
+20
nixos/2configs/websites/default.nix
+20
nixos/2configs/websites/default.nix
···
1
+
{ config, lib, ... }:
2
+
3
+
{
4
+
services.nginx = {
5
+
enable = true;
6
+
recommendedGzipSettings = true;
7
+
recommendedOptimisation = true;
8
+
recommendedTlsSettings = true;
9
+
10
+
enableReload = true;
11
+
12
+
virtualHosts.default = {
13
+
locations."= /etc/os-release".extraConfig = ''
14
+
default_type text/plain;
15
+
alias /etc/os-release;
16
+
'';
17
+
};
18
+
};
19
+
}
20
+
+454
nixos/2configs/websites/domsen.nix
+454
nixos/2configs/websites/domsen.nix
···
1
+
{ config, pkgs, lib, ... }:
2
+
3
+
let
4
+
5
+
inherit (import <stockholm/lib>)
6
+
genid
7
+
genid_uint31
8
+
;
9
+
inherit (import <stockholm/lass/2configs/websites/util.nix> {inherit lib pkgs;})
10
+
servePage
11
+
serveOwncloud
12
+
serveWordpress;
13
+
14
+
msmtprc = pkgs.writeText "msmtprc" ''
15
+
account localhost
16
+
host localhost
17
+
account default: localhost
18
+
'';
19
+
20
+
sendmail = pkgs.writeDash "msmtp" ''
21
+
exec ${pkgs.msmtp}/bin/msmtp --read-envelope-from -C ${msmtprc} "$@"
22
+
'';
23
+
24
+
in {
25
+
imports = [
26
+
./default.nix
27
+
./sqlBackup.nix
28
+
(servePage [ "aldonasiech.com" "www.aldonasiech.com" ])
29
+
(servePage [ "apanowicz.de" "www.apanowicz.de" ])
30
+
(servePage [ "reich-gebaeudereinigung.de" "www.reich-gebaeudereinigung.de" ])
31
+
(servePage [ "illustra.de" "www.illustra.de" ])
32
+
(servePage [ "event-extra.de" "www.event-extra.de" ])
33
+
# (servePage [ "nirwanabluete.de" "www.nirwanabluete.de" ])
34
+
(servePage [ "familienrat-hamburg.de" "www.familienrat-hamburg.de" ])
35
+
(servePage [ "karlaskop.de" ])
36
+
(servePage [
37
+
"freemonkey.art"
38
+
"www.freemonkey.art"
39
+
])
40
+
(serveOwncloud [ "o.ubikmedia.de" ])
41
+
(serveWordpress [
42
+
"ubikmedia.de"
43
+
"ubikmedia.eu"
44
+
"youthtube.xyz"
45
+
"joemisch.com"
46
+
"weirdwednesday.de"
47
+
"jarugadesign.de"
48
+
"beesmooth.ch"
49
+
50
+
"www.ubikmedia.eu"
51
+
"www.youthtube.xyz"
52
+
"www.ubikmedia.de"
53
+
"www.joemisch.com"
54
+
"www.weirdwednesday.de"
55
+
"www.jarugadesign.de"
56
+
"www.beesmooth.ch"
57
+
58
+
"aldona2.ubikmedia.de"
59
+
"cinevita.ubikmedia.de"
60
+
"factscloud.ubikmedia.de"
61
+
"illucloud.ubikmedia.de"
62
+
"joemisch.ubikmedia.de"
63
+
"nb.ubikmedia.de"
64
+
"youthtube.ubikmedia.de"
65
+
"weirdwednesday.ubikmedia.de"
66
+
"freemonkey.ubikmedia.de"
67
+
"jarugadesign.ubikmedia.de"
68
+
"crypto4art.ubikmedia.de"
69
+
"jarugadesign.ubikmedia.de"
70
+
"beesmooth.ubikmedia.de"
71
+
])
72
+
];
73
+
74
+
# https://github.com/nextcloud/server/issues/25436
75
+
services.mysql.settings.mysqld.innodb_read_only_compressed = 0;
76
+
77
+
services.mysql.ensureDatabases = [ "ubikmedia_de" "o_ubikmedia_de" ];
78
+
services.mysql.ensureUsers = [
79
+
{ ensurePermissions = { "ubikmedia_de.*" = "ALL"; }; name = "nginx"; }
80
+
{ ensurePermissions = { "o_ubikmedia_de.*" = "ALL"; }; name = "nginx"; }
81
+
];
82
+
83
+
services.nginx.virtualHosts."ubikmedia.de".locations."/piwika".extraConfig = ''
84
+
try_files $uri $uri/ /index.php?$args;
85
+
'';
86
+
87
+
lass.mysqlBackup.config.all.databases = [
88
+
"ubikmedia_de"
89
+
"o_ubikmedia_de"
90
+
];
91
+
92
+
services.phpfpm.phpOptions = ''
93
+
sendmail_path = ${sendmail} -t
94
+
upload_max_filesize = 100M
95
+
post_max_size = 100M
96
+
file_uploads = on
97
+
'';
98
+
99
+
systemd.services.nextcloud-setup.after = [ "secret-nextcloud_pw.service" ];
100
+
krebs.secret.files.nextcloud_pw = {
101
+
path = "/run/nextcloud.pw";
102
+
owner.name = "nextcloud";
103
+
group-name = "nextcloud";
104
+
source-path = toString <secrets> + "/nextcloud_pw";
105
+
};
106
+
services.nextcloud = {
107
+
enable = true;
108
+
enableBrokenCiphersForSSE = false;
109
+
hostName = "o.xanf.org";
110
+
package = pkgs.nextcloud25;
111
+
config = {
112
+
adminpassFile = "/run/nextcloud.pw";
113
+
overwriteProtocol = "https";
114
+
};
115
+
https = true;
116
+
};
117
+
services.nginx.virtualHosts."o.xanf.org" = {
118
+
enableACME = true;
119
+
forceSSL = true;
120
+
};
121
+
122
+
# MAIL STUFF
123
+
# TODO: make into its own module
124
+
125
+
services.roundcube = {
126
+
enable = true;
127
+
hostName = "mail.lassul.us";
128
+
extraConfig = ''
129
+
$config['smtp_debug'] = true;
130
+
$config['smtp_host'] = "localhost:25";
131
+
'';
132
+
};
133
+
services.dovecot2 = {
134
+
enable = true;
135
+
showPAMFailure = true;
136
+
mailLocation = "maildir:~/Mail";
137
+
sslServerCert = "/var/lib/acme/lassul.us/fullchain.pem";
138
+
sslServerKey = "/var/lib/acme/lassul.us/key.pem";
139
+
};
140
+
krebs.iptables.tables.filter.INPUT.rules = [
141
+
{ predicate = "-p tcp --dport pop3s"; target = "ACCEPT"; }
142
+
{ predicate = "-p tcp --dport imaps"; target = "ACCEPT"; }
143
+
];
144
+
145
+
environment.systemPackages = [
146
+
(pkgs.writers.writeDashBin "debug_exim" ''
147
+
set -ef
148
+
export PATH="${lib.makeBinPath [ pkgs.coreutils ]}"
149
+
echo "$@" >> /tmp/xxx
150
+
/run/wrappers/bin/shadow_verify_arg "${config.lass.usershadow.pattern}" "$2" "$3" 2>>/tmp/xxx1
151
+
echo "ok" >> /tmp/yyy
152
+
exit 23
153
+
'')
154
+
];
155
+
156
+
krebs.exim-smarthost = {
157
+
authenticators.PLAIN = ''
158
+
driver = plaintext
159
+
public_name = PLAIN
160
+
server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
161
+
'';
162
+
authenticators.LOGIN = ''
163
+
driver = plaintext
164
+
public_name = LOGIN
165
+
server_prompts = "Username:: : Password::"
166
+
server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
167
+
# server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
168
+
'';
169
+
internet-aliases = [
170
+
{ from = "dma@ubikmedia.de"; to = "domsen"; }
171
+
{ from = "dma@ubikmedia.eu"; to = "domsen"; }
172
+
{ from = "mail@habsys.de"; to = "domsen"; }
173
+
{ from = "mail@habsys.eu"; to = "domsen"; }
174
+
{ from = "hallo@apanowicz.de"; to = "domsen"; }
175
+
{ from = "bruno@apanowicz.de"; to = "bruno"; }
176
+
{ from = "mail@jla-trading.com"; to = "jla-trading"; }
177
+
{ from = "jms@ubikmedia.eu"; to = "jms"; }
178
+
{ from = "ms@ubikmedia.eu"; to = "ms"; }
179
+
{ from = "ubik@ubikmedia.eu"; to = "domsen, jms, ms"; }
180
+
{ from = "kontakt@alewis.de"; to ="klabusterbeere"; }
181
+
{ from = "hallo@jarugadesign.de"; to ="kasia"; }
182
+
{ from = "noreply@beeshmooth.ch"; to ="besmooth@gmx.ch"; }
183
+
184
+
{ from = "testuser@lassul.us"; to = "testuser"; }
185
+
{ from = "testuser@ubikmedia.eu"; to = "testuser"; }
186
+
];
187
+
sender_domains = [
188
+
"jla-trading.com"
189
+
"ubikmedia.eu"
190
+
"ubikmedia.de"
191
+
"apanowicz.de"
192
+
"alewis.de"
193
+
"jarugadesign.de"
194
+
"beesmooth.ch"
195
+
"event-extra.de"
196
+
];
197
+
dkim = [
198
+
{ domain = "ubikmedia.eu"; }
199
+
{ domain = "apanowicz.de"; }
200
+
{ domain = "beesmooth.ch"; }
201
+
];
202
+
};
203
+
services.borgbackup.jobs.hetzner.paths = [
204
+
"/home/xanf"
205
+
"/home/domsen"
206
+
"/home/bruno"
207
+
"/home/jla-trading"
208
+
"/home/jms"
209
+
"/home/ms"
210
+
"/home/bui"
211
+
"/home/klabusterbeere"
212
+
"/home/akayguen"
213
+
"/home/kasia"
214
+
"/home/dif"
215
+
"/home/lavafilms"
216
+
"/home/movematchers"
217
+
"/home/blackphoton"
218
+
"/home/avada"
219
+
"/home/sts"
220
+
"/home/familienrat"
221
+
];
222
+
users.users.UBIK-SFTP = {
223
+
uid = genid_uint31 "UBIK-SFTP";
224
+
home = "/home/UBIK-SFTP";
225
+
useDefaultShell = true;
226
+
createHome = true;
227
+
isNormalUser = true;
228
+
};
229
+
230
+
users.users.xanf = {
231
+
uid = genid_uint31 "xanf";
232
+
group = "xanf";
233
+
home = "/home/xanf";
234
+
useDefaultShell = true;
235
+
createHome = false; # creathome forces permissions
236
+
isNormalUser = true;
237
+
};
238
+
239
+
users.users.domsen = {
240
+
uid = genid_uint31 "domsen";
241
+
description = "maintenance acc for domsen";
242
+
home = "/home/domsen";
243
+
useDefaultShell = true;
244
+
extraGroups = [ "syncthing" "download" "xanf" ];
245
+
createHome = true;
246
+
isNormalUser = true;
247
+
};
248
+
249
+
users.users.bruno = {
250
+
uid = genid_uint31 "bruno";
251
+
home = "/home/bruno";
252
+
useDefaultShell = true;
253
+
createHome = true;
254
+
isNormalUser = true;
255
+
};
256
+
257
+
users.users.jla-trading = {
258
+
uid = genid_uint31 "jla-trading";
259
+
home = "/home/jla-trading";
260
+
useDefaultShell = true;
261
+
createHome = true;
262
+
isNormalUser = true;
263
+
};
264
+
265
+
users.users.jms = {
266
+
uid = genid_uint31 "jms";
267
+
home = "/home/jms";
268
+
useDefaultShell = true;
269
+
createHome = true;
270
+
isNormalUser = true;
271
+
};
272
+
273
+
users.users.ms = {
274
+
uid = genid_uint31 "ms";
275
+
home = "/home/ms";
276
+
useDefaultShell = true;
277
+
createHome = true;
278
+
isNormalUser = true;
279
+
};
280
+
281
+
users.users.testuser = {
282
+
uid = genid_uint31 "testuser";
283
+
home = "/home/testuser";
284
+
useDefaultShell = true;
285
+
createHome = true;
286
+
isNormalUser = true;
287
+
};
288
+
289
+
#users.users.akayguen = {
290
+
# uid = genid_uint31 "akayguen";
291
+
# home = "/home/akayguen";
292
+
# useDefaultShell = true;
293
+
# createHome = true;
294
+
# isNormalUser = true;
295
+
#};
296
+
297
+
users.users.bui = {
298
+
uid = genid_uint31 "bui";
299
+
home = "/home/bui";
300
+
useDefaultShell = true;
301
+
createHome = true;
302
+
isNormalUser = true;
303
+
};
304
+
305
+
users.users.klabusterbeere = {
306
+
uid = genid_uint31 "klabusterbeere";
307
+
home = "/home/klabusterbeere";
308
+
useDefaultShell = true;
309
+
createHome = true;
310
+
isNormalUser = true;
311
+
};
312
+
313
+
users.users.kasia = {
314
+
uid = genid_uint31 "kasia";
315
+
home = "/home/kasia";
316
+
useDefaultShell = true;
317
+
createHome = true;
318
+
isNormalUser = true;
319
+
};
320
+
321
+
users.users.XANF_TEAM = {
322
+
uid = genid_uint31 "XANF_TEAM";
323
+
group = "xanf";
324
+
home = "/home/XANF_TEAM";
325
+
useDefaultShell = true;
326
+
createHome = true;
327
+
isNormalUser = true;
328
+
};
329
+
330
+
users.users.dif = {
331
+
uid = genid_uint31 "dif";
332
+
home = "/home/dif";
333
+
useDefaultShell = true;
334
+
extraGroups = [ "xanf" ];
335
+
createHome = true;
336
+
isNormalUser = true;
337
+
};
338
+
339
+
users.users.lavafilms = {
340
+
uid = genid_uint31 "lavafilms";
341
+
home = "/home/lavafilms";
342
+
useDefaultShell = true;
343
+
extraGroups = [ "xanf" ];
344
+
createHome = true;
345
+
isNormalUser = true;
346
+
};
347
+
348
+
users.users.movematchers = {
349
+
uid = genid_uint31 "movematchers";
350
+
home = "/home/movematchers";
351
+
useDefaultShell = true;
352
+
extraGroups = [ "xanf" ];
353
+
createHome = true;
354
+
isNormalUser = true;
355
+
};
356
+
357
+
users.users.blackphoton = {
358
+
uid = genid_uint31 "blackphoton";
359
+
home = "/home/blackphoton";
360
+
useDefaultShell = true;
361
+
extraGroups = [ "xanf" ];
362
+
createHome = true;
363
+
isNormalUser = true;
364
+
};
365
+
366
+
users.users.line = {
367
+
uid = genid_uint31 "line";
368
+
home = "/home/line";
369
+
useDefaultShell = true;
370
+
# extraGroups = [ "xanf" ];
371
+
createHome = true;
372
+
isNormalUser = true;
373
+
};
374
+
375
+
users.users.avada = {
376
+
uid = genid_uint31 "avada";
377
+
home = "/home/avada";
378
+
useDefaultShell = true;
379
+
createHome = true;
380
+
isNormalUser = true;
381
+
};
382
+
383
+
users.users.sts = {
384
+
uid = genid_uint31 "sts";
385
+
home = "/home/sts";
386
+
useDefaultShell = true;
387
+
createHome = true;
388
+
isNormalUser = true;
389
+
};
390
+
391
+
users.users.familienrat = {
392
+
uid = genid_uint31 "familienrat";
393
+
home = "/home/familienrat";
394
+
useDefaultShell = true;
395
+
createHome = true;
396
+
isNormalUser = true;
397
+
};
398
+
krebs.acl."/srv/http/familienrat-hamburg.de"."u:familienrat:rwX" = {};
399
+
krebs.acl."/srv/http"."u:familienrat:X" = {
400
+
default = false;
401
+
recursive = false;
402
+
};
403
+
404
+
users.groups.xanf = {};
405
+
406
+
krebs.on-failure.plans.restic-backups-domsen = {
407
+
journalctl = {
408
+
lines = 1000;
409
+
};
410
+
};
411
+
412
+
services.restic.backups.domsen = {
413
+
initialize = true;
414
+
repository = "/backups/domsen";
415
+
passwordFile = toString <secrets> + "/domsen_backup_pw";
416
+
timerConfig = { OnCalendar = "00:05"; RandomizedDelaySec = "5h"; };
417
+
paths = [
418
+
"/home/domsen/Mail"
419
+
"/home/ms/Mail"
420
+
"/home/klabusterbeere/Mail"
421
+
"/home/jms/Mail"
422
+
"/home/kasia/Mail"
423
+
"/home/bruno/Mail"
424
+
"/home/akayguen/Mail"
425
+
"/backups/sql_dumps"
426
+
];
427
+
};
428
+
429
+
services.syncthing.declarative.folders = {
430
+
domsen-backups = {
431
+
path = "/backups/domsen";
432
+
devices = [ "domsen-backup" ];
433
+
};
434
+
domsen-backup-srv-http = {
435
+
path = "/srv/http";
436
+
devices = [ "domsen-backup" ];
437
+
};
438
+
};
439
+
440
+
system.activationScripts.domsen-backups = ''
441
+
${pkgs.coreutils}/bin/chmod 750 /backups
442
+
'';
443
+
444
+
# takes too long!!
445
+
# krebs.acl."/srv/http"."u:syncthing:rwX" = {};
446
+
# krebs.acl."/srv/http"."u:nginx:rwX" = {};
447
+
# krebs.acl."/srv/http/ubikmedia.de"."u:avada:rwX" = {};
448
+
krebs.acl."/home/xanf/XANF_TEAM"."g:xanf:rwX" = {};
449
+
krebs.acl."/home/xanf"."g:xanf:X" = {
450
+
default = false;
451
+
recursive = false;
452
+
};
453
+
}
454
+
+13
nixos/2configs/websites/flix.lassul.us.nix
+13
nixos/2configs/websites/flix.lassul.us.nix
+69
nixos/2configs/websites/lassulus.nix
+69
nixos/2configs/websites/lassulus.nix
···
1
+
{ config, pkgs, lib, ... }:
2
+
3
+
with lib;
4
+
{
5
+
imports = [
6
+
./default.nix
7
+
];
8
+
9
+
security.acme = {
10
+
email = "acme@lassul.us";
11
+
acceptTerms = true;
12
+
certs."lassul.us" = {
13
+
group = "lasscert";
14
+
};
15
+
};
16
+
17
+
users.groups.lasscert.members = [
18
+
"dovecot2"
19
+
"exim"
20
+
"nginx"
21
+
];
22
+
23
+
services.nginx.virtualHosts."lassul.us" = {
24
+
addSSL = true;
25
+
enableACME = true;
26
+
default = true;
27
+
locations."/".extraConfig = ''
28
+
root /srv/http/lassul.us;
29
+
'';
30
+
locations."= /retiolum-hosts.tar.bz2".extraConfig = ''
31
+
alias ${config.krebs.tinc.retiolum.hostsArchive};
32
+
'';
33
+
locations."= /hosts".extraConfig = ''
34
+
alias ${pkgs.krebs-hosts_combined};
35
+
'';
36
+
locations."= /retiolum.hosts".extraConfig = ''
37
+
alias ${pkgs.krebs-hosts-retiolum};
38
+
'';
39
+
locations."= /wireguard-key".extraConfig = ''
40
+
alias ${pkgs.writeText "prism.wg" config.krebs.hosts.prism.nets.wiregrill.wireguard.pubkey};
41
+
'';
42
+
locations."= /krebspage".extraConfig = ''
43
+
default_type "text/html";
44
+
alias ${pkgs.krebspage}/index.html;
45
+
'';
46
+
locations."= /init".extraConfig = let
47
+
initscript = pkgs.init.override {
48
+
pubkey = config.krebs.users.lass.pubkey;
49
+
};
50
+
in ''
51
+
alias ${initscript}/bin/init;
52
+
'';
53
+
locations."= /blue.pub".extraConfig = ''
54
+
alias ${pkgs.writeText "pub" config.krebs.users.lass-blue.pubkey};
55
+
'';
56
+
locations."= /ssh.pub".extraConfig = ''
57
+
alias ${pkgs.writeText "pub" config.krebs.users.lass-yubikey.pubkey};
58
+
'';
59
+
locations."= /gpg.pub".extraConfig = ''
60
+
alias ${pkgs.writeText "pub" config.krebs.users.lass-yubikey.pgp.pubkeys.default};
61
+
'';
62
+
locations."= /ip".extraConfig = ''
63
+
return 200 '$remote_addr';
64
+
'';
65
+
};
66
+
67
+
68
+
69
+
}
+30
nixos/2configs/websites/sqlBackup.nix
+30
nixos/2configs/websites/sqlBackup.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
krebs.secret.files.mysql_rootPassword = {
5
+
path = "${config.services.mysql.dataDir}/mysql_rootPassword";
6
+
owner.name = "mysql";
7
+
source-path = "${config.krebs.secret.directory}/mysql_rootPassword";
8
+
};
9
+
10
+
services.mysql = {
11
+
enable = true;
12
+
dataDir = "/var/mysql";
13
+
package = pkgs.mariadb;
14
+
};
15
+
16
+
systemd.services.mysql = {
17
+
after = [
18
+
config.krebs.secret.files.mysql_rootPassword.service
19
+
];
20
+
partOf = [
21
+
config.krebs.secret.files.mysql_rootPassword.service
22
+
];
23
+
};
24
+
25
+
lass.mysqlBackup = {
26
+
enable = true;
27
+
config.all = {};
28
+
};
29
+
}
30
+
+251
nixos/2configs/websites/util.nix
+251
nixos/2configs/websites/util.nix
···
1
+
{ lib, pkgs, ... }:
2
+
3
+
with lib;
4
+
5
+
rec {
6
+
7
+
ssl = domains :
8
+
let
9
+
domain = head domains;
10
+
in {
11
+
};
12
+
13
+
servePage = domains:
14
+
let
15
+
domain = head domains;
16
+
in {
17
+
services.nginx.virtualHosts.${domain} = {
18
+
enableACME = true;
19
+
addSSL = true;
20
+
serverAliases = domains;
21
+
locations."/".extraConfig = ''
22
+
root /srv/http/${domain};
23
+
'';
24
+
};
25
+
};
26
+
27
+
servephpBB = domains:
28
+
let
29
+
domain = head domains;
30
+
31
+
in {
32
+
services.nginx.virtualHosts."${domain}" = {
33
+
serverAliases = domains;
34
+
extraConfig = ''
35
+
index index.php;
36
+
root /srv/http/${domain}/;
37
+
access_log /tmp/nginx_acc.log;
38
+
error_log /tmp/nginx_err.log;
39
+
error_page 404 /404.html;
40
+
error_page 500 502 503 504 /50x.html;
41
+
client_max_body_size 100m;
42
+
'';
43
+
locations."/".extraConfig = ''
44
+
try_files $uri $uri/ /index.php?$args;
45
+
'';
46
+
locations."~ \.php(?:$|/)".extraConfig = ''
47
+
fastcgi_split_path_info ^(.+\.php)(/.+)$;
48
+
include ${pkgs.nginx}/conf/fastcgi_params;
49
+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
50
+
fastcgi_param PATH_INFO $fastcgi_path_info;
51
+
fastcgi_param HTTPS on;
52
+
fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
53
+
fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
54
+
fastcgi_intercept_errors on;
55
+
'';
56
+
#Directives to send expires headers and turn off 404 error logging.
57
+
locations."~* ^.+\.(xml|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$".extraConfig = ''
58
+
access_log off;
59
+
log_not_found off;
60
+
expires max;
61
+
'';
62
+
};
63
+
services.phpfpm.pools."${domain}" = {
64
+
user = "nginx";
65
+
group = "nginx";
66
+
extraConfig = ''
67
+
listen = /srv/http/${domain}/phpfpm.pool
68
+
pm = dynamic
69
+
pm.max_children = 25
70
+
pm.start_servers = 5
71
+
pm.min_spare_servers = 3
72
+
pm.max_spare_servers = 20
73
+
listen.owner = nginx
74
+
listen.group = nginx
75
+
php_admin_value[error_log] = 'stderr'
76
+
php_admin_flag[log_errors] = on
77
+
catch_workers_output = yes
78
+
'';
79
+
};
80
+
};
81
+
82
+
serveOwncloud = domains:
83
+
let
84
+
domain = head domains;
85
+
legacy_nixpkgs = import (builtins.fetchTarball "https://github.com/nixos/nixpkgs/archive/22.05.tar.gz") {};
86
+
in {
87
+
services.nginx.virtualHosts."${domain}" = {
88
+
enableACME = true;
89
+
addSSL = true;
90
+
serverAliases = domains;
91
+
extraConfig = ''
92
+
# Add headers to serve security related headers
93
+
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
94
+
add_header X-Content-Type-Options nosniff;
95
+
add_header X-Frame-Options "SAMEORIGIN";
96
+
add_header X-XSS-Protection "1; mode=block";
97
+
add_header X-Robots-Tag none;
98
+
add_header X-Download-Options noopen;
99
+
add_header X-Permitted-Cross-Domain-Policies none;
100
+
101
+
# Path to the root of your installation
102
+
root /srv/http/${domain}/;
103
+
# set max upload size
104
+
client_max_body_size 10G;
105
+
fastcgi_buffers 64 4K;
106
+
fastcgi_read_timeout 120;
107
+
108
+
# Disable gzip to avoid the removal of the ETag header
109
+
gzip off;
110
+
111
+
# Uncomment if your server is build with the ngx_pagespeed module
112
+
# This module is currently not supported.
113
+
#pagespeed off;
114
+
115
+
index index.php;
116
+
error_page 403 /core/templates/403.php;
117
+
error_page 404 /core/templates/404.php;
118
+
119
+
rewrite ^/.well-known/carddav /remote.php/carddav/ permanent;
120
+
rewrite ^/.well-known/caldav /remote.php/caldav/ permanent;
121
+
122
+
# The following 2 rules are only needed for the user_webfinger app.
123
+
# Uncomment it if you're planning to use this app.
124
+
rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
125
+
rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
126
+
'';
127
+
locations."/robots.txt".extraConfig = ''
128
+
allow all;
129
+
log_not_found off;
130
+
access_log off;
131
+
'';
132
+
locations."~ ^/(build|tests|config|lib|3rdparty|templates|data)/".extraConfig = ''
133
+
deny all;
134
+
'';
135
+
136
+
locations."~ ^/(?:autotest|occ|issue|indie|db_|console)".extraConfig = ''
137
+
deny all;
138
+
'';
139
+
140
+
locations."/".extraConfig = ''
141
+
rewrite ^/remote/(.*) /remote.php last;
142
+
rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;
143
+
try_files $uri $uri/ =404;
144
+
'';
145
+
146
+
locations."~ \.php(?:$|/)".extraConfig = ''
147
+
fastcgi_split_path_info ^(.+\.php)(/.+)$;
148
+
include ${pkgs.nginx}/conf/fastcgi_params;
149
+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
150
+
fastcgi_param PATH_INFO $fastcgi_path_info;
151
+
fastcgi_param HTTPS on;
152
+
fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
153
+
fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
154
+
fastcgi_intercept_errors on;
155
+
'';
156
+
157
+
# Adding the cache control header for js and css files
158
+
# Make sure it is BELOW the location ~ \.php(?:$|/) { block
159
+
locations."~* \.(?:css|js)$".extraConfig = ''
160
+
add_header Cache-Control "public, max-age=7200";
161
+
# Add headers to serve security related headers
162
+
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
163
+
add_header X-Content-Type-Options nosniff;
164
+
add_header X-Frame-Options "SAMEORIGIN";
165
+
add_header X-XSS-Protection "1; mode=block";
166
+
add_header X-Robots-Tag none;
167
+
# Optional: Don't log access to assets
168
+
access_log off;
169
+
'';
170
+
# Optional: Don't log access to other assets
171
+
locations."~* \.(?:jpg|jpeg|gif|bmp|ico|png|swf)$".extraConfig = ''
172
+
access_log off;
173
+
'';
174
+
};
175
+
services.phpfpm.pools."${domain}" = {
176
+
user = "nginx";
177
+
group = "nginx";
178
+
phpPackage = legacy_nixpkgs.php74;
179
+
extraConfig = ''
180
+
listen = /srv/http/${domain}/phpfpm.pool
181
+
pm = dynamic
182
+
pm.max_children = 32
183
+
pm.max_requests = 500
184
+
pm.start_servers = 2
185
+
pm.min_spare_servers = 2
186
+
pm.max_spare_servers = 5
187
+
listen.owner = nginx
188
+
listen.group = nginx
189
+
php_admin_value[error_log] = 'stderr'
190
+
php_admin_flag[log_errors] = on
191
+
catch_workers_output = yes
192
+
'';
193
+
};
194
+
};
195
+
196
+
serveWordpress = domains:
197
+
let
198
+
domain = head domains;
199
+
200
+
in {
201
+
services.nginx.virtualHosts."${domain}" = {
202
+
enableACME = true;
203
+
forceSSL = true;
204
+
serverAliases = domains;
205
+
extraConfig = ''
206
+
root /srv/http/${domain}/;
207
+
index index.php;
208
+
access_log /tmp/nginx_acc.log;
209
+
error_log /tmp/nginx_err.log;
210
+
error_page 404 /404.html;
211
+
error_page 500 502 503 504 /50x.html;
212
+
client_max_body_size 100m;
213
+
'';
214
+
locations."/".extraConfig = ''
215
+
try_files $uri $uri/ /index.php?$args;
216
+
'';
217
+
locations."~ \.php$".extraConfig = ''
218
+
fastcgi_pass unix:/srv/http/${domain}/phpfpm.pool;
219
+
fastcgi_read_timeout 120;
220
+
include ${pkgs.nginx}/conf/fastcgi.conf;
221
+
'';
222
+
#Directives to send expires headers and turn off 404 error logging.
223
+
locations."~* ^.+\.(xml|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$".extraConfig = ''
224
+
access_log off;
225
+
log_not_found off;
226
+
expires max;
227
+
'';
228
+
locations."/nb".extraConfig = ''
229
+
index index.html;
230
+
'';
231
+
};
232
+
services.phpfpm.pools."${domain}" = {
233
+
user = "nginx";
234
+
group = "nginx";
235
+
extraConfig = ''
236
+
listen = /srv/http/${domain}/phpfpm.pool
237
+
pm = dynamic
238
+
pm.max_children = 25
239
+
pm.start_servers = 5
240
+
pm.min_spare_servers = 3
241
+
pm.max_spare_servers = 20
242
+
listen.owner = nginx
243
+
listen.group = nginx
244
+
php_admin_value[error_log] = 'stderr'
245
+
php_admin_flag[log_errors] = on
246
+
catch_workers_output = yes
247
+
'';
248
+
};
249
+
};
250
+
251
+
}
+20
nixos/2configs/weron/client.nix
+20
nixos/2configs/weron/client.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
systemd.services.weron = {
4
+
wantedBy = [ "multi-user.target" ];
5
+
environment = {
6
+
WERON_RADDR = "ws://lassul.us:23420/";
7
+
};
8
+
serviceConfig = {
9
+
ExecStart = pkgs.writers.writeDash "weron" ''
10
+
${pkgs.weron}/bin/weron vpn ip \
11
+
--community krebs \
12
+
--password aidsballs \
13
+
--key aidsballs \
14
+
--ips 10.249.1.0/24 \
15
+
--verbose 7 \
16
+
--dev weron
17
+
'';
18
+
};
19
+
};
20
+
}
+13
nixos/2configs/weron/signaler.nix
+13
nixos/2configs/weron/signaler.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
systemd.services.weron-signaler = {
4
+
wantedBy = [ "multi-user.target" ];
5
+
environment = {
6
+
};
7
+
serviceConfig = {
8
+
ExecStart = ''${pkgs.weron}/bin/weron signaler --verbose=7 --laddr ":23420"'';
9
+
};
10
+
};
11
+
12
+
networking.firewall.allowedTCPPorts = [ 23420 ];
13
+
}
+15
nixos/2configs/yellow-mounts/samba.nix
+15
nixos/2configs/yellow-mounts/samba.nix
+16
nixos/5pkgs/acronym/default.nix
+16
nixos/5pkgs/acronym/default.nix
···
1
+
{ pkgs, ... }:
2
+
3
+
pkgs.writeScriptBin "acronym" ''
4
+
5
+
#! ${pkgs.bash}/bin/bash
6
+
7
+
acro=$1
8
+
9
+
curl -L -s http://www.acronymfinder.com/$acro.html \
10
+
| grep 'class="result-list__body__rank"' \
11
+
| sed '
12
+
s/.*title="\([^"]*\)".*/\1/
13
+
s/^.* - //
14
+
s/'/'\'''/g
15
+
'
16
+
''
+1
nixos/5pkgs/autowifi/2
+1
nixos/5pkgs/autowifi/2
···
1
+
hello debug
+30
nixos/5pkgs/autowifi/README.md
+30
nixos/5pkgs/autowifi/README.md
···
1
+
Very WIP
2
+
Automatically connect to WIFIs.
3
+
passwords can be stored in an easy db format
4
+
5
+
Requirements:
6
+
- NetworkManager
7
+
- python3
8
+
9
+
example wifi db:
10
+
```
11
+
myssid/mywifipassword
12
+
myssid2/mywifipassword2
13
+
```
14
+
15
+
will fallback to open wifis if no known wifi is found.
16
+
will try to ping the gateway on the wifi after connecting.
17
+
18
+
Available options:
19
+
(all directory options take multiple directories)
20
+
* `--scan-hooks, -s` - directories with hooks which are run after the scanning phase
21
+
* `--connection-hooks, -c` - directories with hooks which are run after connecting to a wifi
22
+
* `--wifi_dirs, -w` - directories with wifi dbs
23
+
* `--loglevel, -l` - loglevel to log to STDOUT, takes INFO and DEBUG as arguments
24
+
* `--pidfile, -p` - file to write the PID to
25
+
* `--no-open` - don't connect to open wifis in the end
26
+
27
+
28
+
## FLOW
29
+
30
+
+290
nixos/5pkgs/autowifi/autowifi.py
+290
nixos/5pkgs/autowifi/autowifi.py
···
1
+
import argparse
2
+
import json
3
+
import logging
4
+
import os
5
+
import re
6
+
import signal
7
+
import socket
8
+
import struct
9
+
import subprocess
10
+
import time
11
+
import urllib.request
12
+
13
+
logger = logging.getLogger()
14
+
got_signal = False
15
+
16
+
17
+
def signal_handler(_, __):
18
+
global got_signal
19
+
got_signal = True
20
+
21
+
22
+
def get_default_gateway() -> str:
23
+
"""Read the default gateway directly from /proc."""
24
+
with open("/proc/net/route") as route_file:
25
+
for line in route_file:
26
+
fields = line.strip().split()
27
+
if fields[1] != '00000000' or not int(fields[3], 16) & 2:
28
+
continue
29
+
30
+
return socket.inet_ntoa(struct.pack("<L", int(fields[2], 16)))
31
+
32
+
33
+
def connect(ssid, psk=None):
34
+
subprocess.run(
35
+
["nmcli", "connection", "delete", "autowifi"],
36
+
stdout=subprocess.PIPE,
37
+
)
38
+
logging.info('connecting to %s', ssid)
39
+
if psk is None:
40
+
subprocess.run(
41
+
[
42
+
"nmcli",
43
+
"device",
44
+
"wifi",
45
+
"connect",
46
+
ssid,
47
+
"name",
48
+
"autowifi",
49
+
],
50
+
stdout=subprocess.PIPE,
51
+
)
52
+
else:
53
+
subprocess.run(
54
+
[
55
+
"nmcli",
56
+
"device",
57
+
"wifi",
58
+
"connect",
59
+
ssid,
60
+
"name",
61
+
"autowifi",
62
+
"password",
63
+
psk,
64
+
],
65
+
stdout=subprocess.PIPE,
66
+
)
67
+
time.sleep(5)
68
+
69
+
70
+
def scan():
71
+
logging.debug('scanning wifis')
72
+
wifis_raw = subprocess.check_output([
73
+
"nmcli",
74
+
"-e", "no",
75
+
"-f", "ssid,signal,security,rsn-flags,bssid",
76
+
"-t",
77
+
"device", "wifi", "list",
78
+
"--rescan", "auto",
79
+
])
80
+
wifis_list = wifis_raw.split(b'\n')
81
+
logging.debug('scanning wifis finished')
82
+
wifis = []
83
+
for line in wifis_list:
84
+
logging.debug(line)
85
+
ls = re.split(rb'(?<!\\):', line)
86
+
if len(ls) == 10:
87
+
wifis.append({
88
+
"ssid": ls[0],
89
+
"signal": int(ls[1]),
90
+
"crypto": ls[2],
91
+
"flags": ls[3],
92
+
"bssid": b':'.join(ls[4:]),
93
+
})
94
+
return wifis
95
+
96
+
97
+
def get_known_wifis(wifi_dirs):
98
+
wifis_lines = []
99
+
for wdir in wifi_dirs:
100
+
for wfile in os.listdir(wdir):
101
+
with open(os.path.join(wdir, wfile)) as f:
102
+
wifis_lines += f.read().splitlines()
103
+
wifis = []
104
+
for line in wifis_lines:
105
+
ls = line.split('/')
106
+
wifis.append({"ssid": ls[0].encode(), "psk": ls[1].encode()})
107
+
return wifis
108
+
109
+
110
+
def check_network():
111
+
logging.debug('checking network')
112
+
113
+
gateway = get_default_gateway()
114
+
if gateway:
115
+
response = subprocess.run(
116
+
[
117
+
'ping',
118
+
'-q',
119
+
'-c',
120
+
'1',
121
+
gateway,
122
+
],
123
+
stdout=subprocess.PIPE,
124
+
)
125
+
if response.returncode == 0:
126
+
logging.debug('host %s is up', gateway)
127
+
return True
128
+
else:
129
+
logging.debug('host %s is down', gateway)
130
+
return False
131
+
else:
132
+
logging.debug('no gateway')
133
+
return False
134
+
135
+
136
+
def check_internet():
137
+
logging.debug('checking internet')
138
+
139
+
try:
140
+
beacon = urllib.request.urlopen('http://krebsco.de/secret')
141
+
except Exception as e: # noqa
142
+
logging.debug(e)
143
+
logging.info('no internet exc')
144
+
return False
145
+
if beacon.read() == b'1337\n':
146
+
return True
147
+
logging.info('no internet oh')
148
+
return False
149
+
150
+
151
+
def is_wifi_open(wifi):
152
+
if wifi['crypto'] == b'':
153
+
return True
154
+
else:
155
+
return False
156
+
157
+
158
+
def is_wifi_seen(wifi, seen_wifis):
159
+
for seen_wifi in seen_wifis:
160
+
if seen_wifi["ssid"] == wifi["ssid"]:
161
+
return True
162
+
return False
163
+
164
+
165
+
def run_hooks(dirs, wifi):
166
+
outputs = {}
167
+
for directory in dirs:
168
+
for hfile in os.listdir(directory):
169
+
try:
170
+
hook_output = subprocess.check_output([
171
+
str(os.path.join(directory, hfile)),
172
+
json.dumps(wifi)
173
+
])
174
+
outputs[hfile] = hook_output
175
+
except OSError as e:
176
+
logging.debug(e)
177
+
logging.info('running plugin: {} failed'.format(hfile))
178
+
return outputs
179
+
180
+
181
+
def stay_connected_loop(allowed_fails=5):
182
+
fails = 0
183
+
if check_network():
184
+
while True:
185
+
global got_signal
186
+
if got_signal:
187
+
logging.info('got disconnect signal')
188
+
got_signal = False
189
+
break
190
+
else:
191
+
if check_network():
192
+
time.sleep(10)
193
+
else:
194
+
fails += 1
195
+
if fails > allowed_fails:
196
+
logging.debug('network gone, giving up')
197
+
break
198
+
else:
199
+
logging.debug('hmm, missed ping, will try again shortly')
200
+
time.sleep(3)
201
+
202
+
203
+
def main():
204
+
parser = argparse.ArgumentParser()
205
+
206
+
parser.add_argument(
207
+
'-x', '--scan-hooks',
208
+
dest='scan_hooks',
209
+
nargs='*',
210
+
help='directories with scan hooks (executed after scan)',
211
+
default=['/etc/autowifi/scan_hooks'],
212
+
)
213
+
214
+
parser.add_argument(
215
+
'-c', '--connection-hooks',
216
+
dest='connect_hooks',
217
+
nargs='*',
218
+
help='directories with connection hooks (executed after connection)',
219
+
default=['/etc/autowifi/connect_hooks'],
220
+
)
221
+
222
+
parser.add_argument(
223
+
'-w', '--wifi_dirs',
224
+
dest='wifi_dirs',
225
+
nargs='*',
226
+
help='directories with wifi configs',
227
+
default=['/etc/autowifi/wifis'],
228
+
)
229
+
230
+
parser.add_argument(
231
+
'-l', '--loglevel',
232
+
dest='loglevel',
233
+
help='loglevel to use',
234
+
default=logging.INFO,
235
+
)
236
+
237
+
parser.add_argument(
238
+
'-p', '--pidfile',
239
+
dest='pidfile',
240
+
help='file to write the pid to',
241
+
default=None,
242
+
)
243
+
244
+
parser.add_argument(
245
+
'--no-open',
246
+
dest='no_open_networks',
247
+
help='dont connect to open networks',
248
+
default=False,
249
+
action='store_true',
250
+
)
251
+
252
+
args = parser.parse_args()
253
+
254
+
wifi_dirs = args.wifi_dirs
255
+
logger.setLevel(args.loglevel)
256
+
257
+
signal.signal(signal.SIGUSR1, signal_handler)
258
+
259
+
if args.pidfile:
260
+
with open(args.pidfile, 'w+') as f:
261
+
f.write(str(os.getpid()))
262
+
263
+
while True:
264
+
time.sleep(1)
265
+
stay_connected_loop()
266
+
wifis = scan()
267
+
known_wifis = get_known_wifis(wifi_dirs)
268
+
known_seen_wifis = [
269
+
wifi for wifi in known_wifis if is_wifi_seen(wifi, wifis)
270
+
]
271
+
for wifi in known_seen_wifis:
272
+
connect(wifi['ssid'], wifi['psk'])
273
+
if check_network():
274
+
logging.debug('connected to secure wifi, going into busy loop')
275
+
break
276
+
if check_network():
277
+
continue
278
+
logging.debug('no known secure wifi, connecting to open ones')
279
+
if not args.no_open_networks:
280
+
logging.debug('connecting to open wifis')
281
+
open_wifis = filter(is_wifi_open, wifis)
282
+
for wifi in open_wifis:
283
+
connect(wifi['ssid'])
284
+
if check_network():
285
+
run_hooks(args.connect_hooks, wifi)
286
+
break
287
+
288
+
289
+
if __name__ == '__main__':
290
+
main()
+2
nixos/5pkgs/autowifi/default.nix
+2
nixos/5pkgs/autowifi/default.nix
+1
nixos/5pkgs/autowifi/dummy_internet
+1
nixos/5pkgs/autowifi/dummy_internet
···
1
+
xx
+1
nixos/5pkgs/autowifi/mors-pid
+1
nixos/5pkgs/autowifi/mors-pid
···
1
+
12548
+1
nixos/5pkgs/autowifi/pid
+1
nixos/5pkgs/autowifi/pid
···
1
+
10283
+16
nixos/5pkgs/autowifi/refactor_idea
+16
nixos/5pkgs/autowifi/refactor_idea
···
1
+
scan() -> { "ssid": "xxx", "signal": 14, "crypto": "wpa2", "flags": "some flags i dont get", "bssid": "42:23:13:37:fe:fe" }
2
+
-> scan_hook:
3
+
is_known_wifi_hook -> { "ssid": "xxx", ..., "psk" "mypassword", priority = 1014, "method": "connect" }
4
+
is_open -> { "ssid": "xxx", ..., priority = 914, "method": "connect" }
5
+
has_wps -> { "ssid": "xxx", ..., priority = 256, "method": "wps" }
6
+
-> sort by priority
7
+
-> foreach (wifi: (method == connect" => connect wifi; method == "wps => run cracks/wps { "ssid": "xxx", "priority": 256, "method": "wps", ... }))
8
+
9
+
if ping_internet => busy_loop
10
+
else
11
+
if ping_gateway => { "ssid": "xxx" } -> prison_break_hooks:
12
+
hotsplots -> { "sssid": "xxx" }
13
+
14
+
if ping_internet => busy_loop
15
+
16
+
+1
nixos/5pkgs/autowifi/xerxes-pid
+1
nixos/5pkgs/autowifi/xerxes-pid
···
1
+
3332
+14
nixos/5pkgs/bank/default.nix
+14
nixos/5pkgs/bank/default.nix
···
1
+
{ writeDashBin, coreutils, pass, hledger, diffutils }:
2
+
3
+
writeDashBin "bank" ''
4
+
tmp=$(mktemp)
5
+
${pass}/bin/pass show hledger > $tmp
6
+
${hledger}/bin/hledger --file=$tmp "$@"
7
+
${pass}/bin/pass show hledger | if ${diffutils}/bin/diff $tmp -; then
8
+
exit 0
9
+
else
10
+
${coreutils}/bin/cat $tmp | ${pass}/bin/pass insert -m hledger
11
+
fi
12
+
${coreutils}/bin/rm $tmp
13
+
''
14
+
+6
nixos/5pkgs/deploy/default.nix
+6
nixos/5pkgs/deploy/default.nix
+29
nixos/5pkgs/dl/default.nix
+29
nixos/5pkgs/dl/default.nix
···
1
+
{ pkgs }:
2
+
pkgs.writers.writeBashBin "dl" ''
3
+
set -efux
4
+
LINK_OR_SEARCH=$@
5
+
if [[ $LINK_OR_SEARCH == magnet:?* ]] || [[ $LINK_OR_SEARCH =~ ^https?: ]]; then
6
+
LINK=$LINK_OR_SEARCH
7
+
else
8
+
SEARCH=$LINK_OR_SEARCH
9
+
fi
10
+
11
+
if ! [ -z ''${SEARCH+x} ]; then
12
+
LINK=$(${pkgs.we-get}/bin/we-get -n 50 -t the_pirate_bay,1337x --json -s "$SEARCH" |
13
+
${pkgs.jq}/bin/jq -r 'to_entries |
14
+
.[] |
15
+
"\(.key) [\(.value.seeds)]\t\(.value.link)"
16
+
' |
17
+
${pkgs.fzf}/bin/fzf -d '\t' --with-nth=1 |
18
+
${pkgs.coreutils}/bin/cut -f 2
19
+
)
20
+
fi
21
+
22
+
if [ -z ''${CATEGORY+x} ]; then
23
+
CATEGORY=$(echo -e 'movies\nseries' | ${pkgs.fzf}/bin/fzf)
24
+
fi
25
+
26
+
${pkgs.transmission}/bin/transmission-remote yellow.r \
27
+
-w /var/download/finished/sorted/"$CATEGORY" \
28
+
-a "$LINK"
29
+
''
+13
nixos/5pkgs/dls/default.nix
+13
nixos/5pkgs/dls/default.nix
···
1
+
{ pkgs }:
2
+
pkgs.writers.writeDashBin "dls" ''
3
+
set -efux
4
+
SESSION_ID=$(
5
+
curl -Ss -d '{}' http://yellow.r:9091/transmission/rpc -v -o /dev/null 2>&1 |
6
+
grep -oP '(?<=X-Transmission-Session-Id: )\w+'
7
+
)
8
+
${pkgs.curl}/bin/curl -Ss \
9
+
http://yellow.r:9091/transmission/rpc \
10
+
-H "X-Transmission-Session-Id: $SESSION_ID" \
11
+
-d '{"arguments":{"fields":["errorString","eta","isFinished","name","sizeWhenDone","status"]},"method":"torrent-get","tag":4}' |
12
+
jq .
13
+
''
+35
nixos/5pkgs/drbd9/default.nix
+35
nixos/5pkgs/drbd9/default.nix
···
1
+
{ lib, stdenv, git, fetchzip, fetchFromGitHub, kernel }: let
2
+
3
+
version = "9.1.7";
4
+
5
+
in stdenv.mkDerivation {
6
+
pname = "drbd";
7
+
version = "${kernel.version}-${version}";
8
+
9
+
src = fetchzip {
10
+
url = "https://pkg.linbit.com//downloads/drbd/9/drbd-9.1.7.tar.gz";
11
+
sha256 = "sha256-JsbtOrqhZkG7tFEc6tDmj3RlxZggl0HOKfCI8lYtQok=";
12
+
};
13
+
# src = fetchFromGitHub {
14
+
# owner = "LINBIT";
15
+
# repo = "drbd";
16
+
# rev = "drbd-${version}";
17
+
# sha256 = "sha256-8HAt+k0yi6XsZZ9mkVCQkv2pn65o3Zsa0KwTSBJh0yY=";
18
+
# leaveDotGit = true;
19
+
# };
20
+
21
+
nativeBuildInputs = [ git ] ++ kernel.moduleBuildDependencies;
22
+
23
+
# hardeningDisable = [ "pic" ];
24
+
25
+
makeFlags = kernel.makeFlags ++ [
26
+
"KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
27
+
];
28
+
29
+
installPhase = ''
30
+
install -D drbd/drbd.ko -t "$out/lib/modules/${kernel.modDirVersion}/updates/"
31
+
install -D drbd/drbd_transport_tcp.ko -t "$out/lib/modules/${kernel.modDirVersion}/updates/"
32
+
'';
33
+
34
+
enableParallelBuilding = true;
35
+
}
+28
nixos/5pkgs/firefoxPlugins/noscript.nix
+28
nixos/5pkgs/firefoxPlugins/noscript.nix
···
1
+
{ fetchgit, stdenv, bash, zip }:
2
+
3
+
stdenv.mkDerivation rec {
4
+
name = "noscript";
5
+
id = "{73a6fe31-595d-460b-a920-fcc0f8843232}";
6
+
7
+
src = fetchgit {
8
+
url = "https://github.com/avian2/noscript";
9
+
rev = "c900a079793868bb080ab1e23522d29dc121b4c6";
10
+
sha256 = "1y06gh5a622yrsx0h7v92qnvdi97i54ln09zc1lvk8x430z5bdly";
11
+
};
12
+
13
+
buildInputs = [ zip ];
14
+
15
+
patchPhase = ''
16
+
substituteInPlace "version.sh" \
17
+
--replace "/bin/bash" "${bash}/bin/bash"
18
+
'';
19
+
20
+
buildPhase = ''
21
+
./makexpi.sh
22
+
'';
23
+
24
+
installPhase = ''
25
+
mkdir -p $out/
26
+
cp *.xpi $out/${id}.xpi
27
+
'';
28
+
}
+31
nixos/5pkgs/firefoxPlugins/ublock.nix
+31
nixos/5pkgs/firefoxPlugins/ublock.nix
···
1
+
{ fetchgit, stdenv, bash, python, zip }:
2
+
3
+
stdenv.mkDerivation rec {
4
+
name = "ublock";
5
+
id = "{2b10c1c8-a11f-4bad-fe9c-1c11e82cac42}";
6
+
7
+
src = fetchgit {
8
+
url = "https://github.com/chrisaljoudi/uBlock";
9
+
rev = "a70a50052a7914cbf86d46a725812b98434d8c70";
10
+
sha256 = "1qfzy79f8x01i33x0m95k833z1jgxjwb8wvlr6fj6id1kxfvzh77";
11
+
};
12
+
13
+
buildInputs = [
14
+
zip
15
+
python
16
+
];
17
+
18
+
patchPhase = ''
19
+
substituteInPlace "tools/make-firefox.sh" \
20
+
--replace "/bin/bash" "${bash}/bin/bash"
21
+
'';
22
+
23
+
buildPhase = ''
24
+
tools/make-firefox.sh all
25
+
'';
26
+
27
+
installPhase = ''
28
+
mkdir -p $out/
29
+
cp dist/build/uBlock.firefox.xpi $out/${id}.xpi
30
+
'';
31
+
}
+19
nixos/5pkgs/firefoxPlugins/vimperator.nix
+19
nixos/5pkgs/firefoxPlugins/vimperator.nix
···
1
+
{ fetchgit, stdenv, zip }:
2
+
3
+
stdenv.mkDerivation rec {
4
+
name = "vimperator";
5
+
id = "vimperator@mozdev.org";
6
+
7
+
src = fetchgit {
8
+
url = "https://github.com/vimperator/vimperator-labs.git";
9
+
rev = "ba7d8e72516fdc22246748c8183d7bc90f6fb073";
10
+
sha256 = "0drz67qm5hxxzw699rswlpjkg4p2lfipx119pk1nyixrqblcsvq2";
11
+
};
12
+
13
+
buildInputs = [ zip ];
14
+
15
+
installPhase = ''
16
+
mkdir -p $out/
17
+
cp downloads/vimperator*.xpi $out/${id}.xpi
18
+
'';
19
+
}
+12
nixos/5pkgs/graphml2json/default.nix
+12
nixos/5pkgs/graphml2json/default.nix
···
1
+
{ pkgs, ... }:
2
+
pkgs.writers.writePython3Bin "graphml2json" { libraries = [ pkgs.python3Packages.networkx ]; } ''
3
+
import networkx as nx
4
+
import json
5
+
import sys
6
+
7
+
8
+
G = nx.read_graphml(sys.argv[1])
9
+
data = nx.readwrite.json_graph.node_link_data(G)
10
+
11
+
print(json.dumps(data, indent=2))
12
+
''
+15
nixos/5pkgs/htmlparser/default.nix
+15
nixos/5pkgs/htmlparser/default.nix
···
1
+
{ lib, buildGoModule, fetchFromGitHub }:
2
+
3
+
buildGoModule rec {
4
+
pname = "htmlparser";
5
+
version = "v1.0.0";
6
+
7
+
src = fetchFromGitHub {
8
+
owner = "htmlparser";
9
+
repo = "htmlparser";
10
+
rev = "02f964ebd24c296dcfa56c357bb8dedde0f39757";
11
+
sha256 = "1k19rdpjf5sdyjfl233y6bsfgkcnv799ivrh2vkw22almg4243ar";
12
+
};
13
+
14
+
vendorSha256 = "0qkd587z4n372y4lqyzjqc1qlsi3525ah99vdm5dqq4jidcd5h7w";
15
+
}
+107
nixos/5pkgs/init/default.nix
+107
nixos/5pkgs/init/default.nix
···
1
+
{ pkgs, lib, vgname ? "vgname", luksmap ? "luksmap", ... }:
2
+
3
+
with lib;
4
+
5
+
pkgs.writeScriptBin "init" ''
6
+
#!/usr/bin/env nix-shell
7
+
#! nix-shell -i bash -p cryptsetup gptfdisk jq libxfs
8
+
set -xefuo pipefail
9
+
10
+
disk=$1
11
+
12
+
if mount | grep -q "$disk"; then
13
+
echo "target device is already mounted, bailout"
14
+
exit 2
15
+
fi
16
+
17
+
bootdev="$disk"2
18
+
luksdev="$disk"3
19
+
luksmap=/dev/mapper/${luksmap}
20
+
21
+
vgname=${vgname}
22
+
23
+
24
+
rootdev=/dev/mapper/${vgname}-root
25
+
homedev=/dev/mapper/${vgname}-home
26
+
27
+
read -p "LUKS Password: " lukspw
28
+
29
+
#
30
+
# partitioning
31
+
#
32
+
33
+
# http://en.wikipedia.org/wiki/GUID_Partition_Table
34
+
# undo:
35
+
# dd if=/dev/zero bs=512 count=34 of=/dev/sda
36
+
# TODO zero last 34 blocks (lsblk -bno SIZE /dev/sda)
37
+
if ! test "$(blkid -o value -s PTTYPE "$disk")" = gpt; then
38
+
sgdisk -og "$disk"
39
+
sgdisk -n 1:2048:4095 -c 1:"BIOS Boot Partition" -t 1:ef02 "$disk"
40
+
sgdisk -n 2:4096:+1G -c 2:"EFI System Partition" -t 2:ef00 "$disk"
41
+
sgdisk -n 3:0:0 -c 3:"LUKS container" -t 3:8300 "$disk"
42
+
fi
43
+
44
+
if ! test "$(blkid -o value -s PARTLABEL "$luksdev")" = "LUKS container"; then
45
+
echo zonk2
46
+
exit 23
47
+
fi
48
+
49
+
if ! cryptsetup isLuks "$luksdev"; then
50
+
# aes xts-plain64
51
+
echo -n "$lukspw" | cryptsetup luksFormat "$luksdev" - \
52
+
-h sha512 \
53
+
--iter-time 5000
54
+
fi
55
+
56
+
if ! test -e "$luksmap"; then
57
+
echo "$lukspw" | cryptsetup luksOpen "$luksdev" "$(basename "$luksmap")" -
58
+
fi
59
+
60
+
if ! test "$(blkid -o value -s TYPE "$luksmap")" = LVM2_member; then
61
+
pvcreate "$luksmap"
62
+
fi
63
+
64
+
if ! vgdisplay -s "$vgname"; then vgcreate "$vgname" "$luksmap"; fi
65
+
66
+
lvchange -a y /dev/mapper/"$vgname"
67
+
68
+
if ! test -e "$rootdev"; then lvcreate -L 3G -n root "$vgname"; fi
69
+
70
+
#
71
+
# formatting
72
+
#
73
+
74
+
if ! test "$(blkid -o value -s TYPE "$bootdev")" = vfat; then
75
+
mkfs.vfat "$bootdev"
76
+
fi
77
+
78
+
if ! test "$(blkid -o value -s TYPE "$rootdev")" = xfs; then
79
+
mkfs.xfs "$rootdev"
80
+
fi
81
+
82
+
if ! test "$(lsblk -n -o MOUNTPOINT "$rootdev")" = /mnt; then
83
+
mkdir -p /mnt
84
+
mount "$rootdev" /mnt
85
+
fi
86
+
if ! test "$(lsblk -n -o MOUNTPOINT "$bootdev")" = /mnt/boot; then
87
+
mkdir -m 0000 -p /mnt/boot
88
+
mount "$bootdev" /mnt/boot
89
+
fi
90
+
91
+
#
92
+
# dependencies for stockholm
93
+
#
94
+
95
+
# TODO: get sentinal file from target_path
96
+
mkdir -p /mnt/var/src
97
+
touch /mnt/var/src/.populate
98
+
99
+
#
100
+
# print all the infos
101
+
#
102
+
103
+
gdisk -l "$disk"
104
+
lsblk "$disk"
105
+
106
+
echo READY.
107
+
''
+7
nixos/5pkgs/init/run-vm.sh
+7
nixos/5pkgs/init/run-vm.sh
+13
nixos/5pkgs/init/test.nix
+13
nixos/5pkgs/init/test.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
virtualisation.emptyDiskImages = [
4
+
8000
5
+
];
6
+
virtualisation.memorySize = 1500;
7
+
boot.tmpOnTmpfs = true;
8
+
9
+
environment.systemPackages = [
10
+
(pkgs.callPackage ./default.nix {})
11
+
];
12
+
services.mingetty.autologinUser = lib.mkForce "root";
13
+
}
+11
nixos/5pkgs/init/test.sh
+11
nixos/5pkgs/init/test.sh
+35
nixos/5pkgs/install-system/default.nix
+35
nixos/5pkgs/install-system/default.nix
···
1
+
{ pkgs }:
2
+
pkgs.writers.writeDashBin "install-system" ''
3
+
set -efux
4
+
SYSTEM=$1
5
+
TARGET=$2
6
+
# format
7
+
if ! (sshn "$TARGET" -- mountpoint /mnt); then
8
+
if ! (sshn "$TARGET" -- type -p nix); then
9
+
nix run github:numtide/nixos-remote -- --stop-after-disko --store-paths "$(nix-build --no-out-link -I stockholm="$HOME"/sync/stockholm -I nixos-config="$HOME"/sync/stockholm/lass/1systems/"$SYSTEM"/physical.nix '<nixpkgs/nixos>' -A config.system.build.diskoNoDeps)" /dev/null "$TARGET"
10
+
else
11
+
disko=$(nix-build -I stockholm=$HOME/sync/stockholm -I secrets=$HOME/sync/stockholm/lass/2configs/tests/dummy-secrets -I nixos-config=$HOME/sync/stockholm/lass/1systems/$SYSTEM/physical.nix '<nixpkgs/nixos>' -A config.system.build.disko)
12
+
NIX_SSHOPTS='-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no' nix-copy-closure --to "$TARGET" "$disko"
13
+
sshn -t "$TARGET" -- "$disko"
14
+
fi
15
+
fi
16
+
17
+
# install dependencies
18
+
sshn "$TARGET" << SSH
19
+
if ! type -p git; then
20
+
nix-channel --update
21
+
nix-env -iA nixos.git
22
+
fi
23
+
SSH
24
+
25
+
# populate
26
+
$(nix-build --no-out-link "$HOME"/sync/stockholm/lass/krops.nix -A populate --argstr name "$SYSTEM" --argstr target "$TARGET"/mnt/var/src --arg force true)
27
+
28
+
# install
29
+
sshn "$TARGET" << SSH
30
+
NIXOS_CONFIG=/var/src/nixos-config nixos-install --no-root-password -I /mnt/var/src
31
+
nixos-enter -- nixos-rebuild -I /var/src switch --install-bootloader
32
+
umount -R /mnt
33
+
zpool export -fa
34
+
SSH
35
+
''
+82
nixos/5pkgs/l-gen-secrets/default.nix
+82
nixos/5pkgs/l-gen-secrets/default.nix
···
1
+
{ pkgs }:
2
+
pkgs.writers.writeDashBin "l-gen-secrets" ''
3
+
set -efu
4
+
HOSTNAME=$1
5
+
TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d)
6
+
if [ "''${DRYRUN-n}" = "n" ]; then
7
+
trap 'rm -rf $TMPDIR' EXIT
8
+
else
9
+
echo "$TMPDIR"
10
+
set -x
11
+
fi
12
+
mkdir -p $TMPDIR/out
13
+
14
+
PASSWORD=$(${pkgs.pwgen}/bin/pwgen 25 1)
15
+
HASHED_PASSWORD=$(echo $PASSWORD | ${pkgs.hashPassword}/bin/hashPassword -s) > /dev/null
16
+
17
+
# ssh
18
+
${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f $TMPDIR/ssh.id_ed25519 -P "" -C "" >/dev/null
19
+
${pkgs.coreutils}/bin/mv $TMPDIR/ssh.id_ed25519 $TMPDIR/out/
20
+
21
+
# tor
22
+
${pkgs.coreutils}/bin/timeout 1 ${pkgs.tor}/bin/tor --HiddenServiceDir $TMPDIR/tor --HiddenServicePort 1 --SocksPort 0 >/dev/null || :
23
+
${pkgs.coreutils}/bin/mv $TMPDIR/tor/hs_ed25519_secret_key $TMPDIR/out/ssh-tor.priv
24
+
25
+
# tinc
26
+
${pkgs.coreutils}/bin/mkdir -p $TMPDIR/tinc
27
+
${pkgs.tinc_pre}/bin/tinc --config $TMPDIR/tinc generate-keys 4096 </dev/null
28
+
${pkgs.coreutils}/bin/mv $TMPDIR/tinc/ed25519_key.priv $TMPDIR/out/retiolum.ed25519_key.priv
29
+
${pkgs.coreutils}/bin/mv $TMPDIR/tinc/rsa_key.priv $TMPDIR/out/retiolum.rsa_key.priv
30
+
31
+
# wireguard
32
+
${pkgs.wireguard-tools}/bin/wg genkey > $TMPDIR/out/wiregrill.key
33
+
${pkgs.coreutils}/bin/cat $TMPDIR/out/wiregrill.key | ${pkgs.wireguard-tools}/bin/wg pubkey > $TMPDIR/wiregrill.pub
34
+
35
+
# system passwords
36
+
cat <<EOF > $TMPDIR/out/hashedPasswords.nix
37
+
{
38
+
root = "$HASHED_PASSWORD";
39
+
mainUser = "$HASHED_PASSWORD";
40
+
}
41
+
EOF
42
+
43
+
set +f
44
+
if [ "''${DRYRUN-n}" = "n" ]; then
45
+
cd $TMPDIR/out
46
+
for x in *; do
47
+
${pkgs.coreutils}/bin/cat $x | ${pkgs.pass}/bin/pass insert -m hosts/$HOSTNAME/$x > /dev/null
48
+
done
49
+
echo $PASSWORD | ${pkgs.pass}/bin/pass insert -m admin/$HOSTNAME/pass > /dev/null
50
+
${pkgs.coreutils}/bin/cat $TMPDIR/tor/hostname | ${pkgs.pass}/bin/pass insert -m admin/$HOSTNAME/torname > /dev/null
51
+
fi
52
+
set -f
53
+
54
+
cat <<EOF
55
+
{ r6, w6, ... }:
56
+
{
57
+
nets = {
58
+
retiolum = {
59
+
ip4.addr = "10.243.0.changeme";
60
+
ip6.addr = r6 "changeme";
61
+
aliases = [
62
+
"$HOSTNAME.r"
63
+
];
64
+
tinc.pubkey = ${"''"}
65
+
$(cat $TMPDIR/tinc/rsa_key.pub | sed 's/^/ /')
66
+
${"''"};
67
+
tinc.pubkey_ed25519 = "$(cat $TMPDIR/tinc/ed25519_key.pub | ${pkgs.gnused}/bin/sed 's/.* = //')";
68
+
};
69
+
wiregrill = {
70
+
ip6.addr = w6 "changeme";
71
+
aliases = [
72
+
"$HOSTNAME.w"
73
+
];
74
+
wireguard.pubkey = ${"''"}
75
+
$(cat $TMPDIR/wiregrill.pub)
76
+
${"''"};
77
+
};
78
+
};
79
+
ssh.pubkey = "$(cat $TMPDIR/ssh.id_ed25519.pub)";
80
+
}
81
+
EOF
82
+
''
+7
nixos/5pkgs/logify/default.nix
+7
nixos/5pkgs/logify/default.nix
+19
nixos/5pkgs/mk_sql_pair/default.nix
+19
nixos/5pkgs/mk_sql_pair/default.nix
···
1
+
{ pkgs, ... }:
2
+
3
+
pkgs.writeScriptBin "mk_sql_pair" ''
4
+
#!/bin/sh
5
+
6
+
name=$1
7
+
password=$2
8
+
9
+
if [ $# -ne 2 ]; then
10
+
echo '$1=name, $2=password'
11
+
exit 23;
12
+
fi
13
+
14
+
cat <<EOF
15
+
create database $name;
16
+
create user $name;
17
+
grant all on $name.* to $name@'localhost' identified by '$password';
18
+
EOF
19
+
''
+40
nixos/5pkgs/mpv-poll/default.nix
+40
nixos/5pkgs/mpv-poll/default.nix
···
1
+
{ pkgs, ... }:
2
+
3
+
pkgs.writeScriptBin "mpv-poll" ''
4
+
#! ${pkgs.bash}/bin/bash
5
+
6
+
pl=$1
7
+
hist=''${HISTORY:-"./mpv_history"}
8
+
mpv_options=''${MPV_OPTIONS:-""}
9
+
10
+
lastYT=""
11
+
12
+
play_video () {
13
+
toPlay=$1
14
+
echo $toPlay >> $hist
15
+
mpv $mpv_options $toPlay
16
+
}
17
+
18
+
if ! [ -e $hist ]; then
19
+
touch $hist
20
+
fi
21
+
22
+
while :
23
+
do
24
+
if [ -s $pl ]; then
25
+
toPlay=$(head -1 $pl)
26
+
sed -i '1d' $pl
27
+
if $(echo $toPlay | grep -Eq 'https?://(www.)?youtube.com/watch'); then
28
+
lastYT=$toPlay
29
+
fi
30
+
play_video $toPlay
31
+
else
32
+
if [ -n "$lastYT" ]; then
33
+
next=$(yt-next $lastYT)
34
+
lastYT=$next
35
+
play_video $next
36
+
fi
37
+
sleep 1
38
+
fi
39
+
done
40
+
''
+16
nixos/5pkgs/nichtparasoup/default.nix
+16
nixos/5pkgs/nichtparasoup/default.nix
···
1
+
{ stdenv, pkgs, ... }:
2
+
let
3
+
py = pkgs.python3Packages.python.withPackages (p: [
4
+
p.werkzeug
5
+
p.beautifulsoup4
6
+
]);
7
+
src = ./nichtparasoup;
8
+
# src = pkgs.fetchFromGitHub {
9
+
# owner = "k4cg";
10
+
# repo = "nichtparasoup";
11
+
# rev = "c6dcd0d";
12
+
# sha256 = "10xy20bjdnd5bjv2hf6v5y5wi0mc9555awxkjqf57rk6ngc5w6ss";
13
+
# };
14
+
in pkgs.writeDashBin "nichtparasoup" ''
15
+
${py}/bin/python ${src}/nichtparasoup.py "$@"
16
+
''
+13
nixos/5pkgs/nichtparasoup/exception.patch
+13
nixos/5pkgs/nichtparasoup/exception.patch
···
1
+
diff --git a/nichtparasoup.py b/nichtparasoup.py
2
+
index 9da9a2b..833ca71 100755
3
+
--- a/nichtparasoup.py
4
+
+++ b/nichtparasoup.py
5
+
@@ -211,7 +211,7 @@ def cache_fill_loop():
6
+
try:
7
+
sources[crawler][site].crawl()
8
+
info = Crawler.info()
9
+
- except Exception, e:
10
+
+ except Exception as e:
11
+
logger.error("Error in crawler %s - %s: %s" % (crawler, site, e))
12
+
break
13
+
+9
nixos/5pkgs/nix-index-update/default.nix
+9
nixos/5pkgs/nix-index-update/default.nix
···
1
+
{ pkgs }:
2
+
pkgs.writers.writeDashBin "nix-index-update" ''
3
+
set -efux
4
+
filename="index-$(uname -m)-$(uname | tr A-Z a-z)"
5
+
mkdir -p ~/.cache/nix-index && cd ~/.cache/nix-index
6
+
# -N will only download a new version if there is an update.
7
+
${pkgs.wget}/bin/wget -q -N https://github.com/Mic92/nix-index-database/releases/latest/download/$filename
8
+
ln -f $filename files
9
+
''
+10
nixos/5pkgs/pop/default.nix
+10
nixos/5pkgs/pop/default.nix
+286
nixos/5pkgs/q/default.nix
+286
nixos/5pkgs/q/default.nix
···
1
+
{ pkgs, ... }:
2
+
let
3
+
q-cal = let
4
+
# XXX 23 is the longest line of cal's output
5
+
pad = ''{
6
+
${pkgs.gnused}/bin/sed '
7
+
# rtrim
8
+
s/ *$//
9
+
10
+
# delete last empty line
11
+
''${/^$/d}
12
+
' \
13
+
| ${pkgs.gawk}/bin/awk '{printf "%-23s\n", $0}' \
14
+
| ${pkgs.gnused}/bin/sed '
15
+
# colorize header
16
+
1,2s/.*/[38;5;238;1m&[39;22m/
17
+
18
+
# colorize week number
19
+
s/^[ 1-9][0-9]/[38;5;238;1m&[39;22m/
20
+
'
21
+
}'';
22
+
in ''
23
+
${pkgs.coreutils}/bin/paste \
24
+
<(${pkgs.util-linux}/bin/cal -mw \
25
+
$(${pkgs.coreutils}/bin/date +'%m %Y' -d 'last month') \
26
+
| ${pad}
27
+
) \
28
+
<(${pkgs.util-linux}/bin/cal -mw \
29
+
| ${pkgs.gnused}/bin/sed '
30
+
# colorize day of month
31
+
s/\(^\| \)'"$(${pkgs.coreutils}/bin/date +%e)"'\>/[31;1m&[39;22m/
32
+
' \
33
+
| ${pad}
34
+
) \
35
+
<(${pkgs.util-linux}/bin/cal -mw \
36
+
$(${pkgs.coreutils}/bin/date +'%m %Y' -d 'next month') \
37
+
| ${pad}
38
+
) \
39
+
| ${pkgs.gnused}/bin/sed 's/\t/ /g'
40
+
'';
41
+
42
+
q-isodate = ''
43
+
${pkgs.coreutils}/bin/date \
44
+
'+[1m%Y-%m-%d[;30mT[;38;5;085m%H:%M[m:%S%:z'
45
+
'';
46
+
47
+
q-gitdir = ''
48
+
if test -d .git; then
49
+
#git status --porcelain
50
+
branch=$(
51
+
${pkgs.git}/bin/git branch \
52
+
| ${pkgs.gnused}/bin/sed -rn 's/^\* (.*)/\1/p'
53
+
)
54
+
echo "± $LOGNAME@''${HOSTNAME-$(${pkgs.nettools}/bin/hostname)}:$PWD .git $branch"
55
+
fi
56
+
'';
57
+
58
+
q-intel_backlight = ''
59
+
cd /sys/class/backlight/intel_backlight
60
+
</dev/null exec ${pkgs.gawk}/bin/awk '
61
+
END {
62
+
getline actual_brightness < "actual_brightness"
63
+
getline max_brightness < "max_brightness"
64
+
getline brightness < "brightness"
65
+
printf "intel_backlight %d%% %d/%d\n" \
66
+
, actual_brightness / max_brightness * 100 \
67
+
, actual_brightness \
68
+
, max_brightness
69
+
}
70
+
'
71
+
'';
72
+
73
+
q-power_supply = let
74
+
power_supply = pkgs.writeBash "power_supply" ''
75
+
set -efu
76
+
uevent=$1
77
+
eval "$(${pkgs.gnused}/bin/sed -n '
78
+
s/^\([A-Z_]\+=[0-9A-Za-z_-]*\)$/export \1/p
79
+
' $uevent)"
80
+
case $POWER_SUPPLY_NAME in
81
+
AC)
82
+
exit # not battery
83
+
;;
84
+
esac
85
+
exec </dev/null
86
+
exec ${pkgs.gawk}/bin/awk '
87
+
function die(s) {
88
+
printf "%s: %s\n", name, s
89
+
exit 1
90
+
}
91
+
92
+
function print_hm(h, m) {
93
+
m = (h - int(h)) * 60
94
+
return sprintf("%dh%dm", h, m)
95
+
}
96
+
97
+
function print_bar(n, r, t1, t2, t_col) {
98
+
t1 = int(r * n)
99
+
t2 = n - t1
100
+
if (r >= .42) t_col = "1;32"
101
+
else if (r >= 23) t_col = "1;33"
102
+
else if (r >= 11) t_col = "1;31"
103
+
else t_col = "5;1;31"
104
+
return sgr(t_col) strdup("■", t1) sgr(";30") strdup("■", t2) sgr()
105
+
}
106
+
107
+
function sgr(p) {
108
+
return "\x1b[" p "m"
109
+
}
110
+
111
+
function strdup(s,n,t) {
112
+
t = sprintf("%"n"s","")
113
+
gsub(/ /,s,t)
114
+
return t
115
+
}
116
+
117
+
END {
118
+
name = ENVIRON["POWER_SUPPLY_NAME"]
119
+
120
+
charge_unit = "Ah"
121
+
charge_now = ENVIRON["POWER_SUPPLY_CHARGE_NOW"] / 10^6
122
+
charge_full = ENVIRON["POWER_SUPPLY_CHARGE_FULL"] / 10^6
123
+
124
+
current_unit = "A"
125
+
current_now = ENVIRON["POWER_SUPPLY_CURRENT_NOW"] / 10^6
126
+
127
+
energy_unit = "Wh"
128
+
energy_now = ENVIRON["POWER_SUPPLY_ENERGY_NOW"] / 10^6
129
+
energy_full = ENVIRON["POWER_SUPPLY_ENERGY_FULL"] / 10^6
130
+
131
+
power_unit = "W"
132
+
power_now = ENVIRON["POWER_SUPPLY_POWER_NOW"] / 10^6
133
+
134
+
voltage_unit = "V"
135
+
voltage_now = ENVIRON["POWER_SUPPLY_VOLTAGE_NOW"] / 10^6
136
+
voltage_min_design = ENVIRON["POWER_SUPPLY_VOLTAGE_MIN_DESIGN"] / 10^6
137
+
138
+
#printf "charge_now: %s\n", charge_now
139
+
#printf "charge_full: %s\n", charge_full
140
+
#printf "current_now: %s\n", current_now
141
+
#printf "energy_now: %s\n", energy_now
142
+
#printf "energy_full: %s\n", energy_full
143
+
#printf "energy_full: %s\n", ENVIRON["POWER_SUPPLY_ENERGY_FULL"]
144
+
#printf "energy_full: %s\n", ENVIRON["POWER_SUPPLY_ENERGY_FULL"] / 10^6
145
+
#printf "power_now: %s\n", power_now
146
+
#printf "voltage_now: %s\n", voltage_now
147
+
148
+
if (current_now == 0 && voltage_now != 0) {
149
+
current_now = power_now / voltage_now
150
+
}
151
+
if (power_now == 0) {
152
+
power_now = current_now * voltage_now
153
+
}
154
+
if (charge_now == 0 && voltage_min_design != 0) {
155
+
charge_now = energy_now / voltage_min_design
156
+
}
157
+
if (energy_now == 0) {
158
+
energy_now = charge_now * voltage_min_design
159
+
}
160
+
if (charge_full == 0 && voltage_min_design != 0) {
161
+
charge_full = energy_full / voltage_min_design
162
+
}
163
+
if (energy_full == 0) {
164
+
energy_full = charge_full * voltage_min_design
165
+
}
166
+
167
+
if (charge_now == 0 || charge_full == 0) {
168
+
die("unknown charge")
169
+
}
170
+
171
+
charge_ratio = charge_now / charge_full
172
+
173
+
out = out name
174
+
out = out sprintf(" %s", print_bar(10, charge_ratio))
175
+
out = out sprintf(" %d%", charge_ratio * 100)
176
+
out = out sprintf(" %.2f%s", charge_now, charge_unit)
177
+
if (current_now != 0) {
178
+
out = out sprintf("/%.1f%s", current_now, current_unit)
179
+
}
180
+
out = out sprintf(" %d%s", energy_full, energy_unit)
181
+
if (power_now != 0) {
182
+
out = out sprintf("/%.1f%s", power_now, power_unit)
183
+
}
184
+
if (current_now != 0) {
185
+
out = out sprintf(" %s", print_hm(charge_now / current_now))
186
+
}
187
+
188
+
print out
189
+
}
190
+
'
191
+
'';
192
+
in ''
193
+
for uevent in /sys/class/power_supply/*/uevent; do
194
+
${power_supply} "$uevent" || :
195
+
done
196
+
'';
197
+
198
+
q-virtualization = ''
199
+
echo "VT: $(${pkgs.systemd}/bin/systemd-detect-virt)"
200
+
'';
201
+
202
+
q-wireless = ''
203
+
for dev in $(
204
+
${pkgs.iw}/bin/iw dev \
205
+
| ${pkgs.gnused}/bin/sed -n 's/^\s*Interface\s\+\([0-9a-z]\+\)$/\1/p'
206
+
); do
207
+
inet=$(${pkgs.iproute2}/bin/ip addr show $dev \
208
+
| ${pkgs.gnused}/bin/sed -n '
209
+
s/.*inet \([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/p
210
+
') \
211
+
|| unset inet
212
+
ssid=$(${pkgs.iw}/bin/iw dev $dev link \
213
+
| ${pkgs.gnused}/bin/sed -n '
214
+
s/.*\tSSID: \(.*\)/\1/p
215
+
') \
216
+
|| unset ssid
217
+
echo "$dev''${inet+ $inet}''${ssid+ $ssid}"
218
+
done
219
+
'';
220
+
221
+
q-online = ''
222
+
if ${pkgs.curl}/bin/curl -s google.com >/dev/null; then
223
+
echo '[32;1monline[m'
224
+
else
225
+
echo offline
226
+
fi
227
+
'';
228
+
229
+
q-thermal_zone = ''
230
+
for i in /sys/class/thermal/thermal_zone*; do
231
+
type=$(${pkgs.coreutils}/bin/cat $i/type)
232
+
temp=$(${pkgs.coreutils}/bin/cat $i/temp)
233
+
printf '%s %s°C\n' $type $(echo $temp / 1000 | ${pkgs.bc}/bin/bc)
234
+
done
235
+
'';
236
+
237
+
q-todo = ''
238
+
TODO_file=$HOME/TODO
239
+
if test -e "$TODO_file"; then
240
+
${pkgs.coreutils}/bin/cat "$TODO_file" \
241
+
| ${pkgs.gawk}/bin/gawk -v now=$(${pkgs.coreutils}/bin/date +%s) '
242
+
BEGIN { print "remind=0" }
243
+
/^[0-9]/{
244
+
x = $1
245
+
gsub(".", "\\\\&", x)
246
+
rest = substr($0, index($0, " "))
247
+
rest = $0
248
+
sub(" *", "", rest)
249
+
gsub(".", "\\\\&", rest)
250
+
print "test $(${pkgs.coreutils}/bin/date +%s -d"x") -lt "now" && \
251
+
echo \"\x1b[38;5;208m\""rest esc "\"\x1b[m\" && \
252
+
(( remind++ ))"
253
+
}
254
+
END { print "test $remind = 0 && echo \"nothing to remind\"" }
255
+
' \
256
+
| {
257
+
# bash needed for (( ... ))
258
+
${pkgs.bash}/bin/bash
259
+
}
260
+
else
261
+
echo "$TODO_file: no such file or directory"
262
+
fi
263
+
'';
264
+
265
+
in
266
+
# bash needed for <(...)
267
+
pkgs.writeBashBin "q" ''
268
+
set -eu
269
+
export PATH=/var/empty
270
+
(${q-todo}) || :
271
+
if [ "$PWD" != "$HOME" ]; then
272
+
(HOME=$PWD; ${q-todo}) || :
273
+
fi
274
+
echo
275
+
${q-cal}
276
+
echo
277
+
${q-isodate}
278
+
(${q-gitdir}) &
279
+
(${q-intel_backlight}) &
280
+
(${q-power_supply}) &
281
+
(${q-virtualization}) &
282
+
(${q-wireless}) &
283
+
(${q-online}) &
284
+
(${q-thermal_zone}) &
285
+
wait
286
+
''
+39
nixos/5pkgs/review-mail-queue/default.nix
+39
nixos/5pkgs/review-mail-queue/default.nix
···
1
+
{ pkgs }: let
2
+
3
+
review = pkgs.writers.writeBash "review-mail" ''
4
+
mail="$1"
5
+
${pkgs.exim}/bin/exim -Mvc "$mail" | grep -E 'Subject:|To:'
6
+
${pkgs.exim}/bin/exim -Mvl "$mail"
7
+
while :; do
8
+
read -p 'delete?' key
9
+
case "$key" in
10
+
v*)
11
+
${pkgs.exim}/bin/exim -Mvc "$mail"
12
+
;;
13
+
d*)
14
+
${pkgs.exim}/bin/exim -Mrm "$mail"
15
+
break
16
+
;;
17
+
r*)
18
+
${pkgs.exim}/bin/exim -Mt "$mail"
19
+
break
20
+
;;
21
+
n*)
22
+
break
23
+
;;
24
+
esac
25
+
done
26
+
echo '-------------------'
27
+
echo '-------------------'
28
+
echo '-------------------'
29
+
echo '-------------------'
30
+
echo '-------------------'
31
+
'';
32
+
33
+
in pkgs.writers.writeBashBin "review-mail" ''
34
+
for mail in $(${pkgs.exim}/bin/exim -bp \
35
+
| ${pkgs.gnugrep}/bin/grep frozen \
36
+
| ${pkgs.gawk}/bin/awk '{print $3}'); do
37
+
${review} "$mail"
38
+
done
39
+
''
+6
nixos/5pkgs/rs/default.nix
+6
nixos/5pkgs/rs/default.nix
+69
nixos/5pkgs/searx/default.nix
+69
nixos/5pkgs/searx/default.nix
···
1
+
{ lib, nixosTests, python3, python3Packages, fetchFromGitHub, fetchpatch }:
2
+
3
+
with python3Packages;
4
+
5
+
toPythonModule (buildPythonApplication rec {
6
+
pname = "searx";
7
+
version = "1.0.0";
8
+
9
+
# Can not use PyPI because certain test files are missing.
10
+
src = fetchFromGitHub {
11
+
owner = "searx";
12
+
repo = "searx";
13
+
rev = "v${version}";
14
+
sha256 = "0ghkx8g8jnh8yd46p4mlbjn2zm12nx27v7qflr4c8xhlgi0px0mh";
15
+
};
16
+
17
+
postPatch = ''
18
+
sed -i 's/==.*$//' requirements.txt
19
+
'';
20
+
21
+
preBuild = ''
22
+
export SEARX_DEBUG="true";
23
+
'';
24
+
25
+
propagatedBuildInputs = [
26
+
Babel
27
+
certifi
28
+
dateutil
29
+
flask
30
+
flaskbabel
31
+
gevent
32
+
grequests
33
+
jinja2
34
+
langdetect
35
+
lxml
36
+
ndg-httpsclient
37
+
pyasn1
38
+
pyasn1-modules
39
+
pygments
40
+
pysocks
41
+
pytz
42
+
pyyaml
43
+
requests
44
+
speaklater
45
+
werkzeug
46
+
];
47
+
48
+
# tests try to connect to network
49
+
doCheck = false;
50
+
# checkInputs = [
51
+
# Babel mock nose2 covCore pep8 plone-testing splinter
52
+
# unittest2 zope_testrunner selenium
53
+
# ];
54
+
55
+
postInstall = ''
56
+
# Create a symlink for easier access to static data
57
+
mkdir -p $out/share
58
+
ln -s ../${python3.sitePackages}/searx/static $out/share/
59
+
'';
60
+
61
+
passthru.tests = { inherit (nixosTests) searx; };
62
+
63
+
meta = with lib; {
64
+
homepage = "https://github.com/searx/searx";
65
+
description = "A privacy-respecting, hackable metasearch engine";
66
+
license = licenses.agpl3Plus;
67
+
maintainers = with maintainers; [ matejc fpletz globin danielfullmer ];
68
+
};
69
+
})
+1
nixos/5pkgs/searx/result
+1
nixos/5pkgs/searx/result
···
1
+
/nix/store/spmxdwcm2njnjm92xwp864kz2sgqridy-searx-1.0.0
+39
nixos/5pkgs/sshify/default.nix
+39
nixos/5pkgs/sshify/default.nix
···
1
+
{ pkgs }:
2
+
# usage: sshify prism.r -- curl ifconfig.me
3
+
pkgs.writers.writeBashBin "sshify" ''
4
+
set -efu
5
+
6
+
TMPDIR=$(mktemp -d)
7
+
8
+
SSH_ARGS=()
9
+
10
+
while [[ "$#" -gt 0 ]]; do
11
+
case $1 in
12
+
--)
13
+
shift
14
+
break
15
+
;;
16
+
*)
17
+
SSH_ARGS+=($1)
18
+
;;
19
+
esac
20
+
shift
21
+
done
22
+
23
+
if [[ "$#" -le 0 ]]; then
24
+
echo no command specified
25
+
exit 1
26
+
fi
27
+
28
+
RANDOM_HIGH_PORT=$(shuf -i 20000-65000 -n 1)
29
+
30
+
cat << EOF >$TMPDIR/proxychains.conf
31
+
[ProxyList]
32
+
socks4 127.0.0.1 $RANDOM_HIGH_PORT
33
+
EOF
34
+
35
+
ssh -fNM -S "$TMPDIR/socket" -D "$RANDOM_HIGH_PORT" "''${SSH_ARGS[@]}"
36
+
trap "ssh -S $TMPDIR/socket -O exit bla 2>/dev/null; rm -rf $TMPDIR >&2" EXIT
37
+
38
+
${pkgs.proxychains-ng}/bin/proxychains4 -q -f "$TMPDIR/proxychains.conf" "$@"
39
+
''
+11
nixos/5pkgs/sshvnc/default.nix
+11
nixos/5pkgs/sshvnc/default.nix
···
1
+
{ pkgs }:
2
+
pkgs.writers.writeBashBin "sshvnc" ''
3
+
set -xm
4
+
5
+
RANDOM_HIGH_PORT=$(shuf -i 20000-65000 -n 1)
6
+
ssh "$@" -f -L $RANDOM_HIGH_PORT:localhost:$RANDOM_HIGH_PORT -- x11vnc -noxdamage -noxfixes -noxrecord -display :0 -localhost -rfbport $RANDOM_HIGH_PORT
7
+
8
+
sleep 3
9
+
10
+
_JAVA_AWT_WM_NONREPARENTING=1 ${pkgs.turbovnc}/bin/vncviewer localhost:$RANDOM_HIGH_PORT
11
+
''
+38
nixos/5pkgs/super-vnc/default.nix
+38
nixos/5pkgs/super-vnc/default.nix
···
1
+
{ pkgs, lib }: let
2
+
3
+
quoteChar = c:
4
+
if c == "\n" then "'\n'"
5
+
else c;
6
+
quote = x: if x == "" then "''" else lib.stringAsChars quoteChar x;
7
+
8
+
in pkgs.writers.writeDashBin "super-vnc" ''
9
+
PATH=${lib.makeBinPath (with pkgs; [
10
+
xorg.xrandr gnugrep coreutils xorg.xorgserver gnused openssh gawk tightvnc
11
+
])}
12
+
remote=$1
13
+
res_x=$(xrandr --current | grep '*' | uniq | awk '{print $1}' | cut -d 'x' -f1)
14
+
res_y=$(xrandr --current | grep '*' | uniq | awk '{print $1}' | cut -d 'x' -f2)
15
+
export modeline="$(gtf "$res_x" "$res_y" 60 | sed -n 's/.*Modeline "\([^" ]\+\)" \(.*\)/\1 \2/p')"
16
+
export name="$(echo "$modeline" | sed 's/\([^ ]\+\) .*/\1/')"
17
+
export vncline="''${res_x}x''${res_y}+0+0"
18
+
19
+
if [ -z "$modeline" -o -z "$name" ]; then
20
+
echo "Error! modeline=$modeline name=$name"
21
+
exit 1
22
+
fi
23
+
24
+
echo $modeline
25
+
26
+
# TODO user random highport
27
+
ssh "$remote" -L 5900:localhost:55900 bash <<EOF
28
+
set -x
29
+
export DISPLAY=:0
30
+
export output=\$(xrandr | grep disconnected | tail -1 | cut -d' ' -f1)
31
+
xrandr --newmode $modeline
32
+
xrandr --verbose --addmode "\$output" "$name"
33
+
xrandr --output "\$output" --off
34
+
xrandr --verbose --output "\$output" --mode "$name" --right-of "\$(xrandr | grep primary | cut -d ' ' -f1)"
35
+
EOF
36
+
sleep 2
37
+
vncviewer localhost:55900
38
+
''
+27
nixos/5pkgs/sxiv/default.nix
+27
nixos/5pkgs/sxiv/default.nix
···
1
+
{ nsxiv, writers }:
2
+
3
+
writers.writeDashBin "sxiv" ''
4
+
set -efu
5
+
tmpfile="''${TMPDIR:-/tmp}/nsxiv_pipe_$$"
6
+
trap 'rm -f -- $tmpfile' EXIT
7
+
8
+
if [ "$#" -eq 0 ]; then
9
+
if [ -t 0 ]; then
10
+
echo "sxiv: No arguments provided" >&2; exit 1
11
+
else
12
+
# Consume stdin and put it in the temporal file
13
+
cat > "$tmpfile"
14
+
fi
15
+
fi
16
+
17
+
for arg in "$@"; do
18
+
# if it's a pipe then drain it to $tmpfile
19
+
[ -p "$arg" ] && cat "$arg" > "$tmpfile"
20
+
done
21
+
22
+
if [ -s "$tmpfile" ]; then
23
+
${nsxiv}/bin/nsxiv -q "$@" "$tmpfile" # -q to silence warnings
24
+
else
25
+
${nsxiv}/bin/nsxiv "$@" # fallback
26
+
fi
27
+
''
+51
nixos/5pkgs/tdlib-purple/default.nix
+51
nixos/5pkgs/tdlib-purple/default.nix
···
1
+
{ stdenv, pkgs, fetchFromGitHub, cmake, pidgin, libwebp, libtgvoip } :
2
+
3
+
let
4
+
5
+
tdlib = stdenv.mkDerivation rec {
6
+
version = "1.6.0";
7
+
pname = "tdlib";
8
+
9
+
src = fetchFromGitHub {
10
+
owner = "tdlib";
11
+
repo = "td";
12
+
rev = "v${version}";
13
+
sha256 = "0zlzpl6fgszg18kwycyyyrnkm255dvc6fkq0b0y32m5wvwwl36cv";
14
+
};
15
+
16
+
buildInputs = with pkgs; [ gperf openssl readline zlib ];
17
+
nativeBuildInputs = [ pkgs.cmake ];
18
+
19
+
};
20
+
21
+
in stdenv.mkDerivation rec {
22
+
pname = "tdlib-purple";
23
+
version = "0.7.8";
24
+
25
+
src = fetchFromGitHub {
26
+
owner = "ars3niy";
27
+
repo = pname;
28
+
rev = "v${version}";
29
+
sha256 = "17g54mcxsidcx37l6m4p8i06ln1hvq3347dhdl9xkkn7pqpwvv1c";
30
+
};
31
+
32
+
cmakeFlags = [
33
+
"-Dtgvoip_INCLUDE_DIRS=${libtgvoip.dev}/include/tgvoip"
34
+
];
35
+
36
+
nativeBuildInputs = [ cmake ];
37
+
buildInputs = [ pidgin tdlib libwebp libtgvoip ];
38
+
39
+
installPhase = ''
40
+
mkdir -p $out/lib/purple-2/
41
+
cp *.so $out/lib/purple-2/
42
+
'';
43
+
44
+
meta = with stdenv.lib; {
45
+
homepage = "https://github.com/ars3niy/tdlib-purple";
46
+
description = "New libpurple plugin for Telegram";
47
+
license = licenses.gpl2;
48
+
maintainers = [ maintainers.lassulus ];
49
+
platforms = platforms.linux;
50
+
};
51
+
}
+21
nixos/5pkgs/urban/default.nix
+21
nixos/5pkgs/urban/default.nix
···
1
+
{ pkgs, ... }:
2
+
3
+
pkgs.writeScriptBin "urban" ''
4
+
#!/bin/sh
5
+
set -euf
6
+
term=$1
7
+
curl -LsS 'http://www.urbandictionary.com/define.php?term='"$term" \
8
+
| sed 's/<\/\?a\>[^>]*>//g' \
9
+
| sed 's/<\([^>]*\)>/\n<\1\n/g' \
10
+
| grep . \
11
+
| sed -n '/<div class=.meaning./,/<\/div/p' \
12
+
| sed 's/<div class=.meaning./-----/' \
13
+
| grep -v '^</div\>' \
14
+
| grep -v '^<br\>' \
15
+
| sed '
16
+
s/"/"/g
17
+
s/'/'\'''/g
18
+
s/>/>/g
19
+
s/</>/g
20
+
'
21
+
''
+62
nixos/5pkgs/xephyrify/default.nix
+62
nixos/5pkgs/xephyrify/default.nix
···
1
+
{ writeDashBin, writeHaskellPackage, coreutils, xorg, virtualgl, ... }:
2
+
3
+
let
4
+
5
+
xephyrify-xmonad = writeHaskellPackage "xephyrify-xmonad" {
6
+
executables.xmonad = {
7
+
extra-depends = [
8
+
"containers"
9
+
"unix"
10
+
"xmonad"
11
+
];
12
+
text = /* haskell */ ''
13
+
module Main where
14
+
import XMonad
15
+
import Data.Monoid
16
+
import System.Posix.Process (executeFile)
17
+
import qualified Data.Map as Map
18
+
19
+
main :: IO ()
20
+
main = do
21
+
xmonad def
22
+
{ workspaces = [ "1" ]
23
+
, layoutHook = myLayoutHook
24
+
, keys = myKeys
25
+
, normalBorderColor = "#000000"
26
+
, focusedBorderColor = "#000000"
27
+
, handleEventHook = myEventHook
28
+
}
29
+
30
+
myEventHook :: Event -> X All
31
+
32
+
myEventHook (ConfigureEvent { ev_event_type = 22 }) = do
33
+
spawn "${xorg.xrandr}/bin/xrandr >/dev/null 2>&1"
34
+
return (All True)
35
+
36
+
myEventHook _ = do
37
+
return (All True)
38
+
39
+
myLayoutHook = Full
40
+
myKeys _ = Map.fromList []
41
+
'';
42
+
};
43
+
};
44
+
45
+
in writeDashBin "xephyrify" ''
46
+
NDISPLAY=''${NDISPLAY:-$(${coreutils}/bin/shuf -i 100-65536 -n 1)}
47
+
echo "using DISPLAY $NDISPLAY"
48
+
${xorg.xorgserver}/bin/Xephyr -br -ac -reset -terminate -resizeable -dpi 60 -nolisten local :$NDISPLAY &
49
+
if test -n $DROP_TO_USER; then
50
+
sleep 1
51
+
ls /tmp/.X11-unix/
52
+
id
53
+
${coreutils}/bin/chgrp "$DROP_TO_USER" "/tmp/.X11-unix/X$NDISPLAY"
54
+
${coreutils}/bin/chmod 770 "/tmp/.X11-unix/X$NDISPLAY"
55
+
fi
56
+
XEPHYR_PID=$!
57
+
DISPLAY=:$NDISPLAY ${xephyrify-xmonad}/bin/xmonad &
58
+
XMONAD_PID=$!
59
+
DISPLAY=:$NDISPLAY ${virtualgl}/bin/vglrun "$@"
60
+
kill $XMONAD_PID
61
+
kill $XEPHYR_PID
62
+
''
+17
nixos/5pkgs/xml2json/default.nix
+17
nixos/5pkgs/xml2json/default.nix
···
1
+
{ pkgs, ... }:
2
+
let
3
+
pp = pkgs.python35Packages;
4
+
in pp.buildPythonPackage rec {
5
+
name = "xml2json-${version}";
6
+
version = "22ffcd";
7
+
propagatedBuildInputs = [
8
+
pp.simplejson
9
+
];
10
+
src = pkgs.fetchFromGitHub {
11
+
owner = "hay";
12
+
repo = "xml2json";
13
+
rev = "${version}";
14
+
sha256 = "1snjd6q6bk517350gdrl8kkphkra0iaz56i583h2q57ab09r29vc";
15
+
};
16
+
doCheck = false;
17
+
}
+56
nixos/5pkgs/xonsh2/default.nix
+56
nixos/5pkgs/xonsh2/default.nix
···
1
+
{ lib, stdenv
2
+
, fetchFromGitHub
3
+
, python39Packages
4
+
, glibcLocales
5
+
, coreutils
6
+
, git
7
+
, extraInputs ? []
8
+
}: let
9
+
10
+
python3Packages = python39Packages;
11
+
12
+
in python3Packages.buildPythonApplication rec {
13
+
pname = "xonsh2";
14
+
version = "master";
15
+
16
+
# fetch from github because the pypi package ships incomplete tests
17
+
src = fetchFromGitHub {
18
+
owner = "anki-code";
19
+
repo = "xonsh2";
20
+
rev = "bd96fcdce9319ab6b90c7d9ac47d2249b61144d0";
21
+
sha256 = "0b632rac8macfp2mmvhh1f34cf1m5qfpjajwnf676qk7jzn79vx6";
22
+
};
23
+
24
+
LC_ALL = "en_US.UTF-8";
25
+
26
+
postPatch = ''
27
+
sed -ie 's|/usr/bin/env|${coreutils}/bin/env|' scripts/xon.sh
28
+
find scripts -name 'xonsh*' -exec sed -i -e "s|env -S|env|" {} \;
29
+
find -name "*.xsh" | xargs sed -ie 's|/usr/bin/env|${coreutils}/bin/env|'
30
+
patchShebangs .
31
+
'';
32
+
33
+
doCheck = false;
34
+
35
+
checkPhase = ''
36
+
HOME=$TMPDIR pytest -k 'not test_repath_backslash and not test_os and not test_man_completion and not test_builtins and not test_main and not test_ptk_highlight and not test_pyghooks'
37
+
HOME=$TMPDIR pytest -k 'test_builtins or test_main' --reruns 5
38
+
HOME=$TMPDIR pytest -k 'test_ptk_highlight'
39
+
'';
40
+
41
+
checkInputs = [ python3Packages.pytest python3Packages.pytest-rerunfailures glibcLocales git ];
42
+
43
+
propagatedBuildInputs = with python3Packages; [ ply prompt_toolkit pygments ] ++ extraInputs;
44
+
45
+
meta = with lib; {
46
+
description = "A Python-ish, BASHwards-compatible shell";
47
+
homepage = "https://xon.sh/";
48
+
# changelog = "https://github.com/xonsh/xonsh/releases/tag/${version}";
49
+
license = licenses.bsd3;
50
+
platforms = platforms.all;
51
+
};
52
+
53
+
passthru = {
54
+
shellPath = "/bin/xonsh2";
55
+
};
56
+
}
+13
nixos/5pkgs/yt-next/default.nix
+13
nixos/5pkgs/yt-next/default.nix
+155
nixos/machines/aergia/config.nix
+155
nixos/machines/aergia/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
../../default.nix
6
+
7
+
../../2configs/retiolum.nix
8
+
../../2configs/exim-retiolum.nix
9
+
../../2configs/baseX.nix
10
+
../../2configs/pipewire.nix
11
+
../../2configs/browsers.nix
12
+
../../2configs/programs.nix
13
+
../../2configs/network-manager.nix
14
+
../../2configs/syncthing.nix
15
+
../../2configs/sync/sync.nix
16
+
../../2configs/games.nix
17
+
../../2configs/steam.nix
18
+
../../2configs/wine.nix
19
+
../../2configs/fetchWallpaper.nix
20
+
../../2configs/yellow-mounts/samba.nix
21
+
../../2configs/pass.nix
22
+
../../2configs/mail.nix
23
+
../../2configs/bitcoin.nix
24
+
../../2configs/review.nix
25
+
../../2configs/dunst.nix
26
+
../../2configs/print.nix
27
+
../../2configs/br.nix
28
+
# ../../2configs/c-base.nix
29
+
{ # autorandrs
30
+
services.autorandr = {
31
+
enable = true;
32
+
hooks.postswitch.reset_usb = ''
33
+
echo 0 > /sys/bus/usb/devices/usb9/authorized; echo 1 > /sys/bus/usb/devices/usb9/authorized
34
+
${pkgs.xorg.xmodmap}/bin/xmodmap -e 'keycode 96 = F12 Insert F12 F12' # rebind shift + F12 to shift + insert
35
+
'';
36
+
profiles = {
37
+
default = {
38
+
fingerprint = {
39
+
eDP = "00ffffffffffff00288931000100000016200104805932780a0dc9a05747982712484c0000000101010101010101010101010101010108700088a1401360c820a300d9870000001ead4a0088a1401360c820a30020c23100001e000000fd0016480f5a1e000a202020202020000000fc0047504431303031480a2020202000cf";
40
+
};
41
+
config = {
42
+
eDP = {
43
+
enable = true;
44
+
primary = true;
45
+
position = "0x0";
46
+
mode = "2560x1600";
47
+
rate = "60.01";
48
+
transform = [
49
+
[ 0.750000 0.000000 0.000000 ]
50
+
[ 0.000000 0.750000 0.000000 ]
51
+
[ 0.000000 0.000000 1.000000 ]
52
+
];
53
+
# scale = {
54
+
# x = 0.599991;
55
+
# y = 0.599991;
56
+
# };
57
+
};
58
+
};
59
+
};
60
+
docked2 = {
61
+
fingerprint = {
62
+
eDP = config.services.autorandr.profiles.default.fingerprint.eDP;
63
+
DisplayPort-8 = "00ffffffffffff0010ac39d14c3346300f200104b5462878fb26f5af4f46a5240f5054a54b00714f8140818081c081009500b300d1c0565e00a0a0a0295030203500b9882100001a000000ff00444342375847330a2020202020000000fc0044454c4c204733323233440a20000000fd0030a5fafa41010a2020202020200181020332f149030212110490131f3f2309070783010000e200eae305c000e606050162622c6d1a0000020b30a50007622c622c5a8780a070384d4030203500b9882100001af4fb0050a0a0285008206800b9882100001a40e7006aa0a0675008209804b9882100001a6fc200a0a0a0555030203500b9882100001a000000000009";
64
+
DisplayPort-7 = "00ffffffffffff0020a32f00010000000c190103807341780acf74a3574cb02309484c21080081c0814081800101010101010101010104740030f2705a80b0588a00501d7400001e023a801871382d40582c4500501d7400001e000000fc00484953454e53450a2020202020000000fd00324b0f451e000a2020202020200172020333714f5f5e5d01020400101113001f2021222909070715075057070083010000e200f96d030c002000183c200060010203662150b051001b304070360056005300001e011d8018711c1620582c2500c48e2100009e011d007251d01e206e285500c48e2100001800000000000000000000000000000000000000000000ea";
65
+
};
66
+
config = {
67
+
DisplayPort-7 = {
68
+
enable = true;
69
+
position = "2560x0";
70
+
mode = "1920x1080";
71
+
rate = "60.00";
72
+
};
73
+
DisplayPort-8 = config.services.autorandr.profiles.docked1.config.DisplayPort-1;
74
+
eDP = config.services.autorandr.profiles.docked1.config.eDP;
75
+
};
76
+
};
77
+
docked1 = {
78
+
fingerprint = {
79
+
eDP = config.services.autorandr.profiles.default.fingerprint.eDP;
80
+
DisplayPort-1 = "00ffffffffffff0010ac39d14c3346300f200104b5462878fb26f5af4f46a5240f5054a54b00714f8140818081c081009500b300d1c0565e00a0a0a0295030203500b9882100001a000000ff00444342375847330a2020202020000000fc0044454c4c204733323233440a20000000fd0030a5fafa41010a2020202020200181020332f149030212110490131f3f2309070783010000e200eae305c000e606050162622c6d1a0000020b30a50007622c622c000000000000000000000000000000000000f4fb0050a0a0285008206800b9882100001a40e7006aa0a0675008209804b9882100001a6fc200a0a0a0555030203500b9882100001a000000000040";
81
+
};
82
+
config = {
83
+
DisplayPort-1 = {
84
+
enable = true;
85
+
primary = true;
86
+
position = "0x0";
87
+
mode = "2560x1440";
88
+
rate = "165.08";
89
+
};
90
+
eDP = config.services.autorandr.profiles.default.config.eDP // {
91
+
primary = false;
92
+
position = "640x1440";
93
+
};
94
+
};
95
+
};
96
+
docked1_hack = {
97
+
fingerprint = {
98
+
eDP = config.services.autorandr.profiles.default.fingerprint.eDP;
99
+
HDMI-A-0 = "00ffffffffffff0010ac31d14c3346300f20010380462878ea26f5af4f46a5240f5054a54b00714f8140818081c081009500b300d1c0565e00a0a0a0295030203500b9882100001a000000ff00444342375847330a2020202020000000fc0044454c4c204733323233440a20000000fd0030901ee63c000a20202020202001db020346f14d030212110113042f141f05103f2309070783010000e200ea67030c001000383c67d85dc4017888006d1a0000020b3090e607622c622ce305c000e606050162622c40e7006aa0a0675008209804b9882100001a6fc200a0a0a05550302035001d4e3100001a000000000000000000000000000000000000000000fc";
100
+
};
101
+
config = {
102
+
HDMI-A-0 = {
103
+
enable = true;
104
+
primary = true;
105
+
position = "0x0";
106
+
mode = "2560x1440";
107
+
rate = "165.08";
108
+
};
109
+
eDP = config.services.autorandr.profiles.default.config.eDP // {
110
+
primary = false;
111
+
position = "640x1440";
112
+
};
113
+
};
114
+
};
115
+
};
116
+
};
117
+
}
118
+
];
119
+
120
+
system.stateVersion = "22.11";
121
+
122
+
krebs.build.host = config.krebs.hosts.aergia;
123
+
124
+
environment.systemPackages = with pkgs; [
125
+
brain
126
+
bank
127
+
l-gen-secrets
128
+
generate-secrets
129
+
nixpkgs-review
130
+
pipenv
131
+
];
132
+
133
+
programs.adb.enable = true;
134
+
135
+
hardware.bluetooth = {
136
+
enable = true;
137
+
powerOnBoot = true;
138
+
};
139
+
hardware.pulseaudio.package = pkgs.pulseaudioFull;
140
+
141
+
nix.trustedUsers = [ "root" "lass" ];
142
+
143
+
services.tor = {
144
+
enable = true;
145
+
client.enable = true;
146
+
};
147
+
148
+
documentation.nixos.enable = true;
149
+
boot.binfmt.emulatedSystems = [
150
+
"aarch64-linux"
151
+
];
152
+
153
+
boot.cleanTmpDir = true;
154
+
programs.noisetorch.enable = true;
155
+
}
+66
nixos/machines/aergia/disk.nix
+66
nixos/machines/aergia/disk.nix
···
1
+
{ self, ... }:
2
+
{
3
+
imports = [
4
+
self.inputs.disko.nixosModules.disko
5
+
];
6
+
disko.devices.disk = {
7
+
main = {
8
+
type = "disk";
9
+
device = "/dev/nvme0n1";
10
+
content = {
11
+
type = "table";
12
+
format = "gpt";
13
+
partitions = [
14
+
{
15
+
name = "boot";
16
+
start = "0";
17
+
end = "1M";
18
+
part-type = "primary";
19
+
flags = ["bios_grub"];
20
+
}
21
+
{
22
+
name = "ESP";
23
+
start = "1MiB";
24
+
end = "1GiB";
25
+
fs-type = "fat32";
26
+
bootable = true;
27
+
content = {
28
+
type = "filesystem";
29
+
format = "vfat";
30
+
mountpoint = "/boot";
31
+
};
32
+
}
33
+
{
34
+
name = "root";
35
+
start = "1GiB";
36
+
end = "100%";
37
+
content = {
38
+
type = "luks";
39
+
name = "aergia1";
40
+
content = {
41
+
type = "btrfs";
42
+
extraArgs = "-f"; # Override existing partition
43
+
subvolumes = {
44
+
# Subvolume name is different from mountpoint
45
+
"/rootfs" = {
46
+
mountpoint = "/";
47
+
};
48
+
# Mountpoints inferred from subvolume name
49
+
"/home" = {
50
+
mountOptions = [];
51
+
mountpoint = "/home";
52
+
};
53
+
"/nix" = {
54
+
mountOptions = [];
55
+
mountpoint = "/nix";
56
+
};
57
+
};
58
+
};
59
+
};
60
+
}
61
+
];
62
+
};
63
+
};
64
+
};
65
+
}
66
+
+117
nixos/machines/aergia/physical.nix
+117
nixos/machines/aergia/physical.nix
···
1
+
{ config, lib, pkgs, modulesPath, ... }:
2
+
{
3
+
imports = [
4
+
./config.nix
5
+
(modulesPath + "/installer/scan/not-detected.nix")
6
+
../../2configs/antimicrox
7
+
./disk.nix
8
+
];
9
+
10
+
networking.hostId = "deadbeef";
11
+
# boot.loader.efi.canTouchEfiVariables = true;
12
+
boot.loader.grub = {
13
+
enable = true;
14
+
device = "/dev/nvme0n1";
15
+
efiSupport = true;
16
+
efiInstallAsRemovable = true;
17
+
};
18
+
19
+
# boot.kernelPackages = pkgs.linuxPackages_latest;
20
+
21
+
boot.kernelParams = [
22
+
# use less power with pstate
23
+
"amd_pstate=passive"
24
+
25
+
# suspend
26
+
"resume_offset=178345675"
27
+
];
28
+
29
+
boot.kernelModules = [
30
+
# Enables the amd cpu scaling https://www.kernel.org/doc/html/latest/admin-guide/pm/amd-pstate.html
31
+
# On recent AMD CPUs this can be more energy efficient.
32
+
"amd-pstate"
33
+
"kvm-amd"
34
+
];
35
+
36
+
# hardware.cpu.amd.updateMicrocode = true;
37
+
38
+
services.xserver.videoDrivers = [
39
+
"amdgpu"
40
+
];
41
+
42
+
boot.initrd.availableKernelModules = [
43
+
"nvme"
44
+
"thunderbolt"
45
+
"xhci_pci"
46
+
"usbhid"
47
+
];
48
+
49
+
boot.initrd.kernelModules = [
50
+
"amdgpu"
51
+
];
52
+
53
+
environment.systemPackages = [
54
+
pkgs.vulkan-tools
55
+
(pkgs.writers.writeDashBin "set_tdp" ''
56
+
set -efux
57
+
watt=$1
58
+
value=$(( $watt * 1000 ))
59
+
${pkgs.ryzenadj}/bin/ryzenadj --stapm-limit="$value" --fast-limit="$value" --slow-limit="$value"
60
+
'')
61
+
];
62
+
63
+
# corectrl
64
+
programs.corectrl = {
65
+
enable = true;
66
+
gpuOverclock = {
67
+
enable = true;
68
+
ppfeaturemask = "0xffffffff";
69
+
};
70
+
};
71
+
users.users.mainUser.extraGroups = [ "corectrl" ];
72
+
73
+
# keyboard quirks
74
+
services.xserver.displayManager.sessionCommands = ''
75
+
${pkgs.xorg.xmodmap}/bin/xmodmap -e 'keycode 96 = F12 Insert F12 F12' # rebind shift + F12 to shift + insert
76
+
'';
77
+
services.udev.extraHwdb = /* sh */ ''
78
+
# disable back buttons
79
+
evdev:input:b0003v2F24p0135* # /dev/input/event2
80
+
KEYBOARD_KEY_70026=reserved
81
+
KEYBOARD_KEY_70027=reserved
82
+
'';
83
+
84
+
# update cpu microcode
85
+
hardware.cpu.amd.updateMicrocode = true;
86
+
87
+
hardware.opengl.enable = true;
88
+
hardware.opengl.extraPackages = [
89
+
pkgs.amdvlk
90
+
pkgs.rocm-opencl-icd
91
+
pkgs.rocm-opencl-runtime
92
+
];
93
+
94
+
# suspend to disk
95
+
swapDevices = [{
96
+
device = "/swapfile";
97
+
}];
98
+
boot.resumeDevice = "/dev/mapper/aergia1";
99
+
services.logind.lidSwitch = "suspend-then-hibernate";
100
+
services.logind.extraConfig = ''
101
+
HandlePowerKey=hibernate
102
+
'';
103
+
# systemd.sleep.extraConfig = ''
104
+
# HibernateDelaySec=1800
105
+
# '';
106
+
107
+
# firefox touchscreen support
108
+
environment.sessionVariables.MOZ_USE_XINPUT2 = "1";
109
+
110
+
# enable thunderbolt
111
+
services.hardware.bolt.enable = true;
112
+
113
+
# reinit usb after docking station connect
114
+
services.udev.extraRules = ''
115
+
SUBSYSTEM=="drm", ACTION=="change", RUN+="${pkgs.dash}/bin/dash -c 'echo 0 > /sys/bus/usb/devices/usb9/authorized; echo 1 > /sys/bus/usb/devices/usb9/authorized'"
116
+
'';
117
+
}
+21
nixos/machines/blue/config.nix
+21
nixos/machines/blue/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
../../
5
+
../../2configs
6
+
../../2configs/retiolum.nix
7
+
../../2configs/exim-retiolum.nix
8
+
9
+
../../2configs/blue.nix
10
+
../../2configs/syncthing.nix
11
+
../../2configs/sync/sync.nix
12
+
../../2configs/sync/decsync.nix
13
+
];
14
+
15
+
krebs.build.host = config.krebs.hosts.blue;
16
+
17
+
networking.nameservers = [ "1.1.1.1" ];
18
+
19
+
time.timeZone = "Europe/Berlin";
20
+
users.users.mainUser.openssh.authorizedKeys.keys = [ config.krebs.users.lass-android.pubkey ];
21
+
}
+7
nixos/machines/blue/physical.nix
+7
nixos/machines/blue/physical.nix
+17
nixos/machines/blue/source.nix
+17
nixos/machines/blue/source.nix
···
1
+
{ lib, pkgs, test, ... }:
2
+
if test then {} else {
3
+
nixpkgs = lib.mkIf (! test) (lib.mkForce {
4
+
file = {
5
+
path = toString (pkgs.fetchFromGitHub {
6
+
owner = "nixos";
7
+
repo = "nixpkgs";
8
+
rev = (lib.importJSON ../../../krebs/nixpkgs.json).rev;
9
+
sha256 = (lib.importJSON ../../../krebs/nixpkgs.json).sha256;
10
+
});
11
+
useChecksum = true;
12
+
};
13
+
});
14
+
nixpkgs-unstable = lib.mkForce {
15
+
file.path = "/var/empty";
16
+
};
17
+
}
+63
nixos/machines/coaxmetal/config.nix
+63
nixos/machines/coaxmetal/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
<stockholm/lass>
6
+
7
+
<stockholm/lass/2configs/retiolum.nix>
8
+
<stockholm/lass/2configs/exim-retiolum.nix>
9
+
<stockholm/lass/2configs/baseX.nix>
10
+
<stockholm/lass/2configs/browsers.nix>
11
+
<stockholm/lass/2configs/programs.nix>
12
+
<stockholm/lass/2configs/network-manager.nix>
13
+
<stockholm/lass/2configs/syncthing.nix>
14
+
<stockholm/lass/2configs/sync/sync.nix>
15
+
<stockholm/lass/2configs/games.nix>
16
+
<stockholm/lass/2configs/steam.nix>
17
+
<stockholm/lass/2configs/wine.nix>
18
+
<stockholm/lass/2configs/fetchWallpaper.nix>
19
+
<stockholm/lass/2configs/yellow-mounts/samba.nix>
20
+
<stockholm/lass/2configs/pass.nix>
21
+
<stockholm/lass/2configs/mail.nix>
22
+
<stockholm/lass/2configs/bitcoin.nix>
23
+
<stockholm/lass/2configs/review.nix>
24
+
<stockholm/lass/2configs/dunst.nix>
25
+
# <stockholm/krebs/2configs/ircd.nix>
26
+
];
27
+
28
+
krebs.build.host = config.krebs.hosts.coaxmetal;
29
+
30
+
environment.systemPackages = with pkgs; [
31
+
brain
32
+
bank
33
+
l-gen-secrets
34
+
(pkgs.writeDashBin "deploy" ''
35
+
set -eu
36
+
export SYSTEM="$1"
37
+
$(nix-build $HOME/sync/stockholm/lass/krops.nix --no-out-link --argstr name "$SYSTEM" -A deploy)
38
+
'')
39
+
(pkgs.writeDashBin "usb-tether-on" ''
40
+
adb shell su -c service call connectivity 33 i32 1 s16 text
41
+
'')
42
+
(pkgs.writeDashBin "usb-tether-off" ''
43
+
adb shell su -c service call connectivity 33 i32 0 s16 text
44
+
'')
45
+
];
46
+
47
+
programs.adb.enable = true;
48
+
49
+
hardware.bluetooth = {
50
+
enable = true;
51
+
powerOnBoot = true;
52
+
};
53
+
hardware.pulseaudio.package = pkgs.pulseaudioFull;
54
+
55
+
nix.trustedUsers = [ "root" "lass" ];
56
+
57
+
services.tor = {
58
+
enable = true;
59
+
client.enable = true;
60
+
};
61
+
62
+
documentation.nixos.enable = true;
63
+
}
+59
nixos/machines/coaxmetal/physical.nix
+59
nixos/machines/coaxmetal/physical.nix
···
1
+
{ config, lib, pkgs, modulesPath, ... }:
2
+
{
3
+
imports = [
4
+
./config.nix
5
+
(modulesPath + "/installer/scan/not-detected.nix")
6
+
];
7
+
8
+
networking.hostId = "e0c335ea";
9
+
boot.zfs.requestEncryptionCredentials = true;
10
+
boot.zfs.enableUnstable = true;
11
+
boot.loader.efi.canTouchEfiVariables = true;
12
+
boot.loader.grub = {
13
+
enable = true;
14
+
# device = "/dev/disk/by-id/nvme-WDC_PC_SN730_SDBQNTY-1T00-1001_205349800040";
15
+
device = "nodev";
16
+
efiSupport = true;
17
+
# efiInstallAsRemovable = true;
18
+
};
19
+
20
+
services.xserver.videoDrivers = [
21
+
"amdgpu"
22
+
];
23
+
24
+
hardware.opengl.extraPackages = [ pkgs.amdvlk ];
25
+
environment.variables.VK_ICD_FILENAMES =
26
+
"/run/opengl-driver/share/vulkan/icd.d/amd_icd64.json";
27
+
28
+
boot.initrd.availableKernelModules = [ "nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
29
+
boot.kernelModules = [ "kvm-amd" ];
30
+
31
+
fileSystems."/" = {
32
+
device = "zpool/root/root";
33
+
fsType = "zfs";
34
+
};
35
+
36
+
fileSystems."/home" = {
37
+
device = "zpool/root/home";
38
+
fsType = "zfs";
39
+
};
40
+
41
+
fileSystems."/boot" = {
42
+
device = "/dev/disk/by-uuid/50A7-1889";
43
+
fsType = "vfat";
44
+
};
45
+
46
+
services.logind.lidSwitch = "ignore";
47
+
services.logind.lidSwitchDocked = "ignore";
48
+
49
+
# Mouse stuff
50
+
services.xserver.libinput.enable = lib.mkForce false;
51
+
services.xserver.synaptics.enable = true;
52
+
53
+
services.xserver.displayManager.sessionCommands = ''
54
+
xinput disable 'ETPS/2 Elantech Touchpad'
55
+
xinput set-prop 'ETPS/2 Elantech TrackPoint' 'Evdev Wheel Emulation' 1
56
+
xinput set-prop 'ETPS/2 Elantech TrackPoint' 'Evdev Wheel Emulation Button' 2
57
+
xinput set-prop 'ETPS/2 Elantech TrackPoint' 'Evdev Wheel Emulation Axes' 6 7 4 5
58
+
'';
59
+
}
+21
nixos/machines/coaxmetal/source.nix
+21
nixos/machines/coaxmetal/source.nix
···
1
+
{ lib, pkgs, test, ... }: let
2
+
npkgs = lib.importJSON ../../../krebs/nixpkgs-unstable.json;
3
+
in {
4
+
nixpkgs = (if test then lib.mkForce ({ derivation = let
5
+
rev = npkgs.rev;
6
+
sha256 = npkgs.sha256;
7
+
in ''
8
+
with import (builtins.fetchTarball {
9
+
url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
10
+
sha256 = "${sha256}";
11
+
}) {};
12
+
pkgs.fetchFromGitHub {
13
+
owner = "nixos";
14
+
repo = "nixpkgs";
15
+
rev = "${rev}";
16
+
sha256 = "${sha256}";
17
+
}
18
+
''; }) else {
19
+
git.ref = lib.mkForce npkgs.rev;
20
+
});
21
+
}
+113
nixos/machines/daedalus/config.nix
+113
nixos/machines/daedalus/config.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
../../
6
+
7
+
../../2configs/retiolum.nix
8
+
../../2configs/pipewire.nix
9
+
{
10
+
# bubsy config
11
+
users.users.bubsy = {
12
+
uid = genid "bubsy";
13
+
home = "/home/bubsy";
14
+
group = "users";
15
+
createHome = true;
16
+
extraGroups = [
17
+
"audio"
18
+
"networkmanager"
19
+
"pipewire"
20
+
# "plugdev"
21
+
];
22
+
useDefaultShell = true;
23
+
isNormalUser = true;
24
+
};
25
+
networking.networkmanager.enable = true;
26
+
networking.wireless.enable = mkForce false;
27
+
# programs.chromium = {
28
+
# enable = true;
29
+
# extensions = [
30
+
# "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin
31
+
# ];
32
+
# };
33
+
environment.systemPackages = with pkgs; [
34
+
ark
35
+
pavucontrol
36
+
#firefox
37
+
chromium
38
+
hexchat
39
+
networkmanagerapplet
40
+
libreoffice
41
+
audacity
42
+
zathura
43
+
skypeforlinux
44
+
wine
45
+
geeqie
46
+
vlc
47
+
zsnes
48
+
telegram-desktop
49
+
];
50
+
# services.udev.packages = [ pkgs.ledger-udev-rules ];
51
+
nixpkgs.config.firefox.enableAdobeFlash = true;
52
+
services.xserver.enable = true;
53
+
services.xserver.displayManager.lightdm.enable = true;
54
+
services.xserver.desktopManager.plasma5.enable = true;
55
+
services.tlp.enable = lib.mkForce false;
56
+
services.xserver.layout = "de";
57
+
}
58
+
{
59
+
users = {
60
+
groups.plugdev = {};
61
+
users = {
62
+
bitcoin = {
63
+
name = "bitcoin";
64
+
description = "user for bitcoin stuff";
65
+
home = "/home/bitcoin";
66
+
isNormalUser = true;
67
+
useDefaultShell = true;
68
+
createHome = true;
69
+
extraGroups = [
70
+
"audio"
71
+
"networkmanager"
72
+
"plugdev"
73
+
];
74
+
packages = [
75
+
pkgs.electrum
76
+
pkgs.electron-cash
77
+
pkgs.ledger-live-desktop
78
+
];
79
+
};
80
+
};
81
+
};
82
+
hardware.ledger.enable = true;
83
+
security.sudo.extraConfig = ''
84
+
bubsy ALL=(bitcoin) NOPASSWD: ALL
85
+
'';
86
+
}
87
+
{
88
+
#remote control
89
+
environment.systemPackages = with pkgs; [
90
+
x11vnc
91
+
# torbrowser
92
+
];
93
+
krebs.iptables.tables.filter.INPUT.rules = [
94
+
{ predicate = "-p tcp -i retiolum --dport 5900"; target = "ACCEPT"; }
95
+
];
96
+
}
97
+
];
98
+
99
+
time.timeZone = "Europe/Berlin";
100
+
101
+
hardware.trackpoint = {
102
+
enable = true;
103
+
sensitivity = 220;
104
+
speed = 0;
105
+
emulateWheel = true;
106
+
};
107
+
108
+
services.logind.extraConfig = ''
109
+
HandleLidSwitch=ignore
110
+
'';
111
+
112
+
krebs.build.host = config.krebs.hosts.daedalus;
113
+
}
+24
nixos/machines/daedalus/physical.nix
+24
nixos/machines/daedalus/physical.nix
···
1
+
{
2
+
imports = [
3
+
./config.nix
4
+
<stockholm/lass/2configs/hw/x220.nix>
5
+
<stockholm/lass/2configs/boot/coreboot.nix>
6
+
];
7
+
8
+
fileSystems = {
9
+
"/bku" = {
10
+
device = "/dev/mapper/pool-bku";
11
+
fsType = "btrfs";
12
+
options = ["defaults" "noatime" "ssd" "compress=lzo"];
13
+
};
14
+
"/backups" = {
15
+
device = "/dev/pool/backup";
16
+
fsType = "ext4";
17
+
};
18
+
};
19
+
20
+
services.udev.extraRules = ''
21
+
SUBSYSTEM=="net", ATTR{address}=="08:11:96:0a:5d:6c", NAME="wl0"
22
+
SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:71:cb:35", NAME="et0"
23
+
'';
24
+
}
+13
nixos/machines/dishfire/config.nix
+13
nixos/machines/dishfire/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
<stockholm/lass>
6
+
<stockholm/lass/2configs/retiolum.nix>
7
+
<stockholm/lass/2configs/monitoring/prometheus.nix>
8
+
<stockholm/lass/2configs/monitoring/telegraf.nix>
9
+
<stockholm/lass/2configs/consul.nix>
10
+
];
11
+
12
+
krebs.build.host = config.krebs.hosts.dishfire;
13
+
}
+21
nixos/machines/dishfire/physical.nix
+21
nixos/machines/dishfire/physical.nix
···
1
+
{ config, lib, pkgs, modulesPath, ... }:
2
+
3
+
{
4
+
imports = [
5
+
./config.nix
6
+
(modulesPath + "/profiles/qemu-guest.nix")
7
+
];
8
+
9
+
boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "xhci_pci" "sd_mod" "sr_mod" ];
10
+
boot.initrd.kernelModules = [ ];
11
+
boot.kernelModules = [ ];
12
+
boot.extraModulePackages = [ ];
13
+
boot.loader.grub.devices = [ "/dev/sda" ];
14
+
15
+
fileSystems."/" =
16
+
{ device = "/dev/disk/by-uuid/84053adc-49bc-4e02-8a19-3838bf3a43fd";
17
+
fsType = "ext4";
18
+
};
19
+
20
+
swapDevices = [ ];
21
+
}
+17
nixos/machines/echelon/config.nix
+17
nixos/machines/echelon/config.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
<stockholm/lass>
5
+
6
+
<stockholm/lass/2configs/retiolum.nix>
7
+
<stockholm/lass/2configs/tor-initrd.nix>
8
+
<stockholm/lass/2configs/syncthing.nix>
9
+
<stockholm/lass/2configs/green-host.nix>
10
+
];
11
+
12
+
krebs.build.host = config.krebs.hosts.echelon;
13
+
14
+
boot.tmpOnTmpfs = true;
15
+
16
+
}
17
+
+33
nixos/machines/echelon/physical.nix
+33
nixos/machines/echelon/physical.nix
···
1
+
{ config, lib, pkgs, modulesPath, ... }:
2
+
{
3
+
imports = [
4
+
./config.nix
5
+
(modulesPath + "/profiles/qemu-guest.nix")
6
+
];
7
+
8
+
# Use the GRUB 2 boot loader.
9
+
boot.loader.grub.enable = true;
10
+
boot.loader.grub.version = 2;
11
+
boot.loader.grub.efiSupport = true;
12
+
boot.loader.grub.efiInstallAsRemovable = true;
13
+
# Define on which hard drive you want to install Grub.
14
+
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
15
+
16
+
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
17
+
boot.initrd.kernelModules = [ "dm-snapshot" ];
18
+
boot.initrd.luks.devices.luksroot.device = "/dev/sda3";
19
+
20
+
networking.useDHCP = false;
21
+
networking.interfaces.ens18.useDHCP = true;
22
+
23
+
fileSystems."/" = {
24
+
device = "/dev/disk/by-uuid/5186edb1-9234-48ae-8679-61facb56b818";
25
+
fsType = "xfs";
26
+
};
27
+
28
+
fileSystems."/boot" = {
29
+
device = "/dev/disk/by-uuid/56D1-34A0";
30
+
fsType = "vfat";
31
+
};
32
+
33
+
}
+74
nixos/machines/green/config.nix
+74
nixos/machines/green/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
../../
5
+
../../2configs
6
+
../../2configs/retiolum.nix
7
+
../../2configs/exim-retiolum.nix
8
+
../../2configs/mail.nix
9
+
10
+
../../2configs/syncthing.nix
11
+
../../2configs/sync/sync.nix
12
+
../../2configs/sync/decsync.nix
13
+
14
+
../../2configs/weechat.nix
15
+
../../2configs/bitlbee.nix
16
+
17
+
../../2configs/pass.nix
18
+
19
+
../../2configs/git-brain.nix
20
+
../../2configs/et-server.nix
21
+
../../2configs/consul.nix
22
+
23
+
../../2configs/atuin-server.nix
24
+
];
25
+
26
+
krebs.build.host = config.krebs.hosts.green;
27
+
28
+
krebs.sync-containers3.inContainer = {
29
+
enable = true;
30
+
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFlUMf943qEQG64ob81p6dgoHq4jUjq7tSvmSdEOEU2y";
31
+
};
32
+
33
+
systemd.tmpfiles.rules = [
34
+
"d /home/lass/.local/share 0700 lass users -"
35
+
"d /home/lass/.local 0700 lass users -"
36
+
"d /home/lass/.config 0700 lass users -"
37
+
38
+
"d /var/state/lass_mail 0700 lass users -"
39
+
"L+ /home/lass/Maildir - - - - ../../var/state/lass_mail"
40
+
41
+
"d /var/state/lass_ssh 0700 lass users -"
42
+
"L+ /home/lass/.ssh - - - - ../../var/state/lass_ssh"
43
+
"d /var/state/lass_gpg 0700 lass users -"
44
+
"L+ /home/lass/.gnupg - - - - ../../var/state/lass_gpg"
45
+
"d /var/state/lass_sync 0700 lass users -"
46
+
"L+ /home/lass/sync - - - - ../../var/state/lass_sync"
47
+
48
+
"d /var/state/git 0700 git nogroup -"
49
+
"L+ /var/lib/git - - - - ../../var/state/git"
50
+
];
51
+
52
+
users.users.mainUser.openssh.authorizedKeys.keys = [
53
+
config.krebs.users.lass-android.pubkey
54
+
config.krebs.users.lass-tablet.pubkey
55
+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKgpZwye6yavIs3gUIYvSi70spDa0apL2yHR0ASW74z8" # weechat ssh tunnel
56
+
];
57
+
58
+
krebs.iptables.tables.nat.PREROUTING.rules = [
59
+
{ predicate = "-i eth0 -p tcp -m tcp --dport 22"; target = "ACCEPT"; }
60
+
];
61
+
62
+
# workaround for ssh access from yubikey via android
63
+
services.openssh.extraConfig = ''
64
+
HostKeyAlgorithms +ssh-rsa
65
+
PubkeyAcceptedAlgorithms +ssh-rsa
66
+
'';
67
+
68
+
services.dovecot2 = {
69
+
enable = true;
70
+
mailLocation = "maildir:~/Maildir";
71
+
};
72
+
73
+
networking.firewall.allowedTCPPorts = [ 143 ];
74
+
}
+7
nixos/machines/green/physical.nix
+7
nixos/machines/green/physical.nix
+6
nixos/machines/green/source.nix
+6
nixos/machines/green/source.nix
+39
nixos/machines/hilum/config.nix
+39
nixos/machines/hilum/config.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
<stockholm/lass>
5
+
6
+
<stockholm/lass/2configs/retiolum.nix>
7
+
# <stockholm/lass/2configs/baseX.nix>
8
+
# <stockholm/lass/2configs/pipewire.nix>
9
+
# <stockholm/lass/2configs/browsers.nix>
10
+
# <stockholm/lass/2configs/programs.nix>
11
+
<stockholm/lass/2configs/network-manager.nix>
12
+
# <stockholm/lass/2configs/mail.nix>
13
+
<stockholm/lass/2configs/syncthing.nix>
14
+
# <stockholm/lass/2configs/nfs-dl.nix>
15
+
];
16
+
17
+
krebs.build.host = config.krebs.hosts.hilum;
18
+
19
+
boot.loader.grub = {
20
+
extraEntries = ''
21
+
submenu isos {
22
+
source /grub/autoiso.cfg
23
+
}
24
+
'';
25
+
extraFiles."/grub/autoiso.cfg" = (pkgs.stdenv.mkDerivation {
26
+
name = "autoiso.cfg";
27
+
src = pkgs.grub2.src;
28
+
phases = [ "unpackPhase" "installPhase" ];
29
+
installPhase = ''
30
+
cp docs/autoiso.cfg $out
31
+
'';
32
+
});
33
+
};
34
+
35
+
services.logind.lidSwitch = "ignore";
36
+
services.logind.lidSwitchDocked = "ignore";
37
+
38
+
boot.tmpOnTmpfs = true;
39
+
}
+43
nixos/machines/hilum/disk.nix
+43
nixos/machines/hilum/disk.nix
···
1
+
{ lib, disk, keyFile, ... }:
2
+
{
3
+
disk = {
4
+
main = {
5
+
type = "disk";
6
+
device = disk;
7
+
content = {
8
+
type = "table";
9
+
format = "gpt";
10
+
partitions = [
11
+
{
12
+
name = "boot";
13
+
start = "0";
14
+
end = "1M";
15
+
flags = ["bios_grub"];
16
+
}
17
+
{
18
+
name = "ESP";
19
+
start = "1M";
20
+
end = "50%";
21
+
bootable = true;
22
+
content = {
23
+
type = "filesystem";
24
+
format = "vfat";
25
+
mountpoint = "/boot";
26
+
};
27
+
}
28
+
{
29
+
name = "root";
30
+
start = "50%";
31
+
end = "100%";
32
+
content = {
33
+
type = "filesystem";
34
+
format = "ext4";
35
+
mountpoint = "/";
36
+
};
37
+
}
38
+
];
39
+
};
40
+
};
41
+
};
42
+
}
43
+
+43
nixos/machines/hilum/flash-stick.sh
+43
nixos/machines/hilum/flash-stick.sh
···
1
+
#!/bin/sh
2
+
set -efux
3
+
4
+
disk=$1
5
+
6
+
cd "$(dirname "$0")"
7
+
export NIXPKGS_ALLOW_UNFREE=1
8
+
(umask 077; pass show admin/hilum/luks > /tmp/hilum.luks)
9
+
trap 'rm -f /tmp/hilum.luks' EXIT
10
+
echo "$disk" > /tmp/hilum-disk
11
+
trap 'rm -f /tmp/hilum-disk' EXIT
12
+
13
+
stockholm_root=$(git rev-parse --show-toplevel)
14
+
ssh root@localhost -t -- $(nix-build \
15
+
--no-out-link \
16
+
-I nixpkgs=/var/src/nixpkgs \
17
+
-I stockholm="$stockholm_root" \
18
+
-I secrets="$stockholm_root"/lass/2configs/tests/dummy-secrets \
19
+
-E "with import <nixpkgs> {}; (pkgs.nixos [
20
+
{
21
+
luksPassFile = \"/tmp/hilum.luks\";
22
+
mainDisk = \"$disk\";
23
+
disko.rootMountPoint = \"/mnt/hilum\";
24
+
}
25
+
./physical.nix
26
+
]).disko"
27
+
)
28
+
rm -f /tmp/hilum.luks
29
+
$(nix-build \
30
+
--no-out-link \
31
+
-I nixpkgs=/var/src/nixpkgs \
32
+
"$stockholm_root"/lass/krops.nix -A populate \
33
+
--argstr name hilum \
34
+
--argstr target "root@localhost/mnt/hilum/var/src" \
35
+
--arg force true
36
+
)
37
+
ssh root@localhost << SSH
38
+
set -efux
39
+
mkdir -p /mnt/hilum/etc
40
+
NIXOS_CONFIG=/mnt/hilum/var/src/nixos-config nixos-install --no-bootloader --no-root-password --root /mnt/hilum -I /var/src
41
+
nixos-enter --root /mnt/hilum -- nixos-rebuild -I /var/src switch --install-bootloader
42
+
umount -Rv /mnt/hilum
43
+
SSH
+53
nixos/machines/hilum/physical.nix
+53
nixos/machines/hilum/physical.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
./config.nix
6
+
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
7
+
{
8
+
# nice hack to carry around state passed impurely at the beginning
9
+
options.mainDisk = let
10
+
tryFile = path: default:
11
+
if lib.elem (builtins.baseNameOf path) (lib.attrNames (builtins.readDir (builtins.dirOf path))) then
12
+
builtins.readFile path
13
+
else
14
+
default
15
+
;
16
+
in lib.mkOption {
17
+
type = lib.types.str;
18
+
default = tryFile "/etc/hilum-disk" (tryFile "/tmp/hilum-disk" "/dev/sdz");
19
+
};
20
+
config.environment.etc.hilum-disk.text = config.mainDisk;
21
+
}
22
+
{
23
+
options.luksPassFile = lib.mkOption {
24
+
type = lib.types.nullOr lib.types.str;
25
+
default = null;
26
+
};
27
+
}
28
+
];
29
+
30
+
disko.devices = import ./disk.nix {
31
+
inherit lib;
32
+
disk = config.mainDisk;
33
+
keyFile = config.luksPassFile;
34
+
};
35
+
36
+
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
37
+
boot.initrd.kernelModules = [ "dm-snapshot" ];
38
+
boot.kernelModules = [ "kvm-intel" ];
39
+
boot.extraModulePackages = [ ];
40
+
41
+
boot.loader.grub.enable = true;
42
+
boot.loader.grub.efiSupport = true;
43
+
boot.loader.grub.device = config.mainDisk;
44
+
boot.loader.grub.efiInstallAsRemovable = true;
45
+
46
+
swapDevices = [ ];
47
+
48
+
nix.maxJobs = lib.mkDefault 4;
49
+
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
50
+
51
+
#weird bug with nixos-enter
52
+
services.logrotate.enable = false;
53
+
}
+223
nixos/machines/icarus/config.nix
+223
nixos/machines/icarus/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
../../
6
+
7
+
../../2configs/mouse.nix>
8
+
../../2configs/retiolum.nix>
9
+
../../2configs/git.nix>
10
+
../../2configs/exim-retiolum.nix>
11
+
../../2configs/baseX.nix>
12
+
../../2configs/pipewire.nix>
13
+
../../2configs/browsers.nix>
14
+
../../2configs/programs.nix>
15
+
../../2configs/fetchWallpaper.nix>
16
+
../../2configs/games.nix>
17
+
../../2configs/bitcoin.nix>
18
+
../../2configs/wine.nix>
19
+
../../2configs/network-manager.nix>
20
+
../../2configs/red-host.nix>
21
+
../../2configs/ipfs.nix>
22
+
../../2configs/snapclient.nix>
23
+
../../2configs/consul.nix>
24
+
{ # === logging playground ===
25
+
# --- client ---
26
+
27
+
# services.fluentd = {
28
+
# enable = true;
29
+
# config = ''
30
+
# '';
31
+
# };
32
+
33
+
# services.netdata = {
34
+
# enable = true;
35
+
# config = {
36
+
# global = {
37
+
# "debug log" = "syslog";
38
+
# "error log" = "syslog";
39
+
# };
40
+
41
+
# backend = {
42
+
# enabled = "yes";
43
+
# type = "opentsdb";
44
+
# destination = "tcp:localhost:4242";
45
+
# prefix = "netdata";
46
+
# hostname = config.networking.hostName;
47
+
# };
48
+
# # "exporting:global" = {
49
+
# # enabled = "yes";
50
+
# # "update every" = "60";
51
+
# # };
52
+
# # "graphite:icarus" = {
53
+
# # enabled = "yes";
54
+
# # destination = "localhost:8086";
55
+
# # "data source" = "average";
56
+
# # prefix = "netdata";
57
+
# # hostname = config.networking.hostName;
58
+
# # "send charts matching" = "*";
59
+
# # "send hosts matching" = "localhost *";
60
+
# # "send names instead of ids" = "yes";
61
+
# # };
62
+
# };
63
+
# };
64
+
65
+
# - metrics
66
+
services.telegraf = {
67
+
enable = true;
68
+
extraConfig = {
69
+
inputs = {
70
+
cpu = {};
71
+
mem = {};
72
+
net = {
73
+
ignore_protocol_stats = true;
74
+
};
75
+
exec = {
76
+
command = pkgs.writers.writePython3 "get_bat_stats" {} /* python */ ''
77
+
import json
78
+
import os
79
+
80
+
81
+
values_to_fetch = [
82
+
"capacity",
83
+
"energy_now",
84
+
"energy_full",
85
+
"energy_full_design",
86
+
"charge_now",
87
+
"charge_full",
88
+
"charge_full_design",
89
+
]
90
+
91
+
result = {}
92
+
for sup in os.listdir('/sys/class/power_supply'):
93
+
with open('/sys/class/power_supply/{}/type'.format(sup)) as f:
94
+
if f.read().strip() != "Battery":
95
+
continue
96
+
for val in values_to_fetch:
97
+
try:
98
+
with open('/sys/class/power_supply/{}/{}'.format(sup, val)) as f:
99
+
key = '{}_{}'.format(sup, val)
100
+
try:
101
+
result[key] = int(f.read().strip())
102
+
except ValueError:
103
+
result[key] = f.read().strip()
104
+
except: # noqa
105
+
pass
106
+
107
+
print(json.dumps(result))
108
+
'';
109
+
data_format = "json";
110
+
name_suffix = "_bat";
111
+
interval = "10s";
112
+
};
113
+
};
114
+
outputs = {
115
+
influxdb = { database = "telegraf"; urls = [ "http://localhost:8086" ]; };
116
+
};
117
+
};
118
+
};
119
+
120
+
# --- server ---
121
+
122
+
# - metrics
123
+
services.influxdb = {
124
+
enable = true;
125
+
extraConfig = {
126
+
opentsdb = [{
127
+
enabled = true;
128
+
bind-address = ":4242";
129
+
database = "opentsdb";
130
+
retention-policy = "";
131
+
132
+
batch-size = 1000;
133
+
batch-pending = 5;
134
+
batch-timeout = "1s";
135
+
}];
136
+
};
137
+
};
138
+
139
+
# - logs
140
+
services.graylog = {
141
+
enable = true;
142
+
passwordSecret = "AmjUYosI6hXKyI1MLEusupZy7srxQxZOowpHSmvF0ekMoi19go5qmnqd3po4VcQahdR1AKZ3Yk9tP6nLUbgmzLwQFodIc5g8";
143
+
rootPasswordSha2 = "cf80cd8aed482d5d1527d7dc72fceff84e6326592848447d2dc0b0e87dfc9a90"; # testing
144
+
elasticsearchHosts = [ "http://localhost:9200" ];
145
+
};
146
+
147
+
services.elasticsearch = {
148
+
enable = true;
149
+
};
150
+
# services.loki = {
151
+
# enable = true;
152
+
# configuration = {
153
+
# auth_enabled = false;
154
+
# server.http_listen_port = 3100;
155
+
# ingester = {
156
+
# lifecycler = {
157
+
# address = "127.0.0.1";
158
+
# ring = {
159
+
# kvstore.store = "inmemory";
160
+
# replication_factor = 1;
161
+
# };
162
+
# final_sleep = "0s";
163
+
# };
164
+
# };
165
+
# schema_config = {
166
+
# configs = [
167
+
# {
168
+
# from = "2018-04-15";
169
+
# store = "inmemory";
170
+
# object_store = "filesystem";
171
+
# schema = "v9";
172
+
# }
173
+
# ];
174
+
# };
175
+
# storage_config = {
176
+
# filesystem.directory = "/tmp/loki/chunks";
177
+
# };
178
+
# #table_manager = {
179
+
# # chunk_tables_provisioning = {
180
+
# # inactive_read_throughput = 0;
181
+
# # inactive_write_throughput = 0;
182
+
# # provisioned_read_throughput = 0;
183
+
# # provisioned_write_throughput = 0;
184
+
# # };
185
+
# # index_tables_provisioning = {
186
+
# # inactive_read_throughput = 0;
187
+
# # inactive_write_throughput = 0;
188
+
# # provisioned_read_throughput = 0;
189
+
# # provisioned_write_throughput = 0;
190
+
# # };
191
+
# # retention_deletes_enabled = false;
192
+
# # retention_period = 0;
193
+
# #};
194
+
# };
195
+
# };
196
+
197
+
services.grafana = {
198
+
enable = true;
199
+
addr = "0.0.0.0";
200
+
auth.anonymous.enable = true;
201
+
auth.anonymous.org_role = "Admin";
202
+
};
203
+
krebs.iptables.tables.filter.INPUT.rules = [
204
+
{ predicate = "-p tcp --dport 3000"; target = "ACCEPT"; } # grafana
205
+
];
206
+
}
207
+
];
208
+
209
+
krebs.build.host = config.krebs.hosts.icarus;
210
+
211
+
# services.xrdp = {
212
+
# enable = true;
213
+
# defaultWindowManager = "xmonad";
214
+
# };
215
+
# krebs.iptables.tables.filter.INPUT.rules = [
216
+
# { predicate = "-p tcp --dport 3389"; target = "ACCEPT"; } # xrdp
217
+
# ];
218
+
219
+
environment.systemPackages = [ pkgs.chromium ];
220
+
221
+
# users.users.lass.openssh.authorizedKeys = [ config.krebs.users.mic92.pubkey ];
222
+
system.stateVersion = "22.05";
223
+
}
+49
nixos/machines/icarus/physical.nix
+49
nixos/machines/icarus/physical.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
./config.nix
5
+
#<stockholm/lass/2configs/hw/x220.nix>
6
+
#<stockholm/lass/2configs/boot/universal.nix>
7
+
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
8
+
<stockholm/krebs/2configs/hw/x220.nix>
9
+
];
10
+
11
+
boot.loader.grub.enable = true;
12
+
boot.loader.grub.version = 2;
13
+
boot.loader.grub.efiSupport = true;
14
+
boot.loader.grub.efiInstallAsRemovable = true;
15
+
boot.loader.grub.device = "/dev/disk/by-id/wwn-0x5002538d702f5ac6";
16
+
boot.initrd.luks.devices.ssd.device = "/dev/disk/by-id/wwn-0x5002538d702f5ac6-part3";
17
+
18
+
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "xhci_pci" "sd_mod" "sdhci_pci" ];
19
+
boot.initrd.kernelModules = [ "dm-snapshot" ];
20
+
boot.kernelModules = [ "kvm-intel" ];
21
+
boot.extraModulePackages = [ ];
22
+
23
+
fileSystems."/" = {
24
+
device = "/dev/disk/by-uuid/298eb635-8db2-4c15-a73d-2e0d6afa10e8";
25
+
fsType = "xfs";
26
+
};
27
+
28
+
fileSystems."/home" = {
29
+
device = "/dev/disk/by-uuid/eec94bef-e745-4d95-ad17-4df728f5fd31";
30
+
fsType = "xfs";
31
+
};
32
+
33
+
fileSystems."/boot" = {
34
+
device = "/dev/disk/by-uuid/D975-2CAB";
35
+
fsType = "vfat";
36
+
};
37
+
38
+
swapDevices = [ ];
39
+
40
+
nix.maxJobs = lib.mkDefault 4;
41
+
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
42
+
43
+
services.udev.extraRules = ''
44
+
SUBSYSTEM=="net", ATTR{address}=="00:24:d7:f0:a0:0c", NAME="wl0"
45
+
SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:71:cb:35", NAME="et0"
46
+
'';
47
+
48
+
services.logind.lidSwitch = "ignore";
49
+
}
+25
nixos/machines/lasspi/config.nix
+25
nixos/machines/lasspi/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
in
4
+
{
5
+
imports = [
6
+
<stockholm/lass>
7
+
<stockholm/lass/2configs>
8
+
<stockholm/lass/2configs/retiolum.nix>
9
+
];
10
+
11
+
krebs.build.host = config.krebs.hosts.lasspi;
12
+
13
+
networking = {
14
+
networkmanager = {
15
+
enable = true;
16
+
};
17
+
};
18
+
environment.systemPackages = with pkgs; [
19
+
vim
20
+
rxvt-unicode-unwrapped.terminfo
21
+
];
22
+
services.openssh.enable = true;
23
+
24
+
system.stateVersion = "22.05";
25
+
}
+45
nixos/machines/lasspi/physical.nix
+45
nixos/machines/lasspi/physical.nix
···
1
+
{ config, lib, pkgs, modulesPath, ... }:
2
+
{
3
+
imports = [
4
+
(modulesPath + "/installer/scan/not-detected.nix")
5
+
./config.nix
6
+
];
7
+
8
+
boot = {
9
+
# kernelPackages = pkgs.linuxPackages_rpi4;
10
+
tmpOnTmpfs = true;
11
+
initrd.availableKernelModules = [ "usbhid" "usb_storage" "xhci_pci" ];
12
+
# ttyAMA0 is the serial console broken out to the GPIO
13
+
kernelParams = [
14
+
"8250.nr_uarts=1"
15
+
"console=ttyAMA0,115200"
16
+
"console=tty1"
17
+
# Some gui programs need this
18
+
"cma=128M"
19
+
];
20
+
};
21
+
22
+
# boot.loader.raspberryPi = {
23
+
# enable = true;
24
+
# version = 4;
25
+
# # uboot.enable = true;
26
+
# };
27
+
boot.loader.grub.enable = false;
28
+
boot.loader.generic-extlinux-compatible.enable = true;
29
+
30
+
# Required for the Wireless firmware
31
+
hardware.enableRedistributableFirmware = true;
32
+
33
+
networking.interfaces.eth0.useDHCP = true;
34
+
35
+
# Assuming this is installed on top of the disk image.
36
+
fileSystems = {
37
+
"/" = {
38
+
device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
39
+
fsType = "ext4";
40
+
options = [ "noatime" ];
41
+
};
42
+
};
43
+
44
+
powerManagement.cpuFreqGovernor = "ondemand";
45
+
}
+29
nixos/machines/littleT/config.nix
+29
nixos/machines/littleT/config.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
../../
6
+
7
+
../../2configs/retiolum.nix
8
+
../../2configs/blue-host.nix
9
+
../../2configs/green-host.nix
10
+
../../2configs/syncthing.nix
11
+
];
12
+
13
+
networking.networkmanager.enable = true;
14
+
networking.wireless.enable = mkForce false;
15
+
time.timeZone = "Europe/Berlin";
16
+
17
+
hardware.trackpoint = {
18
+
enable = true;
19
+
sensitivity = 220;
20
+
speed = 0;
21
+
emulateWheel = true;
22
+
};
23
+
24
+
services.logind.extraConfig = ''
25
+
HandleLidSwitch=ignore
26
+
'';
27
+
28
+
krebs.build.host = config.krebs.hosts.littleT;
29
+
}
+25
nixos/machines/littleT/physical.nix
+25
nixos/machines/littleT/physical.nix
···
1
+
{
2
+
imports = [
3
+
./config.nix
4
+
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
5
+
];
6
+
fileSystems."/" =
7
+
{ device = "rpool/root";
8
+
fsType = "zfs";
9
+
};
10
+
11
+
fileSystems."/boot" =
12
+
{ device = "/dev/disk/by-uuid/5B2E-3734";
13
+
fsType = "vfat";
14
+
};
15
+
boot.loader.grub.enable = true;
16
+
boot.loader.grub.version = 2;
17
+
boot.loader.grub.efiSupport = true;
18
+
boot.loader.grub.efiInstallAsRemovable = true;
19
+
boot.loader.grub.device = "nodev";
20
+
networking.hostId = "584248c6";
21
+
22
+
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
23
+
boot.kernelModules = [ "kvm-intel" ];
24
+
25
+
}
+163
nixos/machines/mors/config.nix
+163
nixos/machines/mors/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
../../
6
+
7
+
../../2configs/mouse.nix
8
+
../../2configs/retiolum.nix
9
+
../../2configs/baseX.nix
10
+
../../2configs/pipewire.nix
11
+
../../2configs/exim-retiolum.nix
12
+
../../2configs/programs.nix
13
+
../../2configs/bitcoin.nix
14
+
../../2configs/browsers.nix
15
+
../../2configs/games.nix
16
+
../../2configs/pass.nix
17
+
../../2configs/elster.nix
18
+
../../2configs/steam.nix
19
+
../../2configs/wine.nix
20
+
../../2configs/fetchWallpaper.nix
21
+
../../2configs/mail.nix
22
+
../../2configs/logf.nix
23
+
../../2configs/syncthing.nix
24
+
../../2configs/sync/sync.nix
25
+
../../2configs/sync/decsync.nix
26
+
../../2configs/sync/weechat.nix
27
+
../../2configs/sync/the_playlist.nix
28
+
../../2configs/br.nix
29
+
../../2configs/ableton.nix
30
+
../../2configs/dunst.nix
31
+
../../2configs/rtl-sdr.nix
32
+
../../2configs/print.nix
33
+
../../2configs/network-manager.nix
34
+
../../2configs/yellow-mounts/samba.nix
35
+
../../2configs/ppp/x220-modem.nix
36
+
../../2configs/ppp/umts-stick.nix
37
+
../../2configs/consul.nix
38
+
../../2configs/networkd.nix
39
+
../../2configs/autotether.nix
40
+
{
41
+
krebs.iptables.tables.filter.INPUT.rules = [
42
+
#risk of rain
43
+
{ predicate = "-p tcp --dport 11100"; target = "ACCEPT"; }
44
+
#quake3
45
+
{ predicate = "-p tcp --dport 27950:27965"; target = "ACCEPT"; }
46
+
{ predicate = "-p udp --dport 27950:27965"; target = "ACCEPT"; }
47
+
];
48
+
}
49
+
{
50
+
services.nginx = {
51
+
enable = true;
52
+
virtualHosts.default = {
53
+
default = true;
54
+
serverAliases = [
55
+
"localhost"
56
+
"${config.krebs.build.host.name}"
57
+
"${config.krebs.build.host.name}.r"
58
+
];
59
+
locations."~ ^/~(.+?)(/.*)?\$".extraConfig = ''
60
+
alias /home/$1/public_html$2;
61
+
'';
62
+
};
63
+
};
64
+
}
65
+
{
66
+
services.redis.enable = true;
67
+
}
68
+
{
69
+
environment.systemPackages = [
70
+
pkgs.ovh-zone
71
+
pkgs.bank
72
+
pkgs.adb-sync
73
+
pkgs.transgui
74
+
];
75
+
}
76
+
{
77
+
services.tor = {
78
+
enable = true;
79
+
client.enable = true;
80
+
};
81
+
}
82
+
];
83
+
84
+
krebs.build.host = config.krebs.hosts.mors;
85
+
86
+
environment.systemPackages = with pkgs; [
87
+
acronym
88
+
brain
89
+
cac-api
90
+
sshpass
91
+
get
92
+
hashPassword
93
+
urban
94
+
mk_sql_pair
95
+
remmina
96
+
transmission
97
+
98
+
macchanger
99
+
100
+
dnsutils
101
+
woeusb
102
+
(pkgs.writeDashBin "play-on" ''
103
+
HOST=$(echo 'styx\nshodan' | fzfmenu)
104
+
ssh -t "$HOST" -- mpv "$@"
105
+
'')
106
+
];
107
+
108
+
#TODO: fix this shit
109
+
##fprint stuff
110
+
##sudo fprintd-enroll $USER to save fingerprints
111
+
#services.fprintd.enable = true;
112
+
#security.pam.services.sudo.fprintAuth = true;
113
+
114
+
users.extraGroups = {
115
+
loot = {
116
+
members = [
117
+
config.users.extraUsers.mainUser.name
118
+
"firefox"
119
+
"chromium"
120
+
"google"
121
+
"virtual"
122
+
];
123
+
};
124
+
};
125
+
126
+
krebs.repo-sync.timerConfig = {
127
+
OnCalendar = "00:37";
128
+
};
129
+
130
+
nixpkgs.config.android_sdk.accept_license = true;
131
+
programs.adb.enable = true;
132
+
133
+
134
+
services.earlyoom = {
135
+
enable = true;
136
+
freeMemThreshold = 5;
137
+
};
138
+
139
+
140
+
# It may leak your data, but look how FAST it is!1!!
141
+
# https://make-linux-fast-again.com/
142
+
boot.kernelParams = [
143
+
"noibrs"
144
+
"noibpb"
145
+
"nopti"
146
+
"nospectre_v2"
147
+
"nospectre_v1"
148
+
"l1tf=off"
149
+
"nospec_store_bypass_disable"
150
+
"no_stf_barrier"
151
+
"mds=off"
152
+
"mitigations=off"
153
+
];
154
+
155
+
boot.binfmt.emulatedSystems = [
156
+
"aarch64-linux"
157
+
];
158
+
159
+
nix.trustedUsers = [ "root" "lass" ];
160
+
161
+
services.nscd.enableNsncd = true;
162
+
163
+
}
+48
nixos/machines/mors/physical.nix
+48
nixos/machines/mors/physical.nix
···
1
+
{
2
+
imports = [
3
+
./config.nix
4
+
<stockholm/lass/2configs/hw/x220.nix>
5
+
<stockholm/lass/2configs/boot/universal.nix>
6
+
];
7
+
8
+
boot.kernelParams = [ "acpi_backlight=native" ];
9
+
10
+
fileSystems = {
11
+
"/bku" = {
12
+
device = "/dev/mapper/pool-bku";
13
+
fsType = "btrfs";
14
+
options = ["defaults" "noatime" "ssd" "compress=lzo"];
15
+
};
16
+
"/home/virtual" = {
17
+
device = "/dev/mapper/pool-virtual";
18
+
fsType = "ext4";
19
+
};
20
+
"/backups" = {
21
+
device = "/dev/pool/backup";
22
+
fsType = "ext4";
23
+
};
24
+
};
25
+
26
+
services.udev.extraRules = ''
27
+
SUBSYSTEM=="net", DEVPATH=="/devices/pci*/*1c.1/*/net/*", NAME="wl0"
28
+
SUBSYSTEM=="net", ATTR{address}=="3c:97:0e:37:15:d9", NAME="et0"
29
+
'';
30
+
31
+
#TODO activationScripts seem broken, fix them!
32
+
#activationScripts
33
+
#split up and move into base
34
+
system.activationScripts.powertopTunables = ''
35
+
#Runtime PMs
36
+
echo 'auto' > '/sys/bus/pci/devices/0000:00:02.0/power/control'
37
+
echo 'auto' > '/sys/bus/pci/devices/0000:00:00.0/power/control'
38
+
echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.3/power/control'
39
+
echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.2/power/control'
40
+
echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.0/power/control'
41
+
echo 'auto' > '/sys/bus/pci/devices/0000:00:1d.0/power/control'
42
+
echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.0/power/control'
43
+
echo 'auto' > '/sys/bus/pci/devices/0000:00:1b.0/power/control'
44
+
echo 'auto' > '/sys/bus/pci/devices/0000:00:1a.0/power/control'
45
+
echo 'auto' > '/sys/bus/pci/devices/0000:00:19.0/power/control'
46
+
echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.1/power/control'
47
+
'';
48
+
}
+21
nixos/machines/mors/source.nix
+21
nixos/machines/mors/source.nix
···
1
+
{ lib, pkgs, test, ... }: let
2
+
npkgs = lib.importJSON ../../../krebs/nixpkgs-unstable.json;
3
+
in {
4
+
nixpkgs = (if test then lib.mkForce ({ derivation = let
5
+
rev = npkgs.rev;
6
+
sha256 = npkgs.sha256;
7
+
in ''
8
+
with import (builtins.fetchTarball {
9
+
url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
10
+
sha256 = "${sha256}";
11
+
}) {};
12
+
pkgs.fetchFromGitHub {
13
+
owner = "nixos";
14
+
repo = "nixpkgs";
15
+
rev = "${rev}";
16
+
sha256 = "${sha256}";
17
+
}
18
+
''; }) else {
19
+
git.ref = lib.mkForce npkgs.rev;
20
+
});
21
+
}
+51
nixos/machines/neoprism/config.nix
+51
nixos/machines/neoprism/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
<stockholm/lass>
6
+
<stockholm/lass/2configs/retiolum.nix>
7
+
<stockholm/lass/2configs/mail/internet-gateway.nix>
8
+
<stockholm/lass/2configs/binary-cache/server.nix>
9
+
<stockholm/lass/2configs/matrix.nix>
10
+
<stockholm/lass/2configs/gsm-wiki.nix>
11
+
12
+
# sync-containers
13
+
<stockholm/lass/2configs/consul.nix>
14
+
<stockholm/lass/2configs/services/flix/container-host.nix>
15
+
<stockholm/lass/2configs/services/radio/container-host.nix>
16
+
<stockholm/lass/2configs/ubik-host.nix>
17
+
<stockholm/lass/2configs/orange-host.nix>
18
+
<stockholm/krebs/2configs/hotdog-host.nix>
19
+
20
+
# other containers
21
+
<stockholm/lass/2configs/riot.nix>
22
+
23
+
# proxying of services
24
+
<stockholm/lass/2configs/services/radio/proxy.nix>
25
+
<stockholm/lass/2configs/services/flix/proxy.nix>
26
+
<stockholm/lass/2configs/services/coms/proxy.nix>
27
+
];
28
+
29
+
krebs.build.host = config.krebs.hosts.neoprism;
30
+
31
+
networking.firewall.allowedTCPPorts = [ 80 443 ];
32
+
security.acme.acceptTerms = true;
33
+
security.acme.defaults.email = "acme@lassul.us";
34
+
services.nginx = {
35
+
enable = true;
36
+
recommendedGzipSettings = true;
37
+
recommendedOptimisation = true;
38
+
recommendedTlsSettings = true;
39
+
40
+
enableReload = true;
41
+
42
+
virtualHosts.default = {
43
+
default = true;
44
+
locations."= /etc/os-release".extraConfig = ''
45
+
default_type text/plain;
46
+
alias /etc/os-release;
47
+
'';
48
+
locations."~ ^/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
49
+
};
50
+
};
51
+
}
+118
nixos/machines/neoprism/disk.nix
+118
nixos/machines/neoprism/disk.nix
···
1
+
{ lib, ... }:
2
+
{
3
+
disk = (lib.genAttrs [ "/dev/nvme0n1" "/dev/nvme1n1" ] (disk: {
4
+
type = "disk";
5
+
device = disk;
6
+
content = {
7
+
type = "gpt";
8
+
partitions = {
9
+
boot = {
10
+
size = "1M";
11
+
type = "EF02";
12
+
};
13
+
ESP = {
14
+
size = "1G";
15
+
content = {
16
+
type = "mdraid";
17
+
name = "boot";
18
+
};
19
+
};
20
+
zfs = {
21
+
size = "100%";
22
+
content = {
23
+
type = "zfs";
24
+
pool = "zroot";
25
+
};
26
+
};
27
+
};
28
+
};
29
+
})) // {
30
+
hdd1 = {
31
+
type = "disk";
32
+
device = "/dev/sda";
33
+
content = {
34
+
type = "zfs";
35
+
pool = "tank";
36
+
};
37
+
};
38
+
};
39
+
mdadm = {
40
+
boot = {
41
+
type = "mdadm";
42
+
level = 1;
43
+
metadata = "1.0";
44
+
content = {
45
+
type = "filesystem";
46
+
format = "vfat";
47
+
mountpoint = "/boot";
48
+
};
49
+
};
50
+
};
51
+
zpool = {
52
+
zroot = {
53
+
type = "zpool";
54
+
mode = "mirror";
55
+
mountpoint = "/";
56
+
rootFsOptions = {
57
+
};
58
+
datasets.reserved = {
59
+
type = "zfs_fs";
60
+
options.refreservation = "1G";
61
+
};
62
+
};
63
+
tank = {
64
+
type = "zpool";
65
+
datasets = {
66
+
reserved = {
67
+
type = "zfs_fs";
68
+
options.refreservation = "1G";
69
+
};
70
+
containers = {
71
+
type = "zfs_fs";
72
+
mountpoint = "/var/lib/containers";
73
+
options = {
74
+
canmount = "noauto";
75
+
};
76
+
};
77
+
home = {
78
+
type = "zfs_fs";
79
+
mountpoint = "/home";
80
+
options = {
81
+
canmount = "noauto";
82
+
};
83
+
};
84
+
srv = {
85
+
type = "zfs_fs";
86
+
mountpoint = "/srv";
87
+
options = {
88
+
canmount = "noauto";
89
+
};
90
+
};
91
+
libvirt = {
92
+
type = "zfs_fs";
93
+
mountpoint = "/var/lib/libvirt";
94
+
options = {
95
+
canmount = "noauto";
96
+
};
97
+
};
98
+
# encrypted = {
99
+
# type = "zfs_fs";
100
+
# options = {
101
+
# canmount = "noauto";
102
+
# mountpoint = "none";
103
+
# encryption = "aes-256-gcm";
104
+
# keyformat = "passphrase";
105
+
# keylocation = "prompt";
106
+
# };
107
+
# };
108
+
# "encrypted/download" = {
109
+
# type = "zfs_fs";
110
+
# mountpoint = "/var/download";
111
+
# options = {
112
+
# canmount = "noauto";
113
+
# };
114
+
# };
115
+
};
116
+
};
117
+
};
118
+
}
+79
nixos/machines/neoprism/physical.nix
+79
nixos/machines/neoprism/physical.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
5
+
imports = [
6
+
./config.nix
7
+
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
8
+
];
9
+
10
+
disko.devices = import ./disk.nix;
11
+
networking.hostId = "9c0a74ac";
12
+
13
+
boot.loader.grub.enable = true;
14
+
boot.loader.grub.version = 2;
15
+
boot.loader.grub.efiSupport = true;
16
+
boot.loader.grub.devices = [
17
+
config.disko.devices.disk."/dev/nvme0n1".device
18
+
config.disko.devices.disk."/dev/nvme1n1".device
19
+
];
20
+
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "sd_mod" ];
21
+
boot.kernelModules = [ "kvm-amd" ];
22
+
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
23
+
24
+
# networking config
25
+
networking.useNetworkd = true;
26
+
systemd.network = {
27
+
enable = true;
28
+
config = {
29
+
networkConfig.SpeedMeter = true;
30
+
};
31
+
# netdevs.ext-br.netdevConfig = {
32
+
# Kind = "bridge";
33
+
# Name = "ext-br";
34
+
# MACAddress = "a8:a1:59:0f:2d:69";
35
+
# };
36
+
# networks.ext-br = {
37
+
# name = "ext-br";
38
+
# address = [
39
+
# "95.217.192.59/26"
40
+
# "2a01:4f9:4a:4f1a::1/64"
41
+
# ];
42
+
# gateway = [
43
+
# "95.217.192.1"
44
+
# "fe80::1"
45
+
# ];
46
+
# };
47
+
networks.eth0 = {
48
+
#bridge = [ "ext-br" ];
49
+
matchConfig.Name = "eth0";
50
+
address = [
51
+
"95.217.192.59/26"
52
+
"2a01:4f9:4a:4f1a::1/64"
53
+
];
54
+
gateway = [
55
+
"95.217.192.1"
56
+
"fe80::1"
57
+
];
58
+
};
59
+
};
60
+
61
+
networking.useDHCP = false;
62
+
# boot.initrd.network = {
63
+
# enable = true;
64
+
# ssh = {
65
+
# enable = true;
66
+
# authorizedKeys = [ config.krebs.users.lass.pubkey ];
67
+
# port = 2222;
68
+
# hostKeys = [
69
+
# (<secrets/ssh.id_ed25519>)
70
+
# (<secrets/ssh.id_rsa>)
71
+
# ];
72
+
# };
73
+
# };
74
+
# boot.kernelParams = [
75
+
# "net.ifnames=0"
76
+
# "ip=dhcp"
77
+
# "boot.trace"
78
+
# ];
79
+
}
+24
nixos/machines/orange/config.nix
+24
nixos/machines/orange/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
<stockholm/lass>
5
+
<stockholm/lass/2configs>
6
+
<stockholm/lass/2configs/retiolum.nix>
7
+
<stockholm/lass/2configs/mumble-reminder.nix>
8
+
<stockholm/lass/2configs/services/git>
9
+
];
10
+
11
+
krebs.build.host = config.krebs.hosts.orange;
12
+
13
+
services.nginx.enable = true;
14
+
networking.firewall.allowedTCPPorts = [ 80 443 ];
15
+
security.acme = {
16
+
acceptTerms = true;
17
+
defaults.email = "acme@lassul.us";
18
+
};
19
+
20
+
krebs.sync-containers3.inContainer = {
21
+
enable = true;
22
+
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFQWzKuXrwQopBc1mzb2VpljmwAs7Y8bRl9a8hBXLC+l";
23
+
};
24
+
}
+7
nixos/machines/orange/physical.nix
+7
nixos/machines/orange/physical.nix
+37
nixos/machines/prism/backup.nix
+37
nixos/machines/prism/backup.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
services.postgresqlBackup.enable = true;
4
+
5
+
systemd.services.borgbackup-job-hetzner.serviceConfig.ReadWritePaths = [ "/var/log/telegraf" ];
6
+
7
+
services.borgbackup.jobs.hetzner = {
8
+
paths = [
9
+
"/var/backup"
10
+
];
11
+
exclude = [
12
+
"*.pyc"
13
+
];
14
+
repo = "u364341@u364341.your-storagebox.de:/./hetzner";
15
+
encryption.mode = "none";
16
+
compression = "auto,zstd";
17
+
startAt = "daily";
18
+
# TODO: change backup key
19
+
environment.BORG_RSH = "ssh -oPort=23 -i ${"${config.krebs.secret.directory}/borgbackup.ssh.id25519"}";
20
+
preHook = ''
21
+
set -x
22
+
'';
23
+
24
+
postHook = ''
25
+
cat > /var/log/telegraf/borgbackup-job-hetzner.service <<EOF
26
+
task,frequency=daily last_run=$(date +%s)i,state="$([[ $exitStatus == 0 ]] && echo ok || echo fail)"
27
+
EOF
28
+
'';
29
+
30
+
prune.keep = {
31
+
within = "1d"; # Keep all archives from the last day
32
+
daily = 7;
33
+
weekly = 4;
34
+
monthly = 0;
35
+
};
36
+
};
37
+
}
+389
nixos/machines/prism/config.nix
+389
nixos/machines/prism/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
./backup.nix
6
+
../../
7
+
../../2configs/retiolum.nix
8
+
../../2configs/libvirt.nix
9
+
../../2configs/websites/lassulus.nix
10
+
../../2configs/services/git/proxy.nix
11
+
../../2configs/monitoring/telegraf.nix
12
+
../../2configs/consul.nix
13
+
{
14
+
services.nginx.enable = true;
15
+
imports = [
16
+
../../2configs/websites/domsen.nix
17
+
];
18
+
# needed by domsen.nix ^^
19
+
lass.usershadow = {
20
+
enable = true;
21
+
};
22
+
23
+
krebs.iptables.tables.filter.INPUT.rules = [
24
+
{ predicate = "-p tcp --dport http"; target = "ACCEPT"; }
25
+
{ predicate = "-p tcp --dport https"; target = "ACCEPT"; }
26
+
];
27
+
}
28
+
{ # TODO make new hfos.nix out of this vv
29
+
users.users.riot = {
30
+
uid = genid_uint31 "riot";
31
+
isNormalUser = true;
32
+
extraGroups = [ "libvirtd" ];
33
+
openssh.authorizedKeys.keys = [
34
+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
35
+
];
36
+
};
37
+
krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
38
+
{ v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; }
39
+
{ v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; }
40
+
];
41
+
}
42
+
{
43
+
users.users.tv = {
44
+
uid = genid_uint31 "tv";
45
+
isNormalUser = true;
46
+
openssh.authorizedKeys.keys = [
47
+
config.krebs.users.tv.pubkey
48
+
];
49
+
};
50
+
users.users.makefu = {
51
+
uid = genid_uint31 "makefu";
52
+
isNormalUser = true;
53
+
openssh.authorizedKeys.keys = [
54
+
config.krebs.users.makefu.pubkey
55
+
];
56
+
};
57
+
users.extraUsers.dritter = {
58
+
uid = genid_uint31 "dritter";
59
+
isNormalUser = true;
60
+
extraGroups = [
61
+
"download"
62
+
];
63
+
openssh.authorizedKeys.keys = [
64
+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnqOWDDk7QkSAvrSLkEoz7dY22+xPyv5JDn2zlfUndfavmTMfZvPx9REMjgULbcCSM4m3Ncf40yUjciDpVleGoEz82+p/ObHAkVWPQyXRS3ZRM2IJJultBHEFc61+61Pi8k3p5pBhPPaig6VncJ4uUuuNqen9jqLesSTVXNtdntU2IvnC8B8k1Kq6fu9q1T2yEOMxkD31D5hVHlqAly0LdRiYvtsRIoCSmRvlpGl70uvPprhQxhtoiEUeDqmIL7BG9x7gU0Swdl7R0/HtFXlFuOwSlNYDmOf/Zrb1jhOpj4AlCliGUkM0iKIJhgH0tnJna6kfkGKHDwuzITGIh6SpZ dritter@Janeway"
65
+
];
66
+
};
67
+
users.extraUsers.juhulian = {
68
+
uid = 1339;
69
+
isNormalUser = true;
70
+
openssh.authorizedKeys.keys = [
71
+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBQhLGvfv4hyQ/nqJGy1YgHXPSVl6igeWTroJSvAhUFgoh+rG+zvqY0EahKXNb3sq0/OYDCTJVuucc0hgCg7T2KqTqMtTb9EEkRmCFbD7F7DWZojCrh/an6sHneqT5eFvzAPZ8E5hup7oVQnj5P5M3I9keRHBWt1rq6q0IcOEhsFvne4qJc73aLASTJkxzlo5U8ju3JQOl6474ECuSn0lb1fTrQ/SR1NgF7jV11eBldkS8SHEB+2GXjn4Yrn+QUKOnDp+B85vZmVlJSI+7XR1/U/xIbtAjGTEmNwB6cTbBv9NCG9jloDDOZG4ZvzzHYrlBXjaigtQh2/4mrHoKa5eV juhulian@juhulian"
72
+
];
73
+
};
74
+
users.users.hellrazor = {
75
+
uid = genid_uint31 "hellrazor";
76
+
isNormalUser = true;
77
+
extraGroups = [
78
+
"download"
79
+
];
80
+
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDQFaYOWRUvHP6I37q9Dd4PJOq8FNQqAeJZ8pLx0G62uC450kbPGcG80rHHvXmk7HqQP6biJmMg48bOsvXAScPot2Qhp1Qc35CuUqVhLiTvUAsi8l/iJjhjZ23yRGDCAmW5+JIOzIvECkcbMnG7YoYAQ9trNGHe9qwGzQGhpt3QVClE23WtE3PVKRLQx1VbiabSnAm6tXVd2zpUoSdpWt8Gpi2taM4XXJ5+l744MNxFHvDapN5xqpYzwrA34Ii13jNLWcGbtgxESpR+VjnamdWByrkBsW4X5/xn2K1I1FrujaM/DBHV1QMaDKst9V8+uL5X7aYNt0OUBu2eyZdg6aujY2BYovB9uRyR1JIuSbA/a54MM96yN9WirMUufJF/YZrV0L631t9EW8ORyWUo1GRzMuBHVHQlfApj7NCU/jEddUuTqKgwyRgTmMFMUI4M0tRULAB/7pBE1Vbcx9tg6RsKIk8VkskfbBJW9Y6Sx6YoFlxPdgMNIrBefqEjIV62piP7YLMlvfIDCJ7TNd9dLN86XGggZ/nD5zt6SL1o61vVnw9If8pHosppxADPJsJvcdN6fOe16/tFAeE0JRo0jTcyFVTBGfhpey+rFfuW8wtUyuO5WPUxkOn7xMHGMWHJAtWX2vwVIDtLxvqn48B4SmEOpPD6ii+vcpwqAex3ycqBUQ==" ];
81
+
};
82
+
}
83
+
{
84
+
services.nginx.virtualHosts."radio.lassul.us" = {
85
+
enableACME = true;
86
+
addSSL = true;
87
+
locations."/" = {
88
+
# recommendedProxySettings = true;
89
+
proxyWebsockets = true;
90
+
proxyPass = "http://radio.r";
91
+
extraConfig = ''
92
+
proxy_set_header Host radio.r;
93
+
# get source ip for weather reports
94
+
proxy_set_header user-agent "$http_user_agent; client-ip=$remote_addr";
95
+
'';
96
+
};
97
+
};
98
+
krebs.htgen.radio-redirect = {
99
+
port = 8000;
100
+
scriptFile = pkgs.writers.writeDash "redir" ''
101
+
printf 'HTTP/1.1 301 Moved Permanently\r\n'
102
+
printf "Location: http://radio.lassul.us''${Request_URI}\r\n"
103
+
printf '\r\n'
104
+
'';
105
+
};
106
+
krebs.iptables.tables.filter.INPUT.rules = [
107
+
{ predicate = "-p tcp --dport 8000"; target = "ACCEPT"; }
108
+
];
109
+
}
110
+
../../2configs/exim-smarthost.nix
111
+
../../2configs/privoxy-retiolum.nix
112
+
../../2configs/binary-cache/server.nix
113
+
../../2configs/binary-cache/proxy.nix
114
+
../../2configs/iodined.nix
115
+
../../2configs/paste.nix
116
+
../../2configs/syncthing.nix
117
+
../../2configs/reaktor-coders.nix
118
+
../../2configs/ciko.nix
119
+
../../2configs/container-networking.nix
120
+
../../2configs/fysiirc.nix
121
+
../../2configs/bgt-bot
122
+
../../2configs/matrix.nix
123
+
<stockholm/krebs/2configs/mastodon-proxy.nix>
124
+
{
125
+
services.tor = {
126
+
enable = true;
127
+
};
128
+
}
129
+
{
130
+
imports = [
131
+
../../2configs/realwallpaper.nix
132
+
];
133
+
services.nginx.virtualHosts."lassul.us".locations = {
134
+
"= /wallpaper-marker.png".extraConfig = ''
135
+
alias /var/realwallpaper/realwallpaper-marker.png;
136
+
'';
137
+
"= /wallpaper.png".extraConfig = ''
138
+
alias /var/realwallpaper/realwallpaper.png;
139
+
'';
140
+
"= /wallpaper-stars-berlin.png".extraConfig = ''
141
+
alias /var/realwallpaper/realwallpaper-krebs-stars-berlin.png;
142
+
'';
143
+
};
144
+
}
145
+
/2configs/minecraft.nix
146
+
/2configs/codimd.nix
147
+
/2configs/go.nix
148
+
{
149
+
lass.nichtparasoup.enable = true;
150
+
services.nginx = {
151
+
enable = true;
152
+
virtualHosts."lol.lassul.us" = {
153
+
forceSSL = true;
154
+
enableACME = true;
155
+
locations."/".extraConfig = ''
156
+
proxy_pass http://localhost:5001;
157
+
'';
158
+
};
159
+
};
160
+
}
161
+
{
162
+
imports = [
163
+
../../2configs/wiregrill.nix
164
+
];
165
+
krebs.iptables.tables.nat.PREROUTING.rules = mkOrder 999 [
166
+
{ v6 = false; predicate = "-s 10.244.0.0/16"; target = "ACCEPT"; }
167
+
{ v4 = false; predicate = "-s 42:1::/32"; target = "ACCEPT"; }
168
+
];
169
+
krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
170
+
{ predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
171
+
{ predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
172
+
];
173
+
krebs.iptables.tables.nat.POSTROUTING.rules = [
174
+
{ v4 = false; predicate = "-s 42:1::/32 ! -d 42:1::/48"; target = "MASQUERADE"; }
175
+
{ v6 = false; predicate = "-s 10.244.0.0/16 ! -d 10.244.0.0/16"; target = "MASQUERADE"; }
176
+
];
177
+
services.dnsmasq = {
178
+
enable = true;
179
+
resolveLocalQueries = false;
180
+
181
+
extraConfig= ''
182
+
bind-interfaces
183
+
interface=wiregrill
184
+
interface=retiolum
185
+
'';
186
+
};
187
+
}
188
+
{
189
+
krebs.iptables.tables.filter.INPUT.rules = [
190
+
{ predicate = "-p udp --dport 60000:61000"; target = "ACCEPT"; }
191
+
];
192
+
}
193
+
../../2configs/services/coms/jitsi.nix
194
+
../../2configs/services/coms/murmur.nix
195
+
{
196
+
197
+
services.nginx.virtualHosts."flix.lassul.us" = {
198
+
forceSSL = true;
199
+
enableACME = true;
200
+
locations."/" = {
201
+
proxyPass = "http://yellow.r:8096";
202
+
proxyWebsockets = true;
203
+
recommendedProxySettings = true;
204
+
};
205
+
};
206
+
services.nginx.virtualHosts."lassul.us" = {
207
+
locations."^~ /flix/".extraConfig = ''
208
+
if ($scheme != "https") {
209
+
rewrite ^ https://$host$request_uri permanent;
210
+
}
211
+
auth_basic "Restricted Content";
212
+
auth_basic_user_file ${pkgs.writeText "flix-user-pass" ''
213
+
krebs:$apr1$1Fwt/4T0$YwcUn3OBmtmsGiEPlYWyq0
214
+
''};
215
+
proxy_pass http://yellow.r:80/;
216
+
proxy_set_header Accept-Encoding "";
217
+
sub_filter "https://lassul.us/" "https://lassul.us/flix/";
218
+
sub_filter_once off;
219
+
'';
220
+
locations."^~ /chatty/".extraConfig = ''
221
+
rewrite ^ https://$host/flix/$request_uri permanent;
222
+
'';
223
+
#locations."^~ /transmission".return = "301 https://$host/transmission/web/";
224
+
locations."^~ /transmission/".extraConfig = ''
225
+
if ($scheme != "https") {
226
+
rewrite ^ https://$host$request_uri permanent;
227
+
}
228
+
auth_basic "Restricted Content";
229
+
auth_basic_user_file ${pkgs.writeText "transmission-user-pass" ''
230
+
krebs:$apr1$1Fwt/4T0$YwcUn3OBmtmsGiEPlYWyq0
231
+
''};
232
+
proxy_pass_header X-Transmission-Session-Id;
233
+
proxy_pass http://10.233.2.14:9091;
234
+
'';
235
+
};
236
+
237
+
users.groups.download = {};
238
+
users.users = {
239
+
download = {
240
+
createHome = false;
241
+
group = "download";
242
+
name = "download";
243
+
home = "/var/download";
244
+
useDefaultShell = true;
245
+
uid = genid "download";
246
+
isSystemUser = true;
247
+
openssh.authorizedKeys.keys = with config.krebs.users; [
248
+
lass.pubkey
249
+
lass-android.pubkey
250
+
makefu.pubkey
251
+
palo.pubkey
252
+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDB0d0JA20Vqn7I4lCte6Ne2EOmLZyMJyS9yIKJYXNLjbLwkQ4AYoQKantPBkTxR75M09E7d3j5heuWnCjWH45TrfQfe1EOSSC3ppCI6C6aIVlaNs+KhAYZS0m2Y8WkKn+TT5JLEa8yybYVN/RlZPOilpj/1QgjU6CQK+eJ1k/kK+QFXcwN82GDVh5kbTVcKUNp2tiyxFA+z9LY0xFDg/JHif2ROpjJVLQBJ+YPuOXZN5LDnVcuyLWKThjxy5srQ8iDjoxBg7dwLHjby5Mv41K4W61Gq6xM53gDEgfXk4cQhJnmx7jA/pUnsn2ZQDeww3hcc7vRf8soogXXz2KC9maiq0M/svaATsa9Ul4hrKnqPZP9Q8ScSEAUX+VI+x54iWrnW0p/yqBiRAzwsczdPzaQroUFTBxrq8R/n5TFdSHRMX7fYNOeVMjhfNca/gtfw9dYBVquCvuqUuFiRc0I7yK44rrMjjVQRcAbw6F8O7+04qWCmaJ8MPlmApwu2c05VMv9hiJo5p6PnzterRSLCqF6rIdhSnuOwrUIt1s/V+EEZXHCwSaNLaQJnYL0H9YjaIuGz4c8kVzxw4c0B6nl+hqW5y5/B2cuHiumnlRIDKOIzlv8ufhh21iN7QpIsPizahPezGoT1XqvzeXfH4qryo8O4yTN/PWoA+f7o9POU7L6hQ== lhebendanz@nixos"
253
+
"AAAAB3NzaC1yc2EAAAADAQABAAABgQC4ECL9NSCWqs4KVe+FF+2BPtl5Bv5aQPHqnXllCyiESZykwRKLx6/AbF5SbUAUMVZtp9oDSdp28m3BvVeWJ/q7hAbIxUtfd/jp+JBRZ8Kj6K5GzUO7Bhgl/o0A7xEjAeOKHiYuLjdPMcFUyl6Ah4ey/mcQYf6AdU0+hYUDeUlKe/YxxYD6202W0GJq2xGdIqs/TbopT9iaX+sv0wdXDVfFY72nFqOUwJW3u6O2viKKRugrz/eo50Eo3ts7pYz/FpDXExrUvV9Vu/bQ34pa8nKgF3/AKQHgmzljNQSVZKyAV8OY0UFonjBMXCBg2tXtwfnlzdx2SyuQVv55x+0AuRKsi85G2xLpXu1A3921pseBTW6Q6kbYK9eqxAay2c/kNbwNqFnO+nCvQ6Ier/hvGddOtItMu96IuU2E7mPN6WgvM8/3fjJRFWnZxFxqu/k7iH+yYT8qwRgdiSqZc76qvkYEuabdk2itstTRY0A3SpI3hFMZDw/7bxgMZtqpfyoRk5s= philip@shiki11:15 <Profpatsch> AAAAB3NzaC1yc2EAAAADAQABAAABgQC4ECL9NSCWqs4KVe+FF+2BPtl5Bv5aQPHqnXllCyiESZykwRKLx6/AbF5SbUAUMVZtp9oDSdp28m3BvVeWJ/q7hAbIxUtfd/jp+JBRZ8Kj6K5GzUO7Bhgl/o0A7xEjAeOKHiYuLjdPMcFUyl6Ah4ey/mcQYf6AdU0+hYUDeUlKe/YxxYD6202W0GJq2xGdIqs/TbopT9iaX+sv0wdXDVfFY72nFqOUwJW3u6O2viKKRugrz/eo50Eo3ts7pYz/FpDXExrUvV9Vu/bQ34pa8nKgF3/AKQHgmzljNQSVZKyAV8OY0UFonjBMXCBg2tXtwfnlzdx2SyuQVv55x+0AuRKsi85G2xLpXu1A3921pseBTW6Q6kbYK9eqxAay2c/kNbwNqFnO+nCvQ6Ier/hvGddOtItMu96IuU2E7mPN6WgvM8/3fjJRFWnZxFxqu/k7iH+yYT8qwRgdiSqZc76qvkYEuabdk2itstTRY0A3SpI3hFMZDw/7bxgMZtqpfyoRk5s= philip@shiki"
254
+
mic92.pubkey
255
+
qubasa.pubkey
256
+
];
257
+
};
258
+
};
259
+
260
+
system.activationScripts.downloadFolder = ''
261
+
mkdir -p /var/download
262
+
chmod 775 /var/download
263
+
ln -fnsT /var/lib/containers/yellow/var/download/finished /var/download/finished || :
264
+
chown download: /var/download/finished
265
+
'';
266
+
267
+
fileSystems."/export/download" = {
268
+
device = "/var/lib/containers/yellow/var/download/finished";
269
+
options = [ "bind" ];
270
+
};
271
+
services.nfs.server = {
272
+
enable = true;
273
+
exports = ''
274
+
/export 42::/16(insecure,ro,crossmnt)
275
+
'';
276
+
lockdPort = 4001;
277
+
mountdPort = 4002;
278
+
statdPort = 4000;
279
+
};
280
+
281
+
services.samba = {
282
+
enable = true;
283
+
enableNmbd = false;
284
+
extraConfig = ''
285
+
workgroup = WORKGROUP
286
+
netbios name = PRISM
287
+
server string = ${config.networking.hostName}
288
+
# only allow retiolum addresses
289
+
hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16
290
+
291
+
# Use sendfile() for performance gain
292
+
use sendfile = true
293
+
294
+
# No NetBIOS is needed
295
+
disable netbios = true
296
+
297
+
# Only mangle non-valid NTFS names, don't care about DOS support
298
+
mangled names = illegal
299
+
300
+
# Performance optimizations
301
+
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
302
+
303
+
# Disable all printing
304
+
load printers = false
305
+
disable spoolss = true
306
+
printcap name = /dev/null
307
+
308
+
map to guest = Bad User
309
+
max log size = 50
310
+
dns proxy = no
311
+
security = user
312
+
313
+
[global]
314
+
syslog only = yes
315
+
'';
316
+
shares.public = {
317
+
comment = "Warez";
318
+
path = "/export";
319
+
public = "yes";
320
+
"only guest" = "yes";
321
+
"create mask" = "0644";
322
+
"directory mask" = "2777";
323
+
writable = "no";
324
+
printable = "no";
325
+
};
326
+
};
327
+
328
+
krebs.iptables.tables.filter.INPUT.rules = [
329
+
# smbd
330
+
{ predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; }
331
+
{ predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; }
332
+
{ predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; }
333
+
{ predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; }
334
+
{ predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; }
335
+
{ predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; }
336
+
{ predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; }
337
+
{ predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; }
338
+
{ predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; }
339
+
{ predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; }
340
+
{ predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; }
341
+
{ predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; }
342
+
{ predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; }
343
+
{ predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; }
344
+
];
345
+
}
346
+
{ # acme fallback for neoprism migration
347
+
services.nginx.virtualHosts."lassul.us".acmeFallbackHost = "orange.r";
348
+
services.nginx.virtualHosts."radio.lassul.us".acmeFallbackHost = "neoprism.r";
349
+
services.nginx.virtualHosts."flix.lassul.us".acmeFallbackHost = "neoprism.r";
350
+
services.nginx.virtualHosts."jitsi.lassul.us".acmeFallbackHost = "neoprism.r";
351
+
services.nginx.virtualHosts."cgit.lassul.us".acmeFallbackHost = "orange.r";
352
+
services.nginx.virtualHosts."mail.lassul.us".acmeFallbackHost = "neoprism.r";
353
+
services.nginx.virtualHosts."mumble.lassul.us".acmeFallbackHost = "neoprism.r";
354
+
services.nginx.virtualHosts."mail.ubikmedia.eu" = {
355
+
enableACME = true;
356
+
forceSSL = true;
357
+
acmeFallbackHost = "ubik.r";
358
+
locations."/" = {
359
+
recommendedProxySettings = true;
360
+
proxyWebsockets = true;
361
+
proxyPass = "https://ubik.r";
362
+
};
363
+
};
364
+
}
365
+
];
366
+
367
+
krebs.build.host = config.krebs.hosts.prism;
368
+
services.earlyoom = {
369
+
enable = true;
370
+
freeMemThreshold = 5;
371
+
};
372
+
373
+
# test stable-confusion external access
374
+
services.nginx.virtualHosts."testing.lassul.us" = {
375
+
forceSSL = true;
376
+
enableACME = true;
377
+
locations."/".extraConfig = ''
378
+
auth_basic "Restricted Content";
379
+
auth_basic_user_file ${pkgs.writeText "flix-user-pass" ''
380
+
krebs:$apr1$1Fwt/4T0$YwcUn3OBmtmsGiEPlYWyq0
381
+
''};
382
+
proxy_pass http://stable-confusion.r:80/;
383
+
proxy_http_version 1.1;
384
+
proxy_set_header Upgrade $http_upgrade;
385
+
proxy_set_header Connection "Upgrade";
386
+
proxy_set_header Accept-Encoding "";
387
+
'';
388
+
};
389
+
}
+107
nixos/machines/prism/physical.nix
+107
nixos/machines/prism/physical.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
5
+
imports = [
6
+
./config.nix
7
+
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
8
+
];
9
+
10
+
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "sd_mod" ];
11
+
boot.kernelModules = [ "kvm-intel" ];
12
+
boot.swraid.enable = true;
13
+
14
+
fileSystems."/" = {
15
+
device = "rpool/root/nixos";
16
+
fsType = "zfs";
17
+
};
18
+
19
+
fileSystems."/boot" = {
20
+
device = "/dev/disk/by-uuid/d155d6ff-8e89-4876-a9e7-d1b7ba6a4804";
21
+
fsType = "ext4";
22
+
};
23
+
24
+
fileSystems."/backups" = {
25
+
device = "tank/backups";
26
+
fsType = "zfs";
27
+
};
28
+
29
+
fileSystems."/srv/http" = {
30
+
device = "tank/srv-http";
31
+
fsType = "zfs";
32
+
};
33
+
34
+
fileSystems."/var/download" = {
35
+
device = "tank/download";
36
+
fsType = "zfs";
37
+
};
38
+
39
+
fileSystems."/var/lib/containers" = {
40
+
device = "tank/containers";
41
+
fsType = "zfs";
42
+
};
43
+
44
+
fileSystems."/home" = {
45
+
device = "tank/home";
46
+
fsType = "zfs";
47
+
};
48
+
49
+
fileSystems."/var/lib/nextcloud" = {
50
+
device = "tank/nextcloud";
51
+
fsType = "zfs";
52
+
};
53
+
54
+
fileSystems."/var/lib/libvirt" = {
55
+
device = "tank/libvirt";
56
+
fsType = "zfs";
57
+
};
58
+
59
+
fileSystems."/var/realwallpaper/archive" = {
60
+
device = "tank/wallpaper";
61
+
fsType = "zfs";
62
+
};
63
+
64
+
# silence mdmonitor.service failures
65
+
# https://github.com/NixOS/nixpkgs/issues/72394
66
+
environment.etc."mdadm.conf".text = ''
67
+
MAILADDR root
68
+
'';
69
+
70
+
nix.maxJobs = lib.mkDefault 8;
71
+
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
72
+
73
+
boot.loader.grub.enable = true;
74
+
boot.loader.grub.version = 2;
75
+
boot.loader.grub.devices = [ "/dev/sda" "/dev/sdb" ];
76
+
77
+
# we don't pay for power there and this might solve a problem we observed at least once
78
+
# https://www.thomas-krenn.com/de/wiki/PCIe_Bus_Error_Status_00001100_beheben
79
+
boot.kernelParams = [ "pcie_aspm=off" "net.ifnames=0" "nomodeset" ];
80
+
networking.dhcpcd.enable = false;
81
+
82
+
83
+
networking.useNetworkd = lib.mkForce false;
84
+
systemd.network.enable = lib.mkForce false;
85
+
# bridge config
86
+
networking.bridges."ext-br".interfaces = [ "eth0" ];
87
+
networking = {
88
+
hostId = "2283aaae";
89
+
defaultGateway = "95.216.1.129";
90
+
defaultGateway6 = { address = "fe80::1"; interface = "ext-br"; };
91
+
# Use google's public DNS server
92
+
nameservers = [ "8.8.8.8" ];
93
+
interfaces.ext-br.ipv4.addresses = [
94
+
{
95
+
address = "95.216.1.150";
96
+
prefixLength = 26;
97
+
}
98
+
];
99
+
interfaces.ext-br.ipv6.addresses = [
100
+
{
101
+
address = "2a01:4f9:2a:1e9::1";
102
+
prefixLength = 64;
103
+
}
104
+
];
105
+
};
106
+
107
+
}
+23
nixos/machines/radio/config.nix
+23
nixos/machines/radio/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
<stockholm/lass>
5
+
<stockholm/lass/2configs>
6
+
<stockholm/lass/2configs/retiolum.nix>
7
+
8
+
<stockholm/lass/2configs/syncthing.nix>
9
+
<stockholm/lass/2configs/services/radio>
10
+
];
11
+
12
+
krebs.build.host = config.krebs.hosts.radio;
13
+
14
+
security.acme = {
15
+
acceptTerms = true;
16
+
defaults.email = "acme@lassul.us";
17
+
};
18
+
19
+
krebs.sync-containers3.inContainer = {
20
+
enable = true;
21
+
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvPKdbVwMEFCDMyNAzR8NdVjTbQL2G+03Xomxn6KKFt";
22
+
};
23
+
}
+7
nixos/machines/radio/physical.nix
+7
nixos/machines/radio/physical.nix
+6
nixos/machines/radio/source.nix
+6
nixos/machines/radio/source.nix
+28
nixos/machines/shodan/config.nix
+28
nixos/machines/shodan/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
<stockholm/lass>
6
+
7
+
<stockholm/lass/2configs/mouse.nix>
8
+
<stockholm/lass/2configs/retiolum.nix>
9
+
<stockholm/lass/2configs/baseX.nix>
10
+
<stockholm/lass/2configs/pipewire.nix>
11
+
<stockholm/lass/2configs/exim-retiolum.nix>
12
+
<stockholm/lass/2configs/browsers.nix>
13
+
<stockholm/lass/2configs/programs.nix>
14
+
<stockholm/lass/2configs/wine.nix>
15
+
<stockholm/lass/2configs/bitcoin.nix>
16
+
<stockholm/lass/2configs/yellow-mounts/samba.nix>
17
+
<stockholm/lass/2configs/fetchWallpaper.nix>
18
+
<stockholm/lass/2configs/consul.nix>
19
+
<stockholm/lass/2configs/snapclient.nix>
20
+
];
21
+
22
+
krebs.build.host = config.krebs.hosts.shodan;
23
+
24
+
services.logind.lidSwitch = "ignore";
25
+
services.logind.lidSwitchDocked = "ignore";
26
+
nix.trustedUsers = [ "root" "lass" ];
27
+
system.stateVersion = "22.05";
28
+
}
+45
nixos/machines/shodan/physical.nix
+45
nixos/machines/shodan/physical.nix
···
1
+
{
2
+
#TODO reinstall with correct layout and use lass/hw/x220
3
+
imports = [
4
+
./config.nix
5
+
<stockholm/krebs/2configs/hw/x220.nix>
6
+
];
7
+
8
+
boot = {
9
+
loader.grub.enable = true;
10
+
loader.grub.version = 2;
11
+
loader.grub.device = "/dev/sda";
12
+
13
+
initrd.luks.devices.lusksroot.device = "/dev/sda2";
14
+
initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
15
+
};
16
+
fileSystems = {
17
+
"/" = {
18
+
device = "/dev/pool/nix";
19
+
fsType = "btrfs";
20
+
};
21
+
22
+
"/boot" = {
23
+
device = "/dev/sda1";
24
+
};
25
+
"/home" = {
26
+
device = "/dev/mapper/pool-home";
27
+
fsType = "btrfs";
28
+
options = ["defaults" "noatime" "ssd" "compress=lzo"];
29
+
};
30
+
"/bku" = {
31
+
device = "/dev/pool/bku";
32
+
fsType = "btrfs";
33
+
};
34
+
"/backups" = {
35
+
device = "/dev/pool/backup";
36
+
fsType = "ext4";
37
+
};
38
+
};
39
+
40
+
services.udev.extraRules = ''
41
+
SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:29:26:bc", NAME="wl0"
42
+
SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:0c:a7:63", NAME="et0"
43
+
SUBSYSTEM=="net", ATTR{address}=="00:e0:4c:69:ea:71", NAME="int0"
44
+
'';
45
+
}
+112
nixos/machines/styx/config.nix
+112
nixos/machines/styx/config.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
../../default.nix
6
+
7
+
../../2configs/mouse.nix
8
+
../../2configs/retiolum.nix
9
+
../../2configs/baseX.nix
10
+
../../2configs/pipewire.nix
11
+
../../2configs/exim-retiolum.nix
12
+
../../2configs/browsers.nix
13
+
../../2configs/programs.nix
14
+
../../2configs/nfs-dl.nix
15
+
../../2configs/yellow-mounts/samba.nix
16
+
../../2configs/gg23.nix
17
+
../../2configs/hass
18
+
../../2configs/green-host.nix
19
+
../../2configs/fetchWallpaper.nix
20
+
../../2configs/home-media.nix
21
+
../../2configs/syncthing.nix
22
+
../../2configs/ppp/umts-stick.nix
23
+
../../2configs/snapserver.nix
24
+
../../2configs/snapclient.nix
25
+
../../2configs/consul.nix
26
+
];
27
+
28
+
krebs.build.host = config.krebs.hosts.styx;
29
+
30
+
networking.firewall.interfaces.int0.allowedTCPPorts = [ config.services.smokeping.port ];
31
+
networking.firewall.interfaces.retiolum.allowedTCPPorts = [ config.services.smokeping.port ];
32
+
networking.firewall.interfaces.wiregrill.allowedTCPPorts = [ config.services.smokeping.port ];
33
+
krebs.power-action.enable = mkForce false;
34
+
35
+
environment.systemPackages = with pkgs; [
36
+
wol
37
+
(writeDashBin "wake-alien" ''
38
+
${wol}/bin/wol -h 10.42.0.255 10:65:30:68:83:a3
39
+
'')
40
+
(writers.writeDashBin "iptv" ''
41
+
set -efu
42
+
/run/current-system/sw/bin/mpv \
43
+
--audio-display=no --audio-channels=stereo \
44
+
--audio-samplerate=48000 --audio-format=s16 \
45
+
--ao-pcm-file=/run/snapserver/snapfifo --ao=pcm \
46
+
--audio-delay=-1 \
47
+
--playlist=https://iptv-org.github.io/iptv/index.nsfw.m3u \
48
+
--idle=yes \
49
+
--input-ipc-server=/tmp/mpv.ipc \
50
+
"$@"
51
+
'')
52
+
];
53
+
54
+
users.users.mainUser.openssh.authorizedKeys.keys = [
55
+
config.krebs.users.lass-android.pubkey
56
+
];
57
+
# http://10.42.0.1:8081/smokeping.fcgi
58
+
services.smokeping = {
59
+
enable = true;
60
+
host = null;
61
+
targetConfig = ''
62
+
probe = FPing
63
+
menu = top
64
+
title = top
65
+
66
+
+ Local
67
+
menu = Local
68
+
title = Local Network
69
+
++ LocalMachine
70
+
menu = Local Machine
71
+
title = This host
72
+
host = localhost
73
+
74
+
+ Internet
75
+
menu = internet
76
+
title = internet
77
+
78
+
++ CloudflareDNS
79
+
menu = Cloudflare DNS
80
+
title = Cloudflare DNS server
81
+
host = 1.1.1.1
82
+
83
+
++ GoogleDNS
84
+
menu = Google DNS
85
+
title = Google DNS server
86
+
host = 8.8.8.8
87
+
88
+
+ retiolum
89
+
menu = retiolum
90
+
title = retiolum
91
+
92
+
++ gum
93
+
menu = gum.r
94
+
title = gum.r
95
+
host = gum.r
96
+
97
+
++ ni
98
+
menu = ni.r
99
+
title = ni.r
100
+
host = ni.r
101
+
102
+
++ prism
103
+
menu = prism.r
104
+
title = prism.r
105
+
host = prism.r
106
+
'';
107
+
};
108
+
109
+
# for usb internet
110
+
hardware.usbWwan.enable = true;
111
+
}
112
+
+38
nixos/machines/styx/physical.nix
+38
nixos/machines/styx/physical.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
./config.nix
6
+
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
7
+
];
8
+
9
+
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
10
+
boot.initrd.kernelModules = [ "dm-snapshot" ];
11
+
boot.kernelModules = [ "kvm-intel" ];
12
+
boot.extraModulePackages = [ ];
13
+
14
+
boot.loader.grub.enable = true;
15
+
boot.loader.grub.efiSupport = true;
16
+
boot.loader.grub.device = "/dev/disk/by-id/ata-SanDisk_SSD_G5_BICS4_20248F446514";
17
+
boot.loader.grub.efiInstallAsRemovable = true;
18
+
19
+
fileSystems."/" =
20
+
{ device = "/dev/disk/by-uuid/ee5c9099-17fa-401e-852e-67cb4ae068f4";
21
+
fsType = "ext4";
22
+
};
23
+
24
+
fileSystems."/boot" =
25
+
{ device = "/dev/disk/by-uuid/EAA5-88A9";
26
+
fsType = "vfat";
27
+
};
28
+
29
+
swapDevices = [ ];
30
+
31
+
nix.maxJobs = lib.mkDefault 4;
32
+
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
33
+
34
+
services.udev.extraRules = ''
35
+
SUBSYSTEM=="net", ATTR{address}=="3c:7c:3f:7e:e2:39", NAME="et0"
36
+
SUBSYSTEM=="net", ATTR{address}=="00:e0:4c:78:91:50", NAME="int0"
37
+
'';
38
+
}
+275
nixos/machines/ubik/config.nix
+275
nixos/machines/ubik/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
<stockholm/lass>
5
+
<stockholm/lass/2configs>
6
+
<stockholm/lass/2configs/retiolum.nix>
7
+
];
8
+
9
+
krebs.build.host = config.krebs.hosts.ubik;
10
+
11
+
krebs.sync-containers3.inContainer = {
12
+
enable = true;
13
+
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBFGMjH0+Dco6DVFZbByENMci8CFTLXCL7j53yctPnM";
14
+
};
15
+
16
+
security.acme = {
17
+
acceptTerms = true;
18
+
defaults.email = "acme@lassul.us";
19
+
};
20
+
networking.firewall.allowedTCPPorts = [ 80 443 ];
21
+
22
+
# nextcloud
23
+
services.nginx.virtualHosts."c.apanowicz.de" = {
24
+
enableACME = true;
25
+
forceSSL = true;
26
+
};
27
+
services.nextcloud = {
28
+
enable = true;
29
+
enableBrokenCiphersForSSE = false;
30
+
hostName = "c.apanowicz.de";
31
+
package = pkgs.nextcloud25;
32
+
config.adminpassFile = "/run/nextcloud.pw";
33
+
https = true;
34
+
maxUploadSize = "9001M";
35
+
};
36
+
systemd.services.nextcloud-setup.serviceConfig.ExecStartPre = [
37
+
"+${pkgs.writeDash "copy-pw" ''
38
+
${pkgs.rsync}/bin/rsync \
39
+
--chown nextcloud:nextcloud \
40
+
--chmod 0700 \
41
+
/var/src/secrets/nextcloud.pw /run/nextcloud.pw
42
+
''}"
43
+
];
44
+
45
+
# mail
46
+
lass.usershadow.enable = true;
47
+
services.nginx.virtualHosts."mail.ubikmedia.eu" = {
48
+
enableACME = true;
49
+
forceSSL = true;
50
+
};
51
+
services.roundcube = {
52
+
enable = true;
53
+
hostName = "mail.ubikmedia.eu";
54
+
extraConfig = ''
55
+
$config['smtp_debug'] = true;
56
+
$config['smtp_host'] = "localhost:25";
57
+
'';
58
+
};
59
+
services.dovecot2 = {
60
+
enable = true;
61
+
showPAMFailure = true;
62
+
mailLocation = "maildir:~/Mail";
63
+
sslServerCert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
64
+
sslServerKey = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
65
+
};
66
+
krebs.exim-smarthost = {
67
+
ssl_cert = "/var/lib/acme/mail.ubikmedia.eu/fullchain.pem";
68
+
ssl_key = "/var/lib/acme/mail.ubikmedia.eu/key.pem";
69
+
authenticators.PLAIN = ''
70
+
driver = plaintext
71
+
public_name = PLAIN
72
+
server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth2 $auth3}{yes}{no}}
73
+
'';
74
+
authenticators.LOGIN = ''
75
+
driver = plaintext
76
+
public_name = LOGIN
77
+
server_prompts = "Username:: : Password::"
78
+
server_condition = ''${run{/run/wrappers/bin/shadow_verify_arg ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
79
+
# server_condition = ''${run{/run/current-system/sw/bin/debug_exim ${config.lass.usershadow.pattern} $auth1 $auth2}{yes}{no}}
80
+
'';
81
+
internet-aliases = [
82
+
{ from = "dma@ubikmedia.de"; to = "domsen"; }
83
+
{ from = "dma@ubikmedia.eu"; to = "domsen"; }
84
+
{ from = "hallo@apanowicz.de"; to = "domsen"; }
85
+
{ from = "bruno@apanowicz.de"; to = "bruno"; }
86
+
{ from = "mail@jla-trading.com"; to = "jla-trading"; }
87
+
{ from = "jms@ubikmedia.eu"; to = "jms"; }
88
+
{ from = "ms@ubikmedia.eu"; to = "ms"; }
89
+
{ from = "ubik@ubikmedia.eu"; to = "domsen, jms, ms"; }
90
+
{ from = "kontakt@alewis.de"; to ="klabusterbeere"; }
91
+
{ from = "hallo@jarugadesign.de"; to ="kasia"; }
92
+
{ from = "noreply@beeshmooth.ch"; to ="besmooth@gmx.ch"; }
93
+
94
+
{ from = "testuser@ubikmedia.eu"; to = "testuser"; }
95
+
];
96
+
sender_domains = [
97
+
"jla-trading.com"
98
+
"ubikmedia.eu"
99
+
"ubikmedia.de"
100
+
"apanowicz.de"
101
+
"alewis.de"
102
+
"jarugadesign.de"
103
+
"beesmooth.ch"
104
+
"event-extra.de"
105
+
];
106
+
dkim = [
107
+
{ domain = "ubikmedia.eu"; }
108
+
{ domain = "apanowicz.de"; }
109
+
{ domain = "beesmooth.ch"; }
110
+
];
111
+
};
112
+
113
+
# users
114
+
users.users.UBIK-SFTP = {
115
+
uid = pkgs.stockholm.lib.genid_uint31 "UBIK-SFTP";
116
+
home = "/home/UBIK-SFTP";
117
+
useDefaultShell = true;
118
+
createHome = true;
119
+
isNormalUser = true;
120
+
};
121
+
122
+
users.users.xanf = {
123
+
uid = pkgs.stockholm.lib.genid_uint31 "xanf";
124
+
group = "xanf";
125
+
home = "/home/xanf";
126
+
useDefaultShell = true;
127
+
createHome = false; # creathome forces permissions
128
+
isNormalUser = true;
129
+
};
130
+
131
+
users.users.domsen = {
132
+
uid = pkgs.stockholm.lib.genid_uint31 "domsen";
133
+
description = "maintenance acc for domsen";
134
+
home = "/home/domsen";
135
+
useDefaultShell = true;
136
+
extraGroups = [ "syncthing" "download" "xanf" ];
137
+
createHome = true;
138
+
isNormalUser = true;
139
+
};
140
+
141
+
users.users.bruno = {
142
+
uid = pkgs.stockholm.lib.genid_uint31 "bruno";
143
+
home = "/home/bruno";
144
+
useDefaultShell = true;
145
+
createHome = true;
146
+
isNormalUser = true;
147
+
};
148
+
149
+
users.users.jla-trading = {
150
+
uid = pkgs.stockholm.lib.genid_uint31 "jla-trading";
151
+
home = "/home/jla-trading";
152
+
useDefaultShell = true;
153
+
createHome = true;
154
+
isNormalUser = true;
155
+
};
156
+
157
+
users.users.jms = {
158
+
uid = pkgs.stockholm.lib.genid_uint31 "jms";
159
+
home = "/home/jms";
160
+
useDefaultShell = true;
161
+
createHome = true;
162
+
isNormalUser = true;
163
+
};
164
+
165
+
users.users.ms = {
166
+
uid = pkgs.stockholm.lib.genid_uint31 "ms";
167
+
home = "/home/ms";
168
+
useDefaultShell = true;
169
+
createHome = true;
170
+
isNormalUser = true;
171
+
};
172
+
173
+
users.users.testuser = {
174
+
uid = pkgs.stockholm.lib.genid_uint31 "testuser";
175
+
home = "/home/testuser";
176
+
useDefaultShell = true;
177
+
createHome = true;
178
+
isNormalUser = true;
179
+
};
180
+
181
+
users.users.bui = {
182
+
uid = pkgs.stockholm.lib.genid_uint31 "bui";
183
+
home = "/home/bui";
184
+
useDefaultShell = true;
185
+
createHome = true;
186
+
isNormalUser = true;
187
+
};
188
+
189
+
users.users.klabusterbeere = {
190
+
uid = pkgs.stockholm.lib.genid_uint31 "klabusterbeere";
191
+
home = "/home/klabusterbeere";
192
+
useDefaultShell = true;
193
+
createHome = true;
194
+
isNormalUser = true;
195
+
};
196
+
197
+
users.users.kasia = {
198
+
uid = pkgs.stockholm.lib.genid_uint31 "kasia";
199
+
home = "/home/kasia";
200
+
useDefaultShell = true;
201
+
createHome = true;
202
+
isNormalUser = true;
203
+
};
204
+
205
+
users.users.XANF_TEAM = {
206
+
uid = pkgs.stockholm.lib.genid_uint31 "XANF_TEAM";
207
+
group = "xanf";
208
+
home = "/home/XANF_TEAM";
209
+
useDefaultShell = true;
210
+
createHome = true;
211
+
isNormalUser = true;
212
+
};
213
+
214
+
users.users.dif = {
215
+
uid = pkgs.stockholm.lib.genid_uint31 "dif";
216
+
home = "/home/dif";
217
+
useDefaultShell = true;
218
+
extraGroups = [ "xanf" ];
219
+
createHome = true;
220
+
isNormalUser = true;
221
+
};
222
+
223
+
users.users.lavafilms = {
224
+
uid = pkgs.stockholm.lib.genid_uint31 "lavafilms";
225
+
home = "/home/lavafilms";
226
+
useDefaultShell = true;
227
+
extraGroups = [ "xanf" ];
228
+
createHome = true;
229
+
isNormalUser = true;
230
+
};
231
+
232
+
users.users.movematchers = {
233
+
uid = pkgs.stockholm.lib.genid_uint31 "movematchers";
234
+
home = "/home/movematchers";
235
+
useDefaultShell = true;
236
+
extraGroups = [ "xanf" ];
237
+
createHome = true;
238
+
isNormalUser = true;
239
+
};
240
+
241
+
users.users.blackphoton = {
242
+
uid = pkgs.stockholm.lib.genid_uint31 "blackphoton";
243
+
home = "/home/blackphoton";
244
+
useDefaultShell = true;
245
+
extraGroups = [ "xanf" ];
246
+
createHome = true;
247
+
isNormalUser = true;
248
+
};
249
+
250
+
users.users.line = {
251
+
uid = pkgs.stockholm.lib.genid_uint31 "line";
252
+
home = "/home/line";
253
+
useDefaultShell = true;
254
+
# extraGroups = [ "xanf" ];
255
+
createHome = true;
256
+
isNormalUser = true;
257
+
};
258
+
259
+
users.users.avada = {
260
+
uid = pkgs.stockholm.lib.genid_uint31 "avada";
261
+
home = "/home/avada";
262
+
useDefaultShell = true;
263
+
createHome = true;
264
+
isNormalUser = true;
265
+
};
266
+
267
+
users.users.familienrat = {
268
+
uid = pkgs.stockholm.lib.genid_uint31 "familienrat";
269
+
home = "/home/familienrat";
270
+
useDefaultShell = true;
271
+
createHome = true;
272
+
isNormalUser = true;
273
+
};
274
+
275
+
}
+7
nixos/machines/ubik/physical.nix
+7
nixos/machines/ubik/physical.nix
+286
nixos/machines/wizard/config.nix
+286
nixos/machines/wizard/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
let
4
+
5
+
icon = pkgs.writeText "icon" ''
6
+
//
7
+
//
8
+
_ //
9
+
.' . // '.
10
+
'_ '_\/_' `_
11
+
. . \\ . .
12
+
.==. ` \\' .'
13
+
.\| //bd\\ \,
14
+
\_'`._\\__//_.'`.;
15
+
`.__ __,' \\
16
+
| | \\
17
+
| | `
18
+
| |
19
+
| |
20
+
|____|
21
+
l42 ==' '==
22
+
'';
23
+
24
+
messenger = pkgs.writeText "message" ''
25
+
.
26
+
| \/|
27
+
(\ _ ) )|/|
28
+
(/ _----. /.'.'
29
+
.-._________.. .' @ _\ .'
30
+
'.._______. '. / (_| .')
31
+
'._____. / '-/ | _.'
32
+
'.______ ( ) ) \
33
+
'..____ '._ ) )
34
+
.' __.--\ , , // ((
35
+
'.' mrf| \/ (_.'(
36
+
' \ .'
37
+
\ (
38
+
\ '.
39
+
\ \ '.)
40
+
'-'-'
41
+
'';
42
+
43
+
waiting = pkgs.writeText "waiting" ''
44
+
Z
45
+
Z
46
+
z
47
+
z
48
+
* '
49
+
/ \
50
+
/___\
51
+
( - - )
52
+
) L ( .--------------.
53
+
__()(-)()__ | \ |
54
+
.~~ )()()() ~. | . :
55
+
/ )()() ` | `-.__________)
56
+
| )() ~ | : :
57
+
| ) | : |
58
+
| _ | | [ ## :
59
+
\ ~~-. | , oo_______.'
60
+
`_ ( \) _____/~~~~ `--___
61
+
| ~`-) ) `-. `--- ( - a:f -
62
+
| '///` | `-.
63
+
| | | | `-.
64
+
| | | | `-.
65
+
| | |\ |
66
+
| | | \|
67
+
`-. | | |
68
+
`-| '
69
+
'';
70
+
71
+
wizard = pkgs.writers.writeDash "wizard" ''
72
+
cat ${icon}
73
+
74
+
echo -n '${''
75
+
welcome to the computer wizard
76
+
first we will check for internet connectivity
77
+
78
+
''}'
79
+
80
+
read -p '(press enter to continue...)' key
81
+
until ping -c1 8.8.8.8; do
82
+
${pkgs.nm-dmenu}/bin/nm-dmenu
83
+
done
84
+
85
+
mode=$(echo -n '${''
86
+
1. Help of the wizard
87
+
2. Install NixOS
88
+
3. I know what I need to do
89
+
''}' | ${pkgs.fzf}/bin/fzf --reverse)
90
+
case "$mode" in
91
+
1*)
92
+
echo 'mode_1' > /tmp/mode
93
+
clear
94
+
echo 'waiting for the messenger to reach the wizard'
95
+
cat ${messenger}
96
+
97
+
# get pubkeys
98
+
mkdir -p /root/.ssh/
99
+
touch /root/.ssh/authorized_keys
100
+
curl -Ss 'https://lassul.us/mors.pub' >> /root/.ssh/authorized_keys
101
+
curl -Ss 'https://lassul.us/blue.pub' >> /root/.ssh/authorized_keys
102
+
curl -Ss 'https://lassul.us/yubi.pub' >> /root/.ssh/authorized_keys
103
+
104
+
# write via irc
105
+
systemctl start hidden-ssh-announce.service
106
+
tmux new-session -s help ${pkgs.writers.writeDash "waiting" ''
107
+
cat ${waiting}
108
+
read -p 'waiting for the wizard to wake up' key
109
+
${pkgs.bashInteractive}/bin/bash
110
+
''}
111
+
;;
112
+
2*)
113
+
echo 'mode_2' > /tmp/mode
114
+
${pkgs.nixos-installer}/bin/nixos-installer
115
+
;;
116
+
3*)
117
+
echo 'mode_3' > /tmp/mode
118
+
;;
119
+
*)
120
+
echo 'no mode selected'
121
+
;;
122
+
esac
123
+
'';
124
+
125
+
in {
126
+
imports = [
127
+
<stockholm/krebs>
128
+
<stockholm/lass/3modules>
129
+
<stockholm/lass/2configs/vim.nix>
130
+
# <nixpkgs/nixos/modules/installer/cd-dvd/installation-cd-base.nix>
131
+
{
132
+
nixpkgs.config.packageOverrides = import <stockholm/lass/5pkgs> pkgs;
133
+
krebs.enable = true;
134
+
krebs.build.user = config.krebs.users.lass;
135
+
krebs.build.host = {};
136
+
}
137
+
# {
138
+
# systemd.services.wizard = {
139
+
# description = "Computer Wizard";
140
+
# wantedBy = [ "multi-user.target" ];
141
+
# serviceConfig = {
142
+
# ExecStart = pkgs.writers.writeDash "wizard" ''
143
+
# set -efu
144
+
# cat <<EOF
145
+
# welcome to the computer wizard
146
+
# you can choose between the following modes
147
+
# echo -n '1\n2\n3' | ${pkgs.fzf}/bin/fzf
148
+
# EOF
149
+
# '';
150
+
# StandardInput = "tty";
151
+
# StandardOutput = "tty";
152
+
# # TTYPath = "/dev/tty1";
153
+
# TTYPath = "/dev/ttyS0";
154
+
# TTYReset = true;
155
+
# TTYVTDisallocate = true;
156
+
# Restart = "always";
157
+
# };
158
+
# };
159
+
# }
160
+
];
161
+
162
+
networking.hostName = "wizard";
163
+
nixpkgs.config.allowUnfree = true;
164
+
165
+
# users.extraUsers = {
166
+
# root = {
167
+
# openssh.authorizedKeys.keys = [
168
+
# config.krebs.users.lass.pubkey
169
+
# config.krebs.users.lass-mors.pubkey
170
+
# ];
171
+
# };
172
+
# };
173
+
174
+
environment.systemPackages = with pkgs; [
175
+
#stockholm
176
+
git
177
+
gnumake
178
+
jq
179
+
parallel
180
+
proot
181
+
populate
182
+
183
+
#style
184
+
most
185
+
rxvt-unicode-unwrapped.terminfo
186
+
187
+
#monitoring tools
188
+
htop
189
+
iotop
190
+
191
+
#network
192
+
iptables
193
+
iftop
194
+
nm-dmenu
195
+
196
+
#stuff for dl
197
+
aria2
198
+
199
+
#neat utils
200
+
chntpw
201
+
hashPassword
202
+
krebspaste
203
+
pciutils
204
+
psmisc
205
+
tmux
206
+
usbutils
207
+
208
+
#unpack stuff
209
+
p7zip
210
+
unzip
211
+
unrar
212
+
213
+
#data recovery
214
+
ddrescue
215
+
ntfs3g
216
+
dosfstools
217
+
218
+
nixos-installer
219
+
];
220
+
221
+
environment.extraInit = ''
222
+
EDITOR=vim
223
+
'';
224
+
225
+
programs.bash = {
226
+
enableCompletion = true;
227
+
interactiveShellInit = ''
228
+
HISTCONTROL='erasedups:ignorespace'
229
+
HISTSIZE=65536
230
+
HISTFILESIZE=$HISTSIZE
231
+
232
+
shopt -s checkhash
233
+
shopt -s histappend histreedit histverify
234
+
shopt -s no_empty_cmd_completion
235
+
complete -d cd
236
+
'';
237
+
promptInit = ''
238
+
if test $UID = 0; then
239
+
PS1='\[\033[1;31m\]\w\[\033[0m\] '
240
+
PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
241
+
elif test $UID = 1337; then
242
+
PS1='\[\033[1;32m\]\w\[\033[0m\] '
243
+
PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
244
+
else
245
+
PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
246
+
PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
247
+
fi
248
+
if test -n "$SSH_CLIENT"; then
249
+
PS1='\[\033[35m\]\h'" $PS1"
250
+
PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
251
+
fi
252
+
if ! test -e /tmp/mode; then
253
+
${wizard}
254
+
fi
255
+
'';
256
+
};
257
+
258
+
services.openssh.enable = true;
259
+
systemd.services.sshd.wantedBy = mkForce [ "multi-user.target" ];
260
+
261
+
networking.firewall = {
262
+
enable = true;
263
+
allowedTCPPorts = [ 22 ];
264
+
};
265
+
networking.networkmanager.enable = true;
266
+
networking.wireless.enable = mkForce false;
267
+
268
+
krebs.hidden-ssh = {
269
+
enable = true;
270
+
channel = "##lassulus-wizard";
271
+
message = "lassulus: torify sshn root@";
272
+
};
273
+
systemd.services.hidden-ssh-announce.wantedBy = mkForce [];
274
+
services.getty.autologinUser = lib.mkForce "root";
275
+
276
+
nixpkgs.config.packageOverrides = super: {
277
+
dmenu = pkgs.writeDashBin "dmenu" ''
278
+
${pkgs.fzf}/bin/fzf \
279
+
--history=/dev/null \
280
+
--print-query \
281
+
--prompt=\"$PROMPT\"
282
+
'';
283
+
};
284
+
285
+
boot.tmpOnTmpfs = true;
286
+
}
+7
nixos/machines/wizard/generate-iso.sh
+7
nixos/machines/wizard/generate-iso.sh
+7
nixos/machines/wizard/run-vm.sh
+7
nixos/machines/wizard/run-vm.sh
+10
nixos/machines/wizard/test.nix
+10
nixos/machines/wizard/test.nix
+76
nixos/machines/xerxes/config.nix
+76
nixos/machines/xerxes/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
{
4
+
imports = [
5
+
<stockholm/lass>
6
+
7
+
<stockholm/lass/2configs/retiolum.nix>
8
+
<stockholm/lass/2configs/exim-retiolum.nix>
9
+
<stockholm/lass/2configs/baseX.nix>
10
+
<stockholm/lass/2configs/pipewire.nix>
11
+
<stockholm/lass/2configs/browsers.nix>
12
+
<stockholm/lass/2configs/programs.nix>
13
+
<stockholm/lass/2configs/network-manager.nix>
14
+
<stockholm/lass/2configs/syncthing.nix>
15
+
<stockholm/lass/2configs/sync/sync.nix>
16
+
<stockholm/lass/2configs/steam.nix>
17
+
<stockholm/lass/2configs/wine.nix>
18
+
<stockholm/lass/2configs/fetchWallpaper.nix>
19
+
<stockholm/lass/2configs/pass.nix>
20
+
<stockholm/lass/2configs/mail.nix>
21
+
];
22
+
23
+
krebs.build.host = config.krebs.hosts.xerxes;
24
+
25
+
environment.shellAliases = {
26
+
deploy = pkgs.writeDash "deploy" ''
27
+
set -eu
28
+
export SYSTEM="$1"
29
+
$(nix-build $HOME/sync/stockholm/lass/krops.nix --no-out-link --argstr name "$SYSTEM" -A deploy)
30
+
'';
31
+
usb-tether-on = pkgs.writeDash "usb-tether-on" ''
32
+
adb shell su -c service call connectivity 33 i32 1 s16 text
33
+
'';
34
+
usb-tether-off = pkgs.writeDash "usb-tether-off" ''
35
+
adb shell su -c service call connectivity 33 i32 0 s16 text
36
+
'';
37
+
};
38
+
39
+
services.xserver = {
40
+
displayManager.lightdm.autoLogin.enable = true;
41
+
displayManager.lightdm.autoLogin.user = "lass";
42
+
};
43
+
44
+
boot.blacklistedKernelModules = [ "xpad" ];
45
+
systemd.services.xboxdrv = {
46
+
wantedBy = [ "multi-user.target" ];
47
+
script = ''
48
+
${pkgs.xboxdrv.overrideAttrs(o: {
49
+
patches = o.patches ++ [ (pkgs.fetchurl {
50
+
url = "https://patch-diff.githubusercontent.com/raw/xboxdrv/xboxdrv/pull/251.patch";
51
+
sha256 = "17784y20mxqrlhgvwvszh8lprxrvgmb7ah9dknmbhj5jhkjl8wq5";
52
+
}) ];
53
+
})}/bin/xboxdrv --type xbox360 --dbus disabled -D
54
+
'';
55
+
};
56
+
57
+
programs.adb.enable = true;
58
+
59
+
services.logind.lidSwitch = "suspend";
60
+
lass.screenlock.enable = lib.mkForce false;
61
+
62
+
hardware.bluetooth = {
63
+
enable = true;
64
+
powerOnBoot = true;
65
+
};
66
+
hardware.pulseaudio.package = pkgs.pulseaudioFull;
67
+
# hardware.pulseaudio.configFile = pkgs.writeText "default.pa" ''
68
+
# load-module module-bluetooth-policy
69
+
# load-module module-bluetooth-discover
70
+
# ## module fails to load with
71
+
# ## module-bluez5-device.c: Failed to get device path from module arguments
72
+
# ## module.c: Failed to load module "module-bluez5-device" (argument: ""): initialization failed.
73
+
# # load-module module-bluez5-device
74
+
# # load-module module-bluez5-discover
75
+
# '';
76
+
}
+73
nixos/machines/xerxes/physical.nix
+73
nixos/machines/xerxes/physical.nix
···
1
+
{ pkgs, lib, ... }:
2
+
{
3
+
imports = [
4
+
./config.nix
5
+
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
6
+
];
7
+
8
+
boot.loader.grub = {
9
+
enable = true;
10
+
device = "/dev/sda";
11
+
efiSupport = true;
12
+
efiInstallAsRemovable = true;
13
+
};
14
+
15
+
boot.blacklistedKernelModules = [
16
+
"sdhci_pci"
17
+
];
18
+
19
+
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
20
+
boot.initrd.luks.devices.crypted.device = "/dev/sda3";
21
+
boot.kernelModules = [ "kvm-intel" ];
22
+
boot.kernelParams = [
23
+
"fbcon=rotate:1"
24
+
"boot.shell_on_fail"
25
+
];
26
+
27
+
fileSystems."/" = {
28
+
device = "/dev/disk/by-uuid/8efd0c22-f712-46bf-baad-1fbf19d9ec25";
29
+
fsType = "xfs";
30
+
};
31
+
32
+
fileSystems."/boot" = {
33
+
device = "/dev/disk/by-uuid/7F23-DDB4";
34
+
fsType = "vfat";
35
+
};
36
+
37
+
swapDevices = [ ];
38
+
39
+
boot.extraModprobeConfig = ''
40
+
options zfs zfs_arc_max=107374182
41
+
'';
42
+
43
+
nix.maxJobs = lib.mkDefault 4;
44
+
45
+
networking.hostId = "9b0a74ac";
46
+
networking.networkmanager.enable = true;
47
+
48
+
hardware.opengl.enable = true;
49
+
50
+
services.tlp.enable = true;
51
+
services.tlp.extraConfig = ''
52
+
CPU_SCALING_GOVERNOR_ON_AC=ondemand
53
+
CPU_SCALING_GOVERNOR_ON_BAT=powersave
54
+
CPU_MIN_PERF_ON_AC=0
55
+
CPU_MAX_PERF_ON_AC=100
56
+
CPU_MIN_PERF_ON_BAT=0
57
+
CPU_MAX_PERF_ON_BAT=30
58
+
'';
59
+
60
+
services.logind.extraConfig = ''
61
+
HandlePowerKey=suspend
62
+
IdleAction=suspend
63
+
IdleActionSec=300
64
+
'';
65
+
66
+
services.xserver = {
67
+
videoDrivers = [ "intel" ];
68
+
displayManager.sessionCommands = ''
69
+
(sleep 2 && ${pkgs.xorg.xrandr}/bin/xrandr --output eDP1 --rotate right)
70
+
(sleep 2 && ${pkgs.xorg.xinput}/bin/xinput set-prop "pointer:Goodix Capacitive TouchScreen" --type=float "Coordinate Transformation Matrix" 0 1 0 -1 0 1 0 0 1)
71
+
'';
72
+
};
73
+
}
+45
nixos/machines/yellow/config.nix
+45
nixos/machines/yellow/config.nix
···
1
+
{ config, lib, pkgs, ... }: let
2
+
vpnPort = 1637;
3
+
torrentport = 56709; # port forwarded in airvpn webinterface
4
+
in {
5
+
imports = [
6
+
<stockholm/lass>
7
+
<stockholm/lass/2configs>
8
+
<stockholm/lass/2configs/retiolum.nix>
9
+
<stockholm/lass/2configs/services/flix>
10
+
];
11
+
12
+
krebs.build.host = config.krebs.hosts.yellow;
13
+
14
+
krebs.sync-containers3.inContainer = {
15
+
enable = true;
16
+
pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN737BAP36KiZO97mPKTIUGJUcr97ps8zjfFag6cUiYL";
17
+
};
18
+
19
+
networking.useHostResolvConf = false;
20
+
networking.useNetworkd = true;
21
+
22
+
networking.wg-quick.interfaces.airvpn.configFile = "/var/src/secrets/airvpn.conf";
23
+
services.transmission.settings.peer-port = torrentport;
24
+
25
+
# only allow traffic through openvpn
26
+
krebs.iptables = {
27
+
enable = true;
28
+
tables.filter.INPUT.rules = [
29
+
{ predicate = "-i airvpn -p tcp --dport ${toString torrentport}"; target = "ACCEPT"; }
30
+
{ predicate = "-i airvpn -p udp --dport ${toString torrentport}"; target = "ACCEPT"; }
31
+
];
32
+
tables.filter.OUTPUT = {
33
+
policy = "DROP";
34
+
rules = [
35
+
{ predicate = "-o lo"; target = "ACCEPT"; }
36
+
{ predicate = "-p udp --dport ${toString vpnPort}"; target = "ACCEPT"; }
37
+
{ predicate = "-o airvpn"; target = "ACCEPT"; }
38
+
{ predicate = "-o retiolum"; target = "ACCEPT"; }
39
+
{ v6 = false; predicate = "-d 1.1.1.1/32"; target = "ACCEPT"; }
40
+
{ v6 = false; predicate = "-d 1.0.0.1/32"; target = "ACCEPT"; }
41
+
{ v6 = false; predicate = "-o eth0 -d 10.233.2.0/24"; target = "ACCEPT"; }
42
+
];
43
+
};
44
+
};
45
+
}
+7
nixos/machines/yellow/physical.nix
+7
nixos/machines/yellow/physical.nix
+45
nixos/machines/yubi/config.nix
+45
nixos/machines/yubi/config.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
3
+
# cryptsetup luksOpen /dev/xxx mmc
4
+
# mkdir /mnt
5
+
# mount /dev/mapper/mmc /mnt
6
+
# rm -rf $GNUPGHOME
7
+
# cp -rv /mnt/gnupghome $GNUPGHOME
8
+
#
9
+
### change yubikey pin
10
+
# gpg --card-edit
11
+
# > admin
12
+
# > passwd
13
+
# > 1
14
+
# > > 123456
15
+
# > > $newpin
16
+
# > 3
17
+
# > > 12345678
18
+
# > > $newpuk
19
+
#
20
+
### transfer keys
21
+
# gpg --edit-key $keyid
22
+
#
23
+
# for x in 1 2 3
24
+
# > key $x
25
+
# > expire
26
+
# > 2y
27
+
# > keytocard
28
+
# > > $newpuk
29
+
# > key $x (to unselect)
30
+
31
+
{
32
+
services.pcscd.enable = true;
33
+
services.udev.packages = [ yubikey-personalization ];
34
+
35
+
environment.systemPackages = [ gnupg pinentry-curses pinentry-qt paperkey wget ];
36
+
37
+
programs = {
38
+
ssh.startAgent = false;
39
+
gnupg.agent = {
40
+
enable = true;
41
+
enableSSHSupport = true;
42
+
};
43
+
};
44
+
boot.tmpOnTmpfs = true;
45
+
}
+7
nixos/machines/yubi/generate-iso.sh
+7
nixos/machines/yubi/generate-iso.sh
+7
nixos/machines/yubi/run-vm.sh
+7
nixos/machines/yubi/run-vm.sh
+10
nixos/machines/yubi/test.nix
+10
nixos/machines/yubi/test.nix
+1
nixos/2configs/hass/pyscript/.gitignore
+1
nixos/2configs/hass/pyscript/.gitignore
···
1
+
hass_token
+26
nixos/2configs/hass/pyscript/default.nix
+26
nixos/2configs/hass/pyscript/default.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
systemd.tmpfiles.rules = [
4
+
"L+ /var/lib/hass/custom_components/pyscript - - - - ${pkgs.fetchzip {
5
+
url = "https://github.com/custom-components/pyscript/releases/download/1.3.2/hass-custom-pyscript.zip";
6
+
sha256 = "0cqdjj46s5xp4mqxb0ic790jm1xp3z0zr2n9f7bsfl5zpvdshl8z";
7
+
stripRoot = false;
8
+
}}"
9
+
];
10
+
11
+
services.home-assistant = {
12
+
package = (pkgs.home-assistant.overrideAttrs (old: {
13
+
doInstallCheck = false;
14
+
})).override {
15
+
extraPackages = pp: [ pp.croniter ];
16
+
};
17
+
config.pyscript = {
18
+
allow_all_imports = true;
19
+
hass_is_global = true;
20
+
};
21
+
};
22
+
23
+
networking.firewall.interfaces.retiolum.allowedTCPPortRanges = [
24
+
{ from = 50321; to = 50341; } # for ipython interactive debugging
25
+
];
26
+
}
+51
nixos/2configs/hass/pyscript/shell.nix
+51
nixos/2configs/hass/pyscript/shell.nix
···
1
+
{ pkgs ? import <nixpkgs> {} }: let
2
+
3
+
hass_host = "styx.r";
4
+
hass_token = builtins.readFile ./hass_token;
5
+
6
+
mach-nix = import (builtins.fetchGit {
7
+
url = "https://github.com/DavHau/mach-nix/";
8
+
ref = "refs/tags/3.4.0";
9
+
}) {
10
+
pkgs = pkgs;
11
+
};
12
+
pyenv = mach-nix.mkPython {
13
+
requirements = ''
14
+
hass_pyscript_kernel
15
+
'';
16
+
};
17
+
jupyter = import (builtins.fetchGit {
18
+
url = https://github.com/tweag/jupyterWith;
19
+
ref = "master";
20
+
}) {};
21
+
22
+
pyscriptKernel = {
23
+
spec = pkgs.runCommand "pyscript" {} ''
24
+
mkdir -p $out/kernels/pyscript
25
+
cp ${kernel_json} $out/kernels/pyscript/kernel.json
26
+
cp ${pyscript_conf} $out/kernels/pyscript/pyscript.conf
27
+
'';
28
+
runtimePackages = [ pyenv ];
29
+
};
30
+
31
+
kernel_json = pkgs.writeText "kernel.json" (builtins.toJSON {
32
+
argv = [
33
+
"${pyenv}/bin/python3" "-m" "hass_pyscript_kernel"
34
+
"-f" "{connection_file}"
35
+
];
36
+
display_name = "hass_pyscript";
37
+
language = "python";
38
+
});
39
+
40
+
pyscript_conf = pkgs.writeText "pyscript.conf" ''
41
+
[homeassistant]
42
+
hass_host = ${hass_host}
43
+
hass_url = http://''${hass_host}:8123
44
+
hass_token = ${hass_token}
45
+
'';
46
+
47
+
jupyterEnvironment = jupyter.jupyterlabWith {
48
+
kernels = [ pyscriptKernel ];
49
+
};
50
+
51
+
in jupyterEnvironment.env
+39
nixos/2configs/hass/rooms/bett.nix
+39
nixos/2configs/hass/rooms/bett.nix
···
1
+
{ lib, ... }:
2
+
with import ../lib.nix { inherit lib; };
3
+
4
+
{
5
+
services.home-assistant.config = lib.mkMerge [
6
+
(lightswitch "bett" switches.dimmer.bett lights.bett)
7
+
];
8
+
9
+
# lass.hass.love = {
10
+
# resources = [{
11
+
# url = "https://raw.githubusercontent.com/ljmerza/light-entity-card/master/dist/light-entity-card.js.map";
12
+
# type = "js";
13
+
# }];
14
+
# views = [{
15
+
# title = "bett";
16
+
# cards = [
17
+
# {
18
+
# type = "markdown";
19
+
# title = "hello world";
20
+
# content = "This is just a test";
21
+
# }
22
+
# {
23
+
# type = "light";
24
+
# entity = "light.${lights.bett}";
25
+
# }
26
+
# {
27
+
# type = "custom:light-entity-card";
28
+
# entity = "light.${lights.bett}";
29
+
# }
30
+
# {
31
+
# type = "history-graph";
32
+
# entities = [
33
+
# "light.${lights.bett}"
34
+
# ];
35
+
# }
36
+
# ];
37
+
# }];
38
+
# };
39
+
}
+9
nixos/2configs/hass/rooms/essen.nix
+9
nixos/2configs/hass/rooms/essen.nix
+10
nixos/2configs/hass/rooms/nass.nix
+10
nixos/2configs/hass/rooms/nass.nix
+6
nixos/2configs/services/coms/default.nix
+6
nixos/2configs/services/coms/default.nix
+43
nixos/2configs/services/coms/jitsi.nix
+43
nixos/2configs/services/coms/jitsi.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
4
+
services.jitsi-meet = {
5
+
enable = true;
6
+
hostName = "jitsi.lassul.us";
7
+
config = {
8
+
enableWelcomePage = true;
9
+
requireDisplayName = true;
10
+
analytics.disabled = true;
11
+
startAudioOnly = true;
12
+
channelLastN = 4;
13
+
stunServers = [
14
+
# - https://www.kuketz-blog.de/jitsi-meet-server-einstellungen-fuer-einen-datenschutzfreundlichen-betrieb/
15
+
{ urls = "turn:turn.matrix.org:3478?transport=udp"; }
16
+
{ urls = "turn:turn.matrix.org:3478?transport=tcp"; }
17
+
# - services.coturn:
18
+
#{ urls = "turn:turn.${domainName}:3479?transport=udp"; }
19
+
#{ urls = "turn:turn.${domainName}:3479?transport=tcp"; }
20
+
];
21
+
constraints.video.height = {
22
+
ideal = 720;
23
+
max = 1080;
24
+
min = 240;
25
+
};
26
+
};
27
+
interfaceConfig = {
28
+
SHOW_JITSI_WATERMARK = false;
29
+
SHOW_WATERMARK_FOR_GUESTS = false;
30
+
DISABLE_PRESENCE_STATUS = true;
31
+
GENERATE_ROOMNAMES_ON_WELCOME_PAGE = false;
32
+
};
33
+
};
34
+
35
+
services.jitsi-videobridge.config = {
36
+
org.jitsi.videobridge.TRUST_BWE = false;
37
+
};
38
+
39
+
krebs.iptables.tables.filter.INPUT.rules = [
40
+
{ predicate = "-p tcp --dport 4443"; target = "ACCEPT"; }
41
+
{ predicate = "-p udp --dport 10000"; target = "ACCEPT"; }
42
+
];
43
+
}
+47
nixos/2configs/services/coms/murmur.nix
+47
nixos/2configs/services/coms/murmur.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
services.murmur = {
4
+
enable = true;
5
+
# allowHtml = false;
6
+
bandwidth = 10000000;
7
+
registerName = "lassul.us";
8
+
autobanTime = 30;
9
+
sslCert = "/var/lib/acme/lassul.us/cert.pem";
10
+
sslKey = "/var/lib/acme/lassul.us/key.pem";
11
+
extraConfig = ''
12
+
opusthreshold=0
13
+
# rememberchannelduration=10000
14
+
'';
15
+
};
16
+
krebs.iptables.tables.filter.INPUT.rules = [
17
+
{ predicate = "-p tcp --dport 64738"; target = "ACCEPT";}
18
+
{ predicate = "-p udp --dport 64738"; target = "ACCEPT";}
19
+
];
20
+
21
+
# services.botamusique = {
22
+
# enable = true;
23
+
# settings = {
24
+
# server.host = "lassul.us";
25
+
# bot.auto_check_updates = false;
26
+
# bot.max_track_duration = 360;
27
+
# webinterface.enabled = true;
28
+
# };
29
+
# };
30
+
31
+
services.nginx.virtualHosts."lassul.us" = {
32
+
enableACME = true;
33
+
};
34
+
security.acme.certs."lassul.us" = {
35
+
group = "lasscert";
36
+
};
37
+
users.groups.lasscert.members = [
38
+
"nginx"
39
+
"murmur"
40
+
];
41
+
42
+
# services.nginx.virtualHosts."bota.r" = {
43
+
# locations."/" = {
44
+
# proxyPass = "http://localhost:8181";
45
+
# };
46
+
# };
47
+
}
+41
nixos/2configs/services/coms/proxy.nix
+41
nixos/2configs/services/coms/proxy.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
tcpports = [
4
+
4443 # jitsi
5
+
64738 # murmur
6
+
];
7
+
udpports = [
8
+
10000 # jitsi
9
+
64738 # murmur
10
+
];
11
+
target = "orange.r";
12
+
in
13
+
{
14
+
networking.firewall.allowedTCPPorts = tcpports;
15
+
networking.firewall.allowedUDPPorts = udpports;
16
+
services.nginx.streamConfig = ''
17
+
${lib.concatMapStringsSep "\n" (port: ''
18
+
server {
19
+
listen [::]:${toString port};
20
+
listen ${toString port};
21
+
proxy_pass ${target}:${toString port};
22
+
}
23
+
'') tcpports}
24
+
'';
25
+
26
+
krebs.iptables.tables.nat.PREROUTING.rules = lib.flatten (map (port: [
27
+
{ predicate = "-p udp --dport ${toString port}"; target = "DNAT --to-destination ${config.krebs.hosts.orange.nets.retiolum.ip4.addr}:${toString port}"; v6 = false; }
28
+
{ predicate = "-p udp --dport ${toString port}"; target = "DNAT --to-destination [${config.krebs.hosts.orange.nets.retiolum.ip6.addr}]:${toString port}"; v4 = false; }
29
+
]) udpports);
30
+
31
+
services.nginx.virtualHosts."jitsi.lassul.us" = {
32
+
enableACME = true;
33
+
acmeFallbackHost = "${target}";
34
+
addSSL = true;
35
+
locations."/" = {
36
+
recommendedProxySettings = true;
37
+
proxyWebsockets = true;
38
+
proxyPass = "https://${target}";
39
+
};
40
+
};
41
+
}
+40
nixos/2configs/services/flix/container-host.nix
+40
nixos/2configs/services/flix/container-host.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
krebs.sync-containers3.containers.yellow = {
4
+
sshKey = "${config.krebs.secret.directory}/yellow.sync.key";
5
+
};
6
+
containers.yellow.bindMounts."/var/lib" = {
7
+
hostPath = "/var/lib/sync-containers3/yellow/state";
8
+
isReadOnly = false;
9
+
};
10
+
containers.yellow.bindMounts."/var/download" = {
11
+
hostPath = "/var/download";
12
+
isReadOnly = false;
13
+
};
14
+
# krebs.iptables.tables.filter.FORWARD.rules = [
15
+
# { predicate = "-d ${config.krebs.hosts.yellow.nets.retiolum.ip4.addr} -p tcp --dport 8000 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; v6 = false; }
16
+
# { predicate = "-d ${config.krebs.hosts.yellow.nets.retiolum.ip6.addr} -p tcp --dport 8000 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; v4 = false; }
17
+
# ];
18
+
# krebs.iptables.tables.nat.PREROUTING.rules = [
19
+
# { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip4.addr}:8000"; v6 = false; }
20
+
# { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip6.addr}:8000"; v4 = false; }
21
+
# ];
22
+
networking.firewall.allowedTCPPorts = [ 8096 8920 ];
23
+
networking.firewall.allowedUDPPorts = [ 1900 7359 ];
24
+
containers.yellow.forwardPorts = [
25
+
{ hostPort = 8096; containerPort = 8096; protocol = "tcp"; }
26
+
{ hostPort = 8920; containerPort = 8920; protocol = "tcp"; }
27
+
{ hostPort = 1900; containerPort = 1900; protocol = "udp"; }
28
+
{ hostPort = 7359; containerPort = 7359; protocol = "udp"; }
29
+
];
30
+
31
+
services.nginx.virtualHosts."flix.lassul.us" = {
32
+
# forceSSL = true;
33
+
# enableACME = true;
34
+
locations."/" = {
35
+
proxyPass = "http://yellow.r:8096";
36
+
proxyWebsockets = true;
37
+
recommendedProxySettings = true;
38
+
};
39
+
};
40
+
}
+316
nixos/2configs/services/flix/default.nix
+316
nixos/2configs/services/flix/default.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
users.groups.download.members = [ "transmission" ];
4
+
services.transmission = {
5
+
enable = true;
6
+
home = "/var/state/transmission";
7
+
group = "download";
8
+
downloadDirPermissions = "775";
9
+
settings = {
10
+
download-dir = "/var/download/transmission";
11
+
incomplete-dir-enabled = false;
12
+
rpc-bind-address = "::";
13
+
message-level = 1;
14
+
umask = 18;
15
+
rpc-whitelist-enabled = false;
16
+
rpc-host-whitelist-enabled = false;
17
+
};
18
+
};
19
+
20
+
security.acme.defaults.email = "spam@krebsco.de";
21
+
security.acme.acceptTerms = true;
22
+
security.acme.certs."yellow.r".server = config.krebs.ssl.acmeURL;
23
+
security.acme.certs."jelly.r".server = config.krebs.ssl.acmeURL;
24
+
security.acme.certs."radar.r".server = config.krebs.ssl.acmeURL;
25
+
security.acme.certs."sonar.r".server = config.krebs.ssl.acmeURL;
26
+
security.acme.certs."transmission.r".server = config.krebs.ssl.acmeURL;
27
+
services.nginx = {
28
+
enable = true;
29
+
package = pkgs.nginx.override {
30
+
modules = with pkgs.nginxModules; [
31
+
fancyindex
32
+
];
33
+
};
34
+
virtualHosts."yellow.r" = {
35
+
default = true;
36
+
enableACME = true;
37
+
addSSL = true;
38
+
locations."/" = {
39
+
root = "/var/download";
40
+
extraConfig = ''
41
+
fancyindex on;
42
+
fancyindex_footer "/fancy.html";
43
+
include ${pkgs.nginx}/conf/mime.types;
44
+
include ${pkgs.writeText "extrMime" ''
45
+
types {
46
+
video/webm mkv;
47
+
}
48
+
''};
49
+
create_full_put_path on;
50
+
'';
51
+
};
52
+
locations."/chatty" = {
53
+
proxyPass = "http://localhost:3000";
54
+
extraConfig = ''
55
+
rewrite /chatty/(.*) /$1 break;
56
+
proxy_set_header Host $host;
57
+
'';
58
+
};
59
+
locations."= /fancy.html".extraConfig = ''
60
+
alias ${pkgs.writeText "nginx_footer" ''
61
+
<div id="mydiv">
62
+
<!-- Include a header DIV with the same name as the draggable DIV, followed by "header" -->
63
+
<div id="mydivheader">Click here to move</div>
64
+
<iframe src="/chatty/index.html"></iframe>
65
+
</div>
66
+
<style>
67
+
#mydiv {
68
+
position: absolute;
69
+
z-index: 9;
70
+
background-color: #f1f1f1;
71
+
border: 1px solid #d3d3d3;
72
+
text-align: center;
73
+
}
74
+
75
+
#mydivheader {
76
+
padding: 10px;
77
+
cursor: move;
78
+
z-index: 10;
79
+
background-color: #2196F3;
80
+
color: #fff;
81
+
}
82
+
</style>
83
+
<script>
84
+
// Make the DIV element draggable:
85
+
dragElement(document.getElementById("mydiv"));
86
+
87
+
function dragElement(elmnt) {
88
+
var pos1 = 0, pos2 = 0, pos3 = 0, pos4 = 0;
89
+
if (document.getElementById(elmnt.id + "header")) {
90
+
// if present, the header is where you move the DIV from:
91
+
document.getElementById(elmnt.id + "header").onmousedown = dragMouseDown;
92
+
} else {
93
+
// otherwise, move the DIV from anywhere inside the DIV:
94
+
elmnt.onmousedown = dragMouseDown;
95
+
}
96
+
97
+
function dragMouseDown(e) {
98
+
e = e || window.event;
99
+
e.preventDefault();
100
+
// get the mouse cursor position at startup:
101
+
pos3 = e.clientX;
102
+
pos4 = e.clientY;
103
+
document.onmouseup = closeDragElement;
104
+
// call a function whenever the cursor moves:
105
+
document.onmousemove = elementDrag;
106
+
}
107
+
108
+
function elementDrag(e) {
109
+
e = e || window.event;
110
+
e.preventDefault();
111
+
// calculate the new cursor position:
112
+
pos1 = pos3 - e.clientX;
113
+
pos2 = pos4 - e.clientY;
114
+
pos3 = e.clientX;
115
+
pos4 = e.clientY;
116
+
// set the element's new position:
117
+
elmnt.style.top = (elmnt.offsetTop - pos2) + "px";
118
+
elmnt.style.left = (elmnt.offsetLeft - pos1) + "px";
119
+
}
120
+
121
+
function closeDragElement() {
122
+
// stop moving when mouse button is released:
123
+
document.onmouseup = null;
124
+
document.onmousemove = null;
125
+
}
126
+
}
127
+
</script>
128
+
''};
129
+
'';
130
+
};
131
+
virtualHosts."jelly.r" = {
132
+
enableACME = true;
133
+
addSSL = true;
134
+
locations."/".extraConfig = ''
135
+
proxy_pass http://localhost:8096/;
136
+
proxy_set_header Accept-Encoding "";
137
+
'';
138
+
};
139
+
virtualHosts."transmission.r" = {
140
+
enableACME = true;
141
+
addSSL = true;
142
+
locations."/" = {
143
+
proxyWebsockets = true;
144
+
proxyPass = "http://localhost:9091";
145
+
};
146
+
};
147
+
virtualHosts."radar.r" = {
148
+
enableACME = true;
149
+
addSSL = true;
150
+
locations."/" = {
151
+
proxyWebsockets = true;
152
+
proxyPass = "http://localhost:7878";
153
+
};
154
+
};
155
+
virtualHosts."sonar.r" = {
156
+
enableACME = true;
157
+
addSSL = true;
158
+
locations."/" = {
159
+
proxyWebsockets = true;
160
+
proxyPass = "http://localhost:8989";
161
+
};
162
+
};
163
+
};
164
+
165
+
services.samba = {
166
+
enable = true;
167
+
enableNmbd = false;
168
+
extraConfig = ''
169
+
workgroup = WORKGROUP
170
+
server string = ${config.networking.hostName}
171
+
# only allow retiolum addresses
172
+
hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16
173
+
174
+
# Use sendfile() for performance gain
175
+
use sendfile = true
176
+
177
+
# No NetBIOS is needed
178
+
disable netbios = true
179
+
180
+
# Only mangle non-valid NTFS names, don't care about DOS support
181
+
mangled names = illegal
182
+
183
+
# Performance optimizations
184
+
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
185
+
186
+
# Disable all printing
187
+
load printers = false
188
+
disable spoolss = true
189
+
printcap name = /dev/null
190
+
191
+
map to guest = Bad User
192
+
max log size = 50
193
+
dns proxy = no
194
+
security = user
195
+
196
+
[global]
197
+
syslog only = yes
198
+
'';
199
+
shares.public = {
200
+
comment = "Warez";
201
+
path = "/var/download";
202
+
public = "yes";
203
+
"only guest" = "yes";
204
+
"create mask" = "0644";
205
+
"directory mask" = "2777";
206
+
writable = "no";
207
+
printable = "no";
208
+
};
209
+
};
210
+
211
+
systemd.services.bruellwuerfel =
212
+
let
213
+
bruellwuerfelSrc = pkgs.fetchFromGitHub {
214
+
owner = "krebs";
215
+
repo = "bruellwuerfel";
216
+
rev = "dc73adf69249fb63a4b024f1f3fbc9e541b27015";
217
+
sha256 = "078jp1gbavdp8lnwa09xa5m6bbbd05fi4x5ldkkgin5z04hwlhmd";
218
+
};
219
+
in {
220
+
wantedBy = [ "multi-user.target" ];
221
+
environment = {
222
+
IRC_CHANNEL = "#flix";
223
+
IRC_NICK = "bruelli";
224
+
IRC_SERVER = "irc.r";
225
+
IRC_HISTORY_FILE = "/tmp/bruelli.history";
226
+
};
227
+
serviceConfig = {
228
+
ExecStart = "${pkgs.deno}/bin/deno run -A ${bruellwuerfelSrc}/src/index.ts";
229
+
};
230
+
};
231
+
232
+
krebs.iptables = {
233
+
enable = true;
234
+
tables.filter.INPUT.rules = [
235
+
{ predicate = "-p tcp --dport 80"; target = "ACCEPT"; } # nginx web dir
236
+
{ predicate = "-p tcp --dport 443"; target = "ACCEPT"; } # nginx web dir
237
+
{ predicate = "-p tcp --dport 9091"; target = "ACCEPT"; } # transmission-web
238
+
{ predicate = "-p tcp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
239
+
{ predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
240
+
{ predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin
241
+
{ predicate = "-p tcp --dport 8920"; target = "ACCEPT"; } # jellyfin
242
+
{ predicate = "-p udp --dport 1900"; target = "ACCEPT"; } # jellyfin
243
+
{ predicate = "-p udp --dport 7359"; target = "ACCEPT"; } # jellyfin
244
+
{ predicate = "-p tcp --dport 9696"; target = "ACCEPT"; } # prowlarr
245
+
{ predicate = "-p tcp --dport 8989"; target = "ACCEPT"; } # sonarr
246
+
{ predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr
247
+
{ predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr
248
+
249
+
# smbd
250
+
{ predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; }
251
+
{ predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; }
252
+
{ predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; }
253
+
{ predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; }
254
+
{ predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; }
255
+
{ predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; }
256
+
{ predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; }
257
+
{ predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; }
258
+
{ predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; }
259
+
{ predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; }
260
+
{ predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; }
261
+
{ predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; }
262
+
{ predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; }
263
+
{ predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; }
264
+
];
265
+
};
266
+
267
+
systemd.services.flix-index = {
268
+
wantedBy = [ "multi-user.target" ];
269
+
path = [
270
+
pkgs.coreutils
271
+
pkgs.findutils
272
+
pkgs.inotify-tools
273
+
];
274
+
serviceConfig = {
275
+
Restart = "always";
276
+
ExecStart = pkgs.writers.writeDash "flix-index" ''
277
+
set -efu
278
+
279
+
DIR=/var/download
280
+
cd "$DIR"
281
+
while inotifywait -rq -e create -e move -e delete "$DIR"; do
282
+
find . -type f > "$DIR"/index.tmp
283
+
mv "$DIR"/index.tmp "$DIR"/index
284
+
done
285
+
'';
286
+
};
287
+
};
288
+
289
+
services.jellyfin = {
290
+
enable = true;
291
+
group = "download";
292
+
};
293
+
294
+
# movies
295
+
services.radarr = {
296
+
enable = true;
297
+
group = "download";
298
+
};
299
+
300
+
# shows
301
+
services.sonarr = {
302
+
enable = true;
303
+
group = "download";
304
+
};
305
+
306
+
# indexers
307
+
services.prowlarr = {
308
+
enable = true;
309
+
};
310
+
311
+
# subtitles
312
+
services.bazarr = {
313
+
enable = true;
314
+
group = "download";
315
+
};
316
+
}
+12
nixos/2configs/services/flix/proxy.nix
+12
nixos/2configs/services/flix/proxy.nix
+21
nixos/2configs/services/git/default.nix
+21
nixos/2configs/services/git/default.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
../../git.nix
5
+
];
6
+
services.nginx.virtualHosts."cgit.lassul.us" = {
7
+
enableACME = true;
8
+
addSSL = true;
9
+
locations = config.services.nginx.virtualHosts.cgit.locations;
10
+
extraConfig = ''
11
+
client_max_body_size 300M;
12
+
client_body_timeout 2024;
13
+
client_header_timeout 2024;
14
+
15
+
fastcgi_buffers 16 512k;
16
+
fastcgi_buffer_size 512k;
17
+
fastcgi_read_timeout 500;
18
+
fastcgi_send_timeout 500;
19
+
'';
20
+
};
21
+
}
+23
nixos/2configs/services/git/proxy.nix
+23
nixos/2configs/services/git/proxy.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
services.nginx.virtualHosts."cgit.lassul.us" = {
4
+
forceSSL = true;
5
+
enableACME = true;
6
+
acmeFallbackHost = "orange.r";
7
+
locations."/" = {
8
+
proxyPass = "http://orange.r";
9
+
proxyWebsockets = true;
10
+
recommendedProxySettings = true;
11
+
};
12
+
extraConfig = ''
13
+
client_max_body_size 300M;
14
+
client_body_timeout 2024;
15
+
client_header_timeout 2024;
16
+
17
+
fastcgi_buffers 16 512k;
18
+
fastcgi_buffer_size 512k;
19
+
fastcgi_read_timeout 500;
20
+
fastcgi_send_timeout 500;
21
+
'';
22
+
};
23
+
}
+35
nixos/2configs/services/matrix/default.nix
+35
nixos/2configs/services/matrix/default.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
services.matrix-synapse = {
4
+
enable = true;
5
+
settings = {
6
+
server_name = "lassul.us";
7
+
# registration_shared_secret = "yolo";
8
+
database.name = "sqlite3";
9
+
turn_uris = [
10
+
"turn:turn.matrix.org?transport=udp"
11
+
"turn:turn.matrix.org?transport=tcp"
12
+
];
13
+
listeners = [
14
+
{
15
+
port = 8008;
16
+
bind_addresses = [ "::1" ];
17
+
type = "http";
18
+
tls = false;
19
+
x_forwarded = true;
20
+
resources = [
21
+
{
22
+
names = [ "client" ];
23
+
compress = true;
24
+
}
25
+
{
26
+
names = [ "federation" ];
27
+
compress = false;
28
+
}
29
+
];
30
+
}
31
+
];
32
+
};
33
+
};
34
+
networking.firewall.allowedTCPPorts = [ 8008 ];
35
+
}
+30
nixos/2configs/services/matrix/proxy.nix
+30
nixos/2configs/services/matrix/proxy.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
services.nginx = {
4
+
virtualHosts = {
5
+
"lassul.us" = {
6
+
locations."= /.well-known/matrix/server".extraConfig = ''
7
+
add_header Content-Type application/json;
8
+
return 200 '${builtins.toJSON {
9
+
"m.server" = "matrix.lassul.us:443";
10
+
}}';
11
+
'';
12
+
locations."= /.well-known/matrix/client".extraConfig = ''
13
+
add_header Content-Type application/json;
14
+
add_header Access-Control-Allow-Origin *;
15
+
return 200 '${builtins.toJSON {
16
+
"m.homeserver" = { "base_url" = "https://matrix.lassul.us"; };
17
+
"m.identity_server" = { "base_url" = "https://vector.im"; };
18
+
}}';
19
+
'';
20
+
};
21
+
"matrix.lassul.us" = {
22
+
forceSSL = true;
23
+
enableACME = true;
24
+
locations."/_matrix" = {
25
+
proxyPass = "http://orange.r:8008";
26
+
};
27
+
};
28
+
};
29
+
};
30
+
}
+12
nixos/2configs/services/nixcache/default.nix
+12
nixos/2configs/services/nixcache/default.nix
+23
nixos/2configs/services/radio/container-host.nix
+23
nixos/2configs/services/radio/container-host.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
krebs.sync-containers3.containers.radio = {
4
+
sshKey = "${config.krebs.secret.directory}/radio.sync.key";
5
+
};
6
+
containers.radio = {
7
+
bindMounts."/var/music" = {
8
+
hostPath = "/var/music";
9
+
isReadOnly = false;
10
+
};
11
+
};
12
+
krebs.iptables.tables.filter.INPUT.rules = [
13
+
{ predicate = "-p tcp --dport 8000"; target = "ACCEPT"; }
14
+
];
15
+
krebs.htgen.radio-redirect = {
16
+
port = 8000;
17
+
scriptFile = pkgs.writers.writeDash "redir" ''
18
+
printf 'HTTP/1.1 301 Moved Permanently\r\n'
19
+
printf "Location: http://radio.lassul.us''${Request_URI}\r\n"
20
+
printf '\r\n'
21
+
'';
22
+
};
23
+
}
+83
nixos/2configs/services/radio/controls.html
+83
nixos/2configs/services/radio/controls.html
···
1
+
<!doctype html>
2
+
3
+
<html lang="en">
4
+
<head>
5
+
<meta charset="utf-8">
6
+
<meta name="viewport" content="width=device-width, initial-scale=1">
7
+
8
+
<title>The_Playlist Voting!</title>
9
+
<style>
10
+
#good {
11
+
display: block;
12
+
width: 100%;
13
+
border: none;
14
+
background-color: #04AA6D;
15
+
padding: 14px;
16
+
margin: 14px 0 0 0;
17
+
height: 100px;
18
+
font-size: 16px;
19
+
cursor: pointer;
20
+
text-align: center;
21
+
}
22
+
#bad {
23
+
display: block;
24
+
width: 100%;
25
+
border: none;
26
+
background-color: red;
27
+
padding: 14px;
28
+
height: 100px;
29
+
30
+
margin: 14px 0 0 0;
31
+
font-size: 16px;
32
+
cursor: pointer;
33
+
text-align: center;
34
+
}
35
+
</style>
36
+
37
+
</head>
38
+
39
+
<body>
40
+
<div id=votenote></div>
41
+
<button id=good type="button"> GUT </button>
42
+
43
+
<button id=bad type="button"> SCHLECHT </button>
44
+
<center>
45
+
Currently Running: <br/><div>
46
+
<b id=current></b>
47
+
</div>
48
+
<div id=vote>
49
+
</div>
50
+
<audio controls autoplay="autoplay">
51
+
<source src="https://radio.lassul.us/radio.ogg" type="audio/ogg">
52
+
Your browser does not support the audio element.
53
+
</audio>
54
+
</center>
55
+
56
+
<script>
57
+
document.getElementById("good").onclick=async ()=>{
58
+
let result = await fetch("https://radio.lassul.us/good", {"method": "POST"})
59
+
document.getElementById("vote").textContent = "Dieses Lied findest du gut"
60
+
};
61
+
document.getElementById("bad").onclick=async ()=>{
62
+
let result = await fetch("https://radio.lassul.us/skip", {"method": "POST"})
63
+
document.getElementById("vote").textContent = "Dieses Lied findest du schlecht"
64
+
document.getElementById("bad").disabled = true
65
+
window.setTimeout(function(){
66
+
document.getElementById("bad").disabled = false
67
+
}, 100000)
68
+
69
+
};
70
+
71
+
async function current() {
72
+
let result = await fetch("https://radio.lassul.us/current", {"method": "GET"})
73
+
let data = await result.json()
74
+
document.getElementById("current").textContent = data.name
75
+
}
76
+
window.onload = function() {
77
+
window.setInterval('current()', 10000)
78
+
current()
79
+
}
80
+
81
+
</script>
82
+
</body>
83
+
</html>
+348
nixos/2configs/services/radio/default.nix
+348
nixos/2configs/services/radio/default.nix
···
1
+
{ config, pkgs, lib, ... }:
2
+
3
+
let
4
+
name = "radio";
5
+
6
+
music_dir = "/var/music";
7
+
8
+
skip_track = pkgs.writers.writeBashBin "skip_track" ''
9
+
set -eu
10
+
11
+
# TODO come up with new rating, without moving files
12
+
# current_track=$(${pkgs.curl}/bin/curl -fSs http://localhost:8002/current | ${pkgs.jq}/bin/jq -r .filename)
13
+
# track_infos=$(${print_current}/bin/print_current)
14
+
# skip_count=$(${pkgs.attr}/bin/getfattr -n user.skip_count --only-values "$current_track" || echo 0)
15
+
# if [[ "$current_track" =~ .*/the_playlist/music/.* ]] && [ "$skip_count" -le 2 ]; then
16
+
# skip_count=$((skip_count+1))
17
+
# ${pkgs.attr}/bin/setfattr -n user.skip_count -v "$skip_count" "$current_track"
18
+
# echo skipping: "$track_infos" skip_count: "$skip_count"
19
+
# else
20
+
# mkdir -p "$music_dir"/the_playlist/.graveyard/
21
+
# mv "$current_track" "$music_dir"/the_playlist/.graveyard/
22
+
# echo killing: "$track_infos"
23
+
# fi
24
+
${pkgs.curl}/bin/curl -fSs -X POST http://localhost:8002/skip |
25
+
${pkgs.jq}/bin/jq -r '.filename'
26
+
'';
27
+
28
+
good_track = pkgs.writeBashBin "good_track" ''
29
+
set -eu
30
+
31
+
current_track=$(${pkgs.curl}/bin/curl -fSs http://localhost:8002/current | ${pkgs.jq}/bin/jq -r .filename)
32
+
track_infos=$(${print_current}/bin/print_current)
33
+
# TODO come up with new rating, without moving files
34
+
# if [[ "$current_track" =~ .*/the_playlist/music/.* ]]; then
35
+
# ${pkgs.attr}/bin/setfattr -n user.skip_count -v 0 "$current_track"
36
+
# else
37
+
# mv "$current_track" "$music_dir"/the_playlist/music/ || :
38
+
# fi
39
+
echo good: "$track_infos"
40
+
'';
41
+
42
+
print_current = pkgs.writeDashBin "print_current" ''
43
+
file=$(${pkgs.curl}/bin/curl -fSs http://localhost:8002/current |
44
+
${pkgs.jq}/bin/jq -r '.filename' |
45
+
${pkgs.gnused}/bin/sed 's,^${music_dir},,'
46
+
)
47
+
link=$(${pkgs.curl}/bin/curl http://localhost:8002/current |
48
+
${pkgs.jq}/bin/jq -r '.filename' |
49
+
${pkgs.gnused}/bin/sed 's@.*\(.\{11\}\)\.ogg@https://youtu.be/\1@'
50
+
)
51
+
echo "$file": "$link"
52
+
'';
53
+
54
+
set_irc_topic = pkgs.writeDash "set_irc_topic" ''
55
+
${pkgs.curl}/bin/curl -fsS --unix-socket /home/radio/reaktor.sock http://z/ \
56
+
-H content-type:application/json \
57
+
-d "$(${pkgs.jq}/bin/jq -n \
58
+
--arg text "$1" '{
59
+
command:"TOPIC",
60
+
params:["#the_playlist",$text]
61
+
}'
62
+
)"
63
+
'';
64
+
65
+
write_to_irc = pkgs.writeDash "write_to_irc" ''
66
+
${pkgs.curl}/bin/curl -fsSv --unix-socket /home/radio/reaktor.sock http://z/ \
67
+
-H content-type:application/json \
68
+
-d "$(${pkgs.jq}/bin/jq -n \
69
+
--arg text "$1" '{
70
+
command:"PRIVMSG",
71
+
params:["#the_playlist",$text]
72
+
}'
73
+
)"
74
+
'';
75
+
76
+
in {
77
+
imports = [
78
+
./news.nix
79
+
./weather.nix
80
+
];
81
+
82
+
users.users = {
83
+
"${name}" = rec {
84
+
inherit name;
85
+
createHome = true;
86
+
group = name;
87
+
uid = pkgs.stockholm.lib.genid_uint31 name;
88
+
description = "radio manager";
89
+
home = "/home/${name}";
90
+
useDefaultShell = true;
91
+
openssh.authorizedKeys.keys = with config.krebs.users; [
92
+
lass.pubkey
93
+
];
94
+
};
95
+
};
96
+
97
+
users.groups = {
98
+
"radio" = {};
99
+
};
100
+
101
+
krebs.per-user.${name}.packages = with pkgs; [
102
+
good_track
103
+
skip_track
104
+
print_current
105
+
];
106
+
107
+
108
+
systemd.services.radio_watcher = {
109
+
wantedBy = [ "multi-user.target" ];
110
+
after = [ "radio.service" ];
111
+
serviceConfig = {
112
+
ExecStart = pkgs.writers.writeDash "radio_watcher" ''
113
+
set -efux
114
+
while :; do
115
+
${pkgs.curl}/bin/curl -Ss http://localhost:8000/radio.ogg -o /dev/null
116
+
${pkgs.systemd}/bin/systemctl restart radio
117
+
sleep 60
118
+
done
119
+
'';
120
+
Restart = "on-failure";
121
+
};
122
+
};
123
+
124
+
services.liquidsoap.streams.radio = ./radio.liq;
125
+
systemd.services.radio = {
126
+
environment = {
127
+
RADIO_PORT = "8002";
128
+
HOOK_TRACK_CHANGE = pkgs.writers.writeDash "on_change" ''
129
+
set -xefu
130
+
LIMIT=1000 #how many tracks to keep in the history
131
+
HISTORY_FILE=/var/lib/radio/recent
132
+
133
+
listeners=$(${pkgs.curl}/bin/curl -fSs http://localhost:8000/status-json.xsl |
134
+
${pkgs.jq}/bin/jq '[.icestats.source[].listeners] | add' || echo 0)
135
+
echo "$(${pkgs.coreutils}/bin/date -Is)" "$filename" | ${pkgs.coreutils}/bin/tee -a "$HISTORY_FILE"
136
+
echo "$(${pkgs.coreutils}/bin/tail -$LIMIT "$HISTORY_FILE")" > "$HISTORY_FILE"
137
+
${set_irc_topic} "playing: $filename listeners: $listeners"
138
+
'';
139
+
MUSIC = "${music_dir}/the_playlist";
140
+
ICECAST_HOST = "localhost";
141
+
};
142
+
path = [
143
+
pkgs.yt-dlp
144
+
pkgs.bubblewrap
145
+
];
146
+
serviceConfig.User = lib.mkForce "radio";
147
+
};
148
+
149
+
nixpkgs.config.packageOverrides = opkgs: {
150
+
icecast = opkgs.icecast.overrideAttrs (old: rec {
151
+
version = "2.5-beta3";
152
+
153
+
src = pkgs.fetchurl {
154
+
url = "http://downloads.xiph.org/releases/icecast/icecast-${version}.tar.gz";
155
+
sha256 = "sha256-4FDokoA9zBDYj8RAO/kuTHaZ6jZYBLSJZiX/IYFaCW8=";
156
+
};
157
+
158
+
buildInputs = old.buildInputs ++ [ pkgs.pkg-config ];
159
+
});
160
+
};
161
+
services.icecast = {
162
+
enable = true;
163
+
hostname = "radio.lassul.us";
164
+
admin.password = "hackme";
165
+
extraConf = ''
166
+
<authentication>
167
+
<source-password>hackme</source-password>
168
+
<admin-user>admin</admin-user>
169
+
<admin-password>hackme</admin-password>
170
+
</authentication>
171
+
<logging>
172
+
<accesslog>-</accesslog>
173
+
<errorlog>-</errorlog>
174
+
<loglevel>3</loglevel>
175
+
</logging>
176
+
'';
177
+
};
178
+
179
+
krebs.iptables = {
180
+
tables = {
181
+
filter.INPUT.rules = [
182
+
{ predicate = "-p tcp --dport 8000"; target = "ACCEPT"; }
183
+
{ predicate = "-i retiolum -p tcp --dport 8001"; target = "ACCEPT"; }
184
+
{ predicate = "-i retiolum -p tcp --dport 8002"; target = "ACCEPT"; }
185
+
];
186
+
};
187
+
};
188
+
189
+
# allow reaktor2 to modify files
190
+
systemd.services."reaktor2-the_playlist".serviceConfig.DynamicUser = lib.mkForce false;
191
+
systemd.services."reaktor2-the_playlist".serviceConfig.Group = lib.mkForce "radio";
192
+
193
+
krebs.reaktor2.the_playlist = {
194
+
hostname = "irc.hackint.org";
195
+
port = "6697";
196
+
useTLS = true;
197
+
nick = "the_playlist";
198
+
username = "radio";
199
+
API.listen = "unix:/home/radio/reaktor.sock";
200
+
plugins = [
201
+
{
202
+
plugin = "register";
203
+
config = {
204
+
channels = [
205
+
"#the_playlist"
206
+
"#krebs"
207
+
];
208
+
};
209
+
}
210
+
{
211
+
plugin = "system";
212
+
config = {
213
+
workdir = config.krebs.reaktor2.the_playlist.stateDir;
214
+
hooks.PRIVMSG = [
215
+
{
216
+
activate = "match";
217
+
pattern = "^(?:.*\\s)?\\s*the_playlist:\\s*([0-9A-Za-z._][0-9A-Za-z._-]*)(?:\\s+(.*\\S))?\\s*$";
218
+
command = 1;
219
+
arguments = [2];
220
+
commands = {
221
+
skip.filename = "${skip_track}/bin/skip_track";
222
+
next.filename = "${skip_track}/bin/skip_track";
223
+
bad.filename = "${skip_track}/bin/skip_track";
224
+
225
+
good.filename = "${good_track}/bin/good_track";
226
+
nice.filename = "${good_track}/bin/good_track";
227
+
like.filename = "${good_track}/bin/good_track";
228
+
229
+
current.filename = "${print_current}/bin/print_current";
230
+
wish.filename = pkgs.writeDash "wish" ''
231
+
echo "youtube-dl:$1" | ${pkgs.curl}/bin/curl -fSs http://localhost:8002/wish -d @- > /dev/null
232
+
'';
233
+
wishlist.filename = pkgs.writeDash "wishlist" ''
234
+
${pkgs.curl}/bin/curl -fSs http://localhost:8002/wish | ${pkgs.jq}/bin/jq -r '.[]'
235
+
'';
236
+
suggest.filename = pkgs.writeDash "suggest" ''
237
+
echo "$@" >> playlist_suggest
238
+
'';
239
+
};
240
+
}
241
+
];
242
+
};
243
+
}
244
+
];
245
+
};
246
+
247
+
krebs.htgen.radio = {
248
+
port = 8001;
249
+
user = {
250
+
name = "radio";
251
+
};
252
+
scriptFile = pkgs.writeDash "radio" ''
253
+
case "$Method $Request_URI" in
254
+
"POST /skip")
255
+
printf 'HTTP/1.1 200 OK\r\n'
256
+
printf 'Connection: close\r\n'
257
+
printf '\r\n'
258
+
msg=$(${skip_track}/bin/skip_track)
259
+
${write_to_irc} "$msg"
260
+
echo "$msg"
261
+
exit
262
+
;;
263
+
"POST /good")
264
+
printf 'HTTP/1.1 200 OK\r\n'
265
+
printf 'Connection: close\r\n'
266
+
printf '\r\n'
267
+
msg=$(${good_track}/bin/good_track)
268
+
${write_to_irc} "$msg"
269
+
echo "$msg"
270
+
exit
271
+
;;
272
+
esac
273
+
'';
274
+
};
275
+
276
+
networking.firewall.allowedTCPPorts = [ 80 ];
277
+
services.nginx = {
278
+
enable = true;
279
+
virtualHosts."radio.r" = {
280
+
locations."/".extraConfig = ''
281
+
# https://github.com/aswild/icecast-notes#core-nginx-config
282
+
proxy_pass http://localhost:8000;
283
+
# Disable request size limit, very important for uploading large files
284
+
client_max_body_size 0;
285
+
286
+
# Enable support `Transfer-Encoding: chunked`
287
+
chunked_transfer_encoding on;
288
+
289
+
# Disable request and response buffering, minimize latency to/from Icecast
290
+
proxy_buffering off;
291
+
proxy_request_buffering off;
292
+
293
+
# Icecast needs HTTP/1.1, not 1.0 or 2
294
+
proxy_http_version 1.1;
295
+
296
+
# Forward all original request headers
297
+
proxy_pass_request_headers on;
298
+
299
+
# Set some standard reverse proxy headers. Icecast server currently ignores these,
300
+
# but may support them in a future version so that access logs are more useful.
301
+
proxy_set_header Host $host;
302
+
proxy_set_header X-Real-IP $remote_addr;
303
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
304
+
proxy_set_header X-Forwarded-Proto $scheme;
305
+
306
+
# get source ip for weather reports
307
+
proxy_set_header user-agent "$http_user_agent; client-ip=$remote_addr";
308
+
'';
309
+
locations."= /recent".extraConfig = ''
310
+
default_type "text/plain";
311
+
alias /var/lib/radio/recent;
312
+
'';
313
+
locations."= /current".extraConfig = ''
314
+
proxy_pass http://localhost:8002;
315
+
'';
316
+
locations."= /skip".extraConfig = ''
317
+
proxy_pass http://localhost:8001;
318
+
'';
319
+
locations."= /good".extraConfig = ''
320
+
proxy_pass http://localhost:8001;
321
+
'';
322
+
locations."= /radio.sh".alias = pkgs.writeScript "radio.sh" ''
323
+
#!/bin/sh
324
+
trap 'exit 0' EXIT
325
+
while sleep 1; do
326
+
mpv \
327
+
--cache-secs=0 --demuxer-readahead-secs=0 --untimed --cache-pause=no \
328
+
'http://radio.lassul.us/radio.ogg'
329
+
done
330
+
'';
331
+
locations."= /controls".extraConfig = ''
332
+
default_type "text/html";
333
+
alias ${./controls.html};
334
+
'';
335
+
extraConfig = ''
336
+
add_header 'Access-Control-Allow-Origin' '*';
337
+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
338
+
'';
339
+
};
340
+
};
341
+
services.syncthing.declarative.folders."the_playlist" = {
342
+
path = "/var/music/the_playlist";
343
+
devices = [ "mors" "phone" "prism" "omo" "radio" ];
344
+
};
345
+
krebs.acl."/var/music/the_playlist"."u:syncthing:X".parents = true;
346
+
krebs.acl."/var/music/the_playlist"."u:syncthing:rwX" = {};
347
+
krebs.acl."/var/music/the_playlist"."u:radio:rwX" = {};
348
+
}
+132
nixos/2configs/services/radio/news.nix
+132
nixos/2configs/services/radio/news.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
4
+
tts = pkgs.writers.writeBashBin "tts" ''
5
+
set -efu
6
+
set -x
7
+
8
+
offset=0
9
+
OUTPUT=$(mktemp -d)
10
+
trap 'rm -rf "$OUTPUT"' EXIT
11
+
SPEAKER=$[ $RANDOM % 900 ]
12
+
while read line; do
13
+
echo "$line" |
14
+
${pkgs.piper-tts}/bin/piper \
15
+
--model ${pkgs.fetchzip {
16
+
url = "https://github.com/rhasspy/piper/releases/download/v0.0.2/voice-en-us-libritts-high.tar.gz";
17
+
hash = "sha256-jCoK4p0O7BuF0nr6Sfj40tpivCvU5M3GHKQRg1tfIO8=";
18
+
stripRoot = false;
19
+
}}/en-us-libritts-high.onnx \
20
+
-s "$SPEAKER" \
21
+
-f "$OUTPUT"/"$offset".wav >/dev/null
22
+
23
+
((offset+=1))
24
+
done
25
+
26
+
${pkgs.sox}/bin/sox "$OUTPUT"/*.wav "$OUTPUT"/all.wav
27
+
cat "$OUTPUT"/all.wav
28
+
'';
29
+
30
+
send_to_radio = pkgs.writers.writeDashBin "send_to_radio" ''
31
+
${pkgs.vorbis-tools}/bin/oggenc - |
32
+
${pkgs.cyberlocker-tools}/bin/cput news.ogg
33
+
${pkgs.curl}/bin/curl -fSs -X POST http://localhost:8002/newsshow
34
+
'';
35
+
36
+
gc_news = pkgs.writers.writeDashBin "gc_news" ''
37
+
set -xefu
38
+
export TZ=UTC #workaround for jq parsing wrong timestamp
39
+
${pkgs.coreutils}/bin/cat $HOME/news | ${pkgs.jq}/bin/jq -cs 'map(select((.to|fromdateiso8601) > now)) | .[]' > $HOME/bla-news.tmp
40
+
${pkgs.coreutils}/bin/mv $HOME/bla-news.tmp $HOME/news
41
+
'';
42
+
43
+
get_current_news = pkgs.writers.writeDashBin "get_current_news" ''
44
+
set -xefu
45
+
export TZ=UTC #workaround for jq parsing wrong timestamp
46
+
${pkgs.coreutils}/bin/cat $HOME/news | ${pkgs.jq}/bin/jq -rs '
47
+
sort_by(.priority) |
48
+
map(select(
49
+
((.to | fromdateiso8601) > now) and
50
+
(.from|fromdateiso8601) < now) |
51
+
.text
52
+
) | .[]'
53
+
'';
54
+
55
+
newsshow = pkgs.writers.writeDashBin "newsshow" /* sh */ ''
56
+
cat << EOF
57
+
hello crabpeople!
58
+
$(${pkgs.ddate}/bin/ddate +'Today is %{%A, the %e of %B%}, %Y. %N%nCelebrate %H')
59
+
It is $(date --utc +%H) o clock UTC.
60
+
todays news:
61
+
$(get_current_news)
62
+
$(gc_news)
63
+
EOF
64
+
'';
65
+
in
66
+
{
67
+
systemd.services.newsshow = {
68
+
path = [
69
+
newsshow
70
+
tts
71
+
send_to_radio
72
+
gc_news
73
+
get_current_news
74
+
pkgs.retry
75
+
];
76
+
script = ''
77
+
set -efu
78
+
retry -t 5 -d 10 -- newsshow |
79
+
retry -t 5 -d 10 -- tts |
80
+
retry -t 5 -d 10 -- send_to_radio
81
+
'';
82
+
startAt = "*:00:00";
83
+
serviceConfig = {
84
+
User = "radio-news";
85
+
};
86
+
};
87
+
88
+
services.nginx.virtualHosts."radio-news.r" = {
89
+
locations."/" = {
90
+
proxyPass = "http://localhost:7999";
91
+
proxyWebsockets = true;
92
+
extraConfig = ''
93
+
add_header 'Access-Control-Allow-Origin' '*';
94
+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
95
+
'';
96
+
};
97
+
};
98
+
krebs.htgen.news = {
99
+
port = 7999;
100
+
user = {
101
+
name = "radio-news";
102
+
};
103
+
script = ''. ${pkgs.writers.writeDash "htgen-news" ''
104
+
set -xefu
105
+
case "''${Method:-GET} $Request_URI" in
106
+
"GET /")
107
+
printf 'HTTP/1.1 200 OK\r\n'
108
+
printf 'Connection: close\r\n'
109
+
printf '\r\n'
110
+
cat "$HOME"/news | jq -sc .
111
+
exit
112
+
;;
113
+
"POST /")
114
+
payload=$(head -c "$req_content_length")
115
+
printf '%s' "$payload" | jq 'has("from") and has("to") and has("text")' >&2
116
+
printf '%s' "$payload" | jq -c '{ from: .from, to: .to, text: .text, priority: (.priority // 0)}' >> "$HOME"/news
117
+
printf 'HTTP/1.1 200 OK\r\n'
118
+
printf 'Connection: close\r\n'
119
+
printf '\r\n'
120
+
exit
121
+
;;
122
+
esac
123
+
''}'';
124
+
};
125
+
126
+
# debug
127
+
environment.systemPackages = [
128
+
send_to_radio
129
+
newsshow
130
+
tts
131
+
];
132
+
}
+17
nixos/2configs/services/radio/proxy.nix
+17
nixos/2configs/services/radio/proxy.nix
···
1
+
{ config, pkgs, ... }:
2
+
{
3
+
services.nginx.virtualHosts."radio.lassul.us" = {
4
+
enableACME = true;
5
+
addSSL = true;
6
+
locations."/" = {
7
+
# recommendedProxySettings = true;
8
+
proxyWebsockets = true;
9
+
proxyPass = "http://radio.r";
10
+
extraConfig = ''
11
+
proxy_set_header Host radio.r;
12
+
# get source ip for weather reports
13
+
proxy_set_header user-agent "$http_user_agent; client-ip=$remote_addr";
14
+
'';
15
+
};
16
+
};
17
+
}
+112
nixos/2configs/services/radio/radio.liq
+112
nixos/2configs/services/radio/radio.liq
···
1
+
log.stdout.set(true)
2
+
3
+
# use yt-dlp
4
+
settings.protocol.youtube_dl.path.set("yt-dlp")
5
+
6
+
## functions
7
+
8
+
def stringify_attrs(attrs) =
9
+
let json.stringify out = (attrs : [(string * string)] as json.object)
10
+
out
11
+
end
12
+
13
+
def filter_music(req) =
14
+
filename = request.filename(req)
15
+
if string.match(pattern = '.*/\\.graveyard/.*', filename) then
16
+
false
17
+
else
18
+
true
19
+
end
20
+
end
21
+
22
+
def queue_contents(q) =
23
+
list.map(fun (req) -> request.uri(req), q)
24
+
end
25
+
## main
26
+
27
+
env = environment()
28
+
port = string.to_int(env["RADIO_PORT"], default = 8000)
29
+
30
+
all_music = playlist(env["MUSIC"], check_next = filter_music)
31
+
wishlist = request.queue()
32
+
tracks = fallback(track_sensitive = true, [wishlist, all_music])
33
+
tracks = blank.eat(tracks)
34
+
35
+
last_metadata = ref([])
36
+
def on_metadata(m) =
37
+
last_metadata := m
38
+
print("changing tracks")
39
+
out = process.read(env["HOOK_TRACK_CHANGE"], env = m, timeout = 5.0)
40
+
print(out)
41
+
end
42
+
tracks.on_metadata(on_metadata)
43
+
44
+
# some nice effects
45
+
music = crossfade(tracks)
46
+
music = mksafe(music)
47
+
music = normalize(music)
48
+
49
+
news = request.queue()
50
+
radio = smooth_add(normal = music, special = amplify(1.5, news))
51
+
52
+
if string.length(env["ICECAST_HOST"]) > 0 then
53
+
output.icecast(host = env["ICECAST_HOST"], mount = '/music.ogg', password = 'hackme', %vorbis(quality = 1), music)
54
+
output.icecast(host = env["ICECAST_HOST"], mount = '/music.mp3', password = 'hackme', %mp3.vbr(), music)
55
+
output.icecast(host = env["ICECAST_HOST"], mount = '/music.opus', password = 'hackme', %opus(bitrate = 128), music)
56
+
57
+
output.icecast(host = env["ICECAST_HOST"], mount = '/radio.ogg', password = 'hackme', %vorbis(quality = 1), radio)
58
+
output.icecast(host = env["ICECAST_HOST"], mount = '/radio.mp3', password = 'hackme', %mp3.vbr(), radio)
59
+
output.icecast(host = env["ICECAST_HOST"], mount = '/radio.opus', password = 'hackme', %opus(bitrate = 128), radio)
60
+
else
61
+
output(fallible = true, buffer(radio))
62
+
end
63
+
64
+
interactive.harbor(port = port)
65
+
66
+
def current(~protocol, ~headers, ~data, uri) =
67
+
http.response(content_type = "application/json", data = stringify_attrs(
68
+
!last_metadata
69
+
))
70
+
end
71
+
harbor.http.register("/current", port = port, current)
72
+
73
+
def skip(~protocol, ~headers, ~data, uri) =
74
+
tracks.skip()
75
+
http.response(content_type = "application/json", data = stringify_attrs(
76
+
!last_metadata
77
+
))
78
+
end
79
+
harbor.http.register("/skip", method = "POST", port = port, skip)
80
+
81
+
def all_tracks(~protocol, ~headers, ~data, uri) =
82
+
http.response(content_type = "application/json", data = json.stringify(
83
+
all_music.remaining_files()
84
+
))
85
+
end
86
+
harbor.http.register("/all_tracks", port = port, all_tracks)
87
+
88
+
def wish_track(~protocol, ~headers, ~data, uri) =
89
+
# disallow process:
90
+
if string.match(pattern = '^process:', data) then
91
+
http.response(code = 400)
92
+
else
93
+
# TODO report errors back
94
+
wish = request.create(data)
95
+
wishlist.push(wish)
96
+
http.response(content_type = "application/json", data = "ok")
97
+
end
98
+
end
99
+
harbor.http.register("/wish", method = "POST", port = port, wish_track)
100
+
101
+
def wish_tracklist(~protocol, ~headers, ~data, uri) =
102
+
http.response(content_type = "application/json", data = json.stringify(
103
+
queue_contents(wishlist.queue())
104
+
))
105
+
end
106
+
harbor.http.register("/wish", port = port, wish_tracklist)
107
+
108
+
def newsshow(~protocol, ~headers, ~data, uri) =
109
+
news.push(request.create("http://c.r/news.ogg"))
110
+
http.response(content_type = "application/json", data = "ok")
111
+
end
112
+
harbor.http.register("/newsshow", method = "POST", port = port, newsshow)
+7
nixos/2configs/services/radio/shell.nix
+7
nixos/2configs/services/radio/shell.nix
+60
nixos/2configs/services/radio/weather.nix
+60
nixos/2configs/services/radio/weather.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
weather_for_ips = pkgs.writers.writePython3Bin "weather_for_ips" {
4
+
libraries = [ pkgs.python3Packages.geoip2 ];
5
+
flakeIgnore = [ "E501" ];
6
+
} ./weather_for_ips.py;
7
+
8
+
weather_report = pkgs.writers.writeDashBin "weather_report" ''
9
+
set -efux
10
+
export PATH="${lib.makeBinPath [
11
+
pkgs.coreutils
12
+
pkgs.curl
13
+
pkgs.jq
14
+
]}"
15
+
curl -fSsz /tmp/GeoLite2-City.mmdb -o /tmp/GeoLite2-City.mmdb http://c.r/GeoLite2-City.mmdb
16
+
MAXMIND_GEOIP_DB="/tmp/GeoLite2-City.mmdb"; export MAXMIND_GEOIP_DB
17
+
OPENWEATHER_API_KEY=$(cat "$CREDENTIALS_DIRECTORY/openweather_api"); export OPENWEATHER_API_KEY
18
+
(
19
+
curl -sS 'http://admin:hackme@localhost:8000/admin/listclients.json?mount=/radio.ogg'
20
+
curl -sS 'http://admin:hackme@localhost:8000/admin/listclients.json?mount=/radio.mp3'
21
+
curl -sS 'http://admin:hackme@localhost:8000/admin/listclients.json?mount=/radio.opus'
22
+
) | jq -rs '
23
+
[
24
+
.[][].source|values|to_entries[].value |
25
+
(.listener//[]) [] |
26
+
(.useragent | capture("client-ip=(?<ip>[a-f0-9.:]+)")).ip // .ip
27
+
] |
28
+
unique[] |
29
+
select(. != "127.0.0.1") |
30
+
select(. != "::1")
31
+
' |
32
+
${weather_for_ips}/bin/weather_for_ips
33
+
'';
34
+
in {
35
+
systemd.services.weather = {
36
+
path = [
37
+
weather_report
38
+
pkgs.retry
39
+
pkgs.jq
40
+
pkgs.curl
41
+
];
42
+
script = ''
43
+
set -xefu
44
+
retry -t 5 -d 10 -- weather_report |
45
+
jq \
46
+
--arg from "$(date -u +'%FT%TZ')" \
47
+
--arg to "$(date -u +'%FT%TZ' -d '+1 hours')" \
48
+
--slurp --raw-input --compact-output --ascii-output \
49
+
'{text: ., from: $from, to: $to, priority: 100}' |
50
+
retry -t 5 -d 10 -- curl -fSs -d@- http://radio-news.r
51
+
'';
52
+
startAt = "*:58:00";
53
+
serviceConfig = {
54
+
User = "radio-news";
55
+
LoadCredential = [
56
+
"openweather_api:${config.krebs.secret.directory}/openweather_api_key"
57
+
];
58
+
};
59
+
};
60
+
}
+48
nixos/2configs/services/radio/weather_for_ips.py
+48
nixos/2configs/services/radio/weather_for_ips.py
···
1
+
import geoip2.database
2
+
import fileinput
3
+
import json
4
+
import requests
5
+
import os
6
+
import random
7
+
8
+
9
+
geoip = geoip2.database.Reader(os.environ['MAXMIND_GEOIP_DB'])
10
+
seen = {}
11
+
output = []
12
+
for ip in fileinput.input():
13
+
if "80.147.140.51" in ip:
14
+
output.append(
15
+
'Weather report for c-base, space. '
16
+
'It is empty space outside '
17
+
'with a temperature of -270 degrees, '
18
+
'a lightspeed of 299792 kilometers per second '
19
+
'and a humidity of Not a Number percent. '
20
+
f'The probability of reincarnation is {random.randrange(0, 100)} percent. '
21
+
)
22
+
else:
23
+
try:
24
+
location = geoip.city(ip.strip())
25
+
if location.city.geoname_id not in seen:
26
+
seen[location.city.geoname_id] = True
27
+
weather_api_key = os.environ['OPENWEATHER_API_KEY']
28
+
url = (
29
+
f'https://api.openweathermap.org/data/2.5/onecall'
30
+
f'?lat={location.location.latitude}'
31
+
f'&lon={location.location.longitude}'
32
+
f'&appid={weather_api_key}'
33
+
f'&units=metric'
34
+
)
35
+
resp = requests.get(url)
36
+
weather = json.loads(resp.text)
37
+
output.append(
38
+
f'Weather report for {location.city.name}, {location.country.name}. '
39
+
f'It is {weather["current"]["weather"][0]["description"]} outside '
40
+
f'with a temperature of {weather["current"]["temp"]:.1f} degrees, '
41
+
f'a wind speed of {weather["current"]["wind_speed"]:.1f} meters per second '
42
+
f'and a humidity of {weather["current"]["humidity"]} percent. '
43
+
f'The probability of precipitation is {weather["hourly"][0]["pop"] * 100:.0f} percent. '
44
+
)
45
+
except: # noqa E722
46
+
pass
47
+
48
+
print('\n'.join(output))
+57
nixos/2configs/services/site/default.nix
+57
nixos/2configs/services/site/default.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
security.acme = {
4
+
certs."lassul.us" = {
5
+
group = "lasscert";
6
+
};
7
+
};
8
+
9
+
users.groups.lasscert.members = [
10
+
"exim"
11
+
"nginx"
12
+
];
13
+
14
+
services.nginx.virtualHosts."lassul.us" = {
15
+
addSSL = true;
16
+
enableACME = true;
17
+
default = true;
18
+
locations."/".extraConfig = ''
19
+
root /srv/http/lassul.us;
20
+
'';
21
+
locations."= /retiolum-hosts.tar.bz2".extraConfig = ''
22
+
alias ${config.krebs.tinc.retiolum.hostsArchive};
23
+
'';
24
+
locations."= /hosts".extraConfig = ''
25
+
alias ${pkgs.krebs-hosts_combined};
26
+
'';
27
+
locations."= /retiolum.hosts".extraConfig = ''
28
+
alias ${pkgs.krebs-hosts-retiolum};
29
+
'';
30
+
locations."= /wireguard-key".extraConfig = ''
31
+
alias ${pkgs.writeText "prism.wg" config.krebs.hosts.prism.nets.wiregrill.wireguard.pubkey};
32
+
'';
33
+
locations."= /krebspage".extraConfig = ''
34
+
default_type "text/html";
35
+
alias ${pkgs.krebspage}/index.html;
36
+
'';
37
+
locations."= /init".extraConfig = let
38
+
initscript = pkgs.init.override {
39
+
pubkey = config.krebs.users.lass.pubkey;
40
+
};
41
+
in ''
42
+
alias ${initscript}/bin/init;
43
+
'';
44
+
locations."= /blue.pub".extraConfig = ''
45
+
alias ${pkgs.writeText "pub" config.krebs.users.lass-blue.pubkey};
46
+
'';
47
+
locations."= /ssh.pub".extraConfig = ''
48
+
alias ${pkgs.writeText "pub" config.krebs.users.lass-yubikey.pubkey};
49
+
'';
50
+
locations."= /gpg.pub".extraConfig = ''
51
+
alias ${pkgs.writeText "pub" config.krebs.users.lass-yubikey.pgp.pubkeys.default};
52
+
'';
53
+
locations."= /ip".extraConfig = ''
54
+
return 200 '$remote_addr';
55
+
'';
56
+
};
57
+
}
+1
nixos/2configs/tests/dummy-secrets/bepasty-secret.nix
+1
nixos/2configs/tests/dummy-secrets/bepasty-secret.nix
···
1
+
"bla"
nixos/2configs/tests/dummy-secrets/cbase.txt
nixos/2configs/tests/dummy-secrets/cbase.txt
+4
nixos/2configs/tests/dummy-secrets/grafana_security.nix
+4
nixos/2configs/tests/dummy-secrets/grafana_security.nix
+1
nixos/2configs/tests/dummy-secrets/hashedPasswords.nix
+1
nixos/2configs/tests/dummy-secrets/hashedPasswords.nix
···
1
+
{}
+1
nixos/2configs/tests/dummy-secrets/icecast-admin-pw
+1
nixos/2configs/tests/dummy-secrets/icecast-admin-pw
···
1
+
"blabla"
+1
nixos/2configs/tests/dummy-secrets/icecast-source-pw
+1
nixos/2configs/tests/dummy-secrets/icecast-source-pw
···
1
+
"blabla"
+1
nixos/2configs/tests/dummy-secrets/iodinepw.nix
+1
nixos/2configs/tests/dummy-secrets/iodinepw.nix
···
1
+
"derp"
+3
nixos/2configs/tests/dummy-secrets/lassul.us.dkim.priv
+3
nixos/2configs/tests/dummy-secrets/lassul.us.dkim.priv
+1
nixos/2configs/tests/dummy-secrets/mails.nix
+1
nixos/2configs/tests/dummy-secrets/mails.nix
···
1
+
[]
+1
nixos/2configs/tests/dummy-secrets/mysql_rootPassword
+1
nixos/2configs/tests/dummy-secrets/mysql_rootPassword
···
1
+
blabla123
+1
nixos/2configs/tests/dummy-secrets/nix-serve.key
+1
nixos/2configs/tests/dummy-secrets/nix-serve.key
···
1
+
key-name:blabla123
nixos/2configs/tests/dummy-secrets/nordvpn.txt
nixos/2configs/tests/dummy-secrets/nordvpn.txt
+1
nixos/2configs/tests/dummy-secrets/repos.nix
+1
nixos/2configs/tests/dummy-secrets/repos.nix
···
1
+
_: {}
+4
nixos/2configs/tests/dummy-secrets/retiolum.rsa_key.priv
+4
nixos/2configs/tests/dummy-secrets/retiolum.rsa_key.priv
+1
nixos/2configs/tests/dummy-secrets/searx.key
+1
nixos/2configs/tests/dummy-secrets/searx.key
···
1
+
yolo
nixos/2configs/tests/dummy-secrets/ssh-tor.priv
nixos/2configs/tests/dummy-secrets/ssh-tor.priv
+3
nixos/2configs/tests/dummy-secrets/ssh.id_ed25519
+3
nixos/2configs/tests/dummy-secrets/ssh.id_ed25519
+3
nixos/2configs/tests/dummy-secrets/ssh.id_rsa
+3
nixos/2configs/tests/dummy-secrets/ssh.id_rsa
nixos/2configs/tests/dummy-secrets/syncthing.cert
nixos/2configs/tests/dummy-secrets/syncthing.cert
nixos/2configs/tests/dummy-secrets/syncthing.key
nixos/2configs/tests/dummy-secrets/syncthing.key
+1
nixos/2configs/tests/dummy-secrets/transmission-pw
+1
nixos/2configs/tests/dummy-secrets/transmission-pw
···
1
+
"krebskrebs123"
+89
nixos/2configs/websites/ref.ptkk.de/default.nix
+89
nixos/2configs/websites/ref.ptkk.de/default.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
{
3
+
services.nginx.virtualHosts."ref.ptkk.de" = {
4
+
enableACME = true;
5
+
locations."/" = {
6
+
proxyPass = "http://localhost:4626";
7
+
extraConfig = ''
8
+
proxy_http_version 1.1;
9
+
proxy_set_header Host $host;
10
+
proxy_set_header X-Real-IP $remote_addr;
11
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
12
+
proxy_set_header X-Forwarded-Proto $scheme;
13
+
proxy_set_header X-Forwarded-Port $server_port;
14
+
proxy_set_header X-Forwarded-Host $host;
15
+
proxy_set_header Connection $connection_upgrade;
16
+
proxy_set_header Upgrade $http_upgrade;
17
+
proxy_cache_bypass $http_upgrade;
18
+
'';
19
+
};
20
+
locations."/static/" = {
21
+
alias = "/var/lib/ref.ptkk.de/static/";
22
+
};
23
+
forceSSL = true;
24
+
};
25
+
systemd.services."ref.ptkk.de" = {
26
+
wantedBy = [ "multi-user.target" ];
27
+
environment = {
28
+
PRODUCTION = "yip";
29
+
DATA_DIR = "/var/lib/ref.ptkk.de/data";
30
+
PORT = "4626";
31
+
STATIC_ROOT = "/var/lib/ref.ptkk.de/static";
32
+
};
33
+
path = with pkgs; [
34
+
git
35
+
gnutar
36
+
gzip
37
+
nix
38
+
];
39
+
serviceConfig = {
40
+
ExecStartPre = [
41
+
"${pkgs.coreutils}/bin/mkdir -p /var/lib/ref.ptkk.de/data"
42
+
"${pkgs.coreutils}/bin/mkdir -p /var/lib/ref.ptkk.de/code"
43
+
"${pkgs.coreutils}/bin/mkdir -p /var/lib/ref.ptkk.de/static"
44
+
];
45
+
ExecStart = pkgs.writers.writeDash "nixify" ''
46
+
cd code
47
+
if test -e shell.nix; then
48
+
${pkgs.nix}/bin/nix-shell -I /var/src --run serve
49
+
else
50
+
echo 'no shell.nix, bailing out'
51
+
exit 0
52
+
fi
53
+
'';
54
+
LoadCredential = [
55
+
"django-secret.key:${config.krebs.secret.directory}/ref.ptkk.de-django.key"
56
+
];
57
+
User = "ref.ptkk.de";
58
+
WorkingDirectory = "/var/lib/ref.ptkk.de";
59
+
StateDirectory = "ref.ptkk.de";
60
+
Restart = "always";
61
+
RestartSec = "100s";
62
+
};
63
+
};
64
+
systemd.services."ref.ptkk.de-restarter" = {
65
+
serviceConfig = {
66
+
Type = "oneshot";
67
+
ExecStart = "${pkgs.systemd}/bin/systemctl restart ref.ptkk.de.service";
68
+
};
69
+
};
70
+
systemd.paths."ref.ptkk.de-restarter" = {
71
+
wantedBy = [ "multi-user.target" ];
72
+
pathConfig.PathChanged = [
73
+
"/var/lib/ref.ptkk.de/code"
74
+
"/var/src/nixpkgs"
75
+
];
76
+
};
77
+
78
+
users.users."ref.ptkk.de" = {
79
+
isSystemUser = true;
80
+
uid = pkgs.stockholm.lib.genid_uint31 "ref.ptkk.de";
81
+
openssh.authorizedKeys.keys = [
82
+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF6fu6LtyRdk++qIBpP0BdZQHSTqzNNlvp7ML2Dv0IxD CI@github.com"
83
+
config.krebs.users.lass.pubkey
84
+
];
85
+
group = "nginx";
86
+
home = "/var/lib/ref.ptkk.de";
87
+
useDefaultShell = true;
88
+
};
89
+
}
nixos/5pkgs/autowifi/__pycache__/autowifi.cpython-37.pyc
nixos/5pkgs/autowifi/__pycache__/autowifi.cpython-37.pyc
This is a binary file and will not be displayed.
+1
nixos/5pkgs/autowifi/dbs/dcso
+1
nixos/5pkgs/autowifi/dbs/dcso
···
1
+
Insight Day/MyDCSO#19
+1
nixos/5pkgs/autowifi/dbs/dummy
+1
nixos/5pkgs/autowifi/dbs/dummy
···
1
+
myssid/mypassword
+9
nixos/5pkgs/autowifi/dbs/publics
+9
nixos/5pkgs/autowifi/dbs/publics
+9
nixos/5pkgs/autowifi/dbs/wifi_db
+9
nixos/5pkgs/autowifi/dbs/wifi_db
···
1
+
dcso-member/W75ykhFFc3qdWTuJmoeP
2
+
FRITZ!Box 6490 Cable/91972021718207812615
3
+
krebs/aidsballs
4
+
Kennynet/KennedyWPA2k1
5
+
KabelBox-8944/41426609447731908498
6
+
FRITZ!Box 7530 KU/04858720024803165993
7
+
cyberlin/welcome2cyber
8
+
NH7k-5GHz/geheimlan007
9
+
Raudi3Punkt0/RammsauerLechner
nixos/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key
nixos/2configs/tests/dummy-secrets/initrd/ssh.ed25519_key
+3
nixos/5pkgs/autowifi/hooks/connect/debug.sh
+3
nixos/5pkgs/autowifi/hooks/connect/debug.sh