This repository has no description
fix eval of many hosts
author
lassulus
date
(Sep 7, 2023, 7:17 PM CEST)
commit
7e4e5cf9
7e4e5cf9de0c1edde26278dee25fb1d96b1048b8
parent
8aab38a5
8aab38a5dee097772132030b9706605723ad4d1b
+260
-789
+2
-2
nixos/2configs/blue-host.nix
+2
-2
nixos/2configs/blue-host.nix
···
8
8
"prism"
9
9
"littleT"
10
10
];
11
-
remote_hosts = filter (h: h != config.networking.hostName) all_hosts;
11
+
remote_hosts = lib.filter (h: h != config.networking.hostName) all_hosts;
12
12
13
13
in {
14
14
imports = [
15
15
<stockholm/lass/2configs/container-networking.nix>
16
16
{ #hack for already defined
17
-
systemd.services."container@blue".reloadIfChanged = mkForce false;
17
+
systemd.services."container@blue".reloadIfChanged = lib.mkForce false;
18
18
systemd.services."container@blue".preStart = ''
19
19
${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue'
20
20
'';
-19
nixos/2configs/ciko.nix
-19
nixos/2configs/ciko.nix
···
1
-
{ config, pkgs, ... }:
2
-
{
3
-
users.users.ciko = {
4
-
uid = genid_uint31 "ciko";
5
-
description = "acc for ciko";
6
-
home = "/home/ciko";
7
-
useDefaultShell = true;
8
-
createHome = true;
9
-
openssh.authorizedKeys.keys = [
10
-
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTUWm/fISw/gbuHvf3kwxGEuk1aY5HrNNvr8QXCQv0khDdaYmZSELbtFQtE04WGTWmackNcLpld5mETVyCM0BjOgqMJYQNhtywxfYcodEY5xxHCuGgA3S1t94MZub+DRodXCfB0yUV85Wbb0sltkMTJufMwYmLEGxSLRukxAOcNsXdjlyro96csmYrIiV6R7+REnz8OcR7sKlI4tvKA1mbvWmjbDBd1MZ8Jc0Lwf+b0H/rH69wEQIcB5HRHHJIChoAk0t2azSjXagk1+4AebONZTCKvTHxs/D2wUBIzoxyjmh5S0aso/cKw8qpKcl/A2mZiIvW3KMlJAM5U+RQKMrr"
11
-
];
12
-
isNormalUser = true;
13
-
};
14
-
15
-
system.activationScripts.user-shadow = ''
16
-
${pkgs.coreutils}/bin/chmod +x /home/ciko
17
-
'';
18
-
}
19
-
+1
nixos/2configs/default.nix
+1
nixos/2configs/default.nix
···
29
29
self.inputs.stockholm.nixosModules.systemd
30
30
self.inputs.stockholm.nixosModules.xresources
31
31
self.inputs.stockholm.nixosModules.ssh
32
+
self.inputs.stockholm.nixosModules.sync-containers3
32
33
{
33
34
users.extraUsers.mainUser.passwordFile = "${config.krebs.secret.directory}/passwordFile";
34
35
users.extraUsers.root.passwordFile = "${config.krebs.secret.directory}/passwordFile";
-24
nixos/2configs/elster.nix
-24
nixos/2configs/elster.nix
···
1
-
{ config, pkgs, ... }:
2
-
3
-
let
4
-
mainUser = config.users.extraUsers.mainUser;
5
-
6
-
in {
7
-
users.extraUsers = {
8
-
elster = {
9
-
name = "elster";
10
-
description = "user for running elster-online";
11
-
home = "/home/elster";
12
-
useDefaultShell = true;
13
-
extraGroups = [];
14
-
createHome = true;
15
-
isNormalUser = true;
16
-
};
17
-
};
18
-
krebs.per-user.elster.packages = [
19
-
pkgs.chromium
20
-
];
21
-
security.sudo.extraConfig = ''
22
-
${mainUser.name} ALL=(elster) NOPASSWD: ALL
23
-
'';
24
-
}
+6
-3
nixos/2configs/exim-smarthost.nix
+6
-3
nixos/2configs/exim-smarthost.nix
···
1
-
{ config, lib, pkgs, ... }: let
1
+
{ self, config, lib, pkgs, ... }: let
2
2
3
-
to = concatStringsSep "," [
3
+
to = lib.concatStringsSep "," [
4
4
"lass@green.r"
5
5
];
6
6
7
-
mails = import <secrets/mails.nix>;
7
+
mails = import "${config.krebs.secret.directory}/mails.nix"; # todo make this pure somehow
8
8
9
9
in {
10
+
imports = [
11
+
self.inputs.stockholm.nixosModules.exim-smarthost
12
+
];
10
13
environment.systemPackages = [ pkgs.review-mail-queue ];
11
14
12
15
krebs.exim-smarthost = {
+2
-2
nixos/2configs/gg23.nix
+2
-2
nixos/2configs/gg23.nix
···
1
-
{ config, pkgs, ... }:
1
+
{ config, lib, pkgs, ... }:
2
2
{
3
3
# ipv6 from vodafone is really really flaky
4
4
boot.kernel.sysctl."net.ipv6.conf.et0.disable_ipv6" = 1;
···
55
55
{ predicate = "-o int0"; target = "ACCEPT"; }
56
56
{ predicate = "-p ipv6-icmp"; target = "ACCEPT"; v4 = false; }
57
57
];
58
-
krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
58
+
krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
59
59
{ v6 = false; predicate = "-s 10.42.0.0/24"; target = "ACCEPT"; }
60
60
];
61
61
krebs.iptables.tables.nat.POSTROUTING.rules = [
+17
-14
nixos/2configs/git-brain.nix
+17
-14
nixos/2configs/git-brain.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ self, config, lib, pkgs, ... }:
2
2
let
3
-
3
+
git = self.inputs.stockholm.lib.git;
4
4
repos = krebs-repos;
5
-
rules = concatMap krebs-rules (attrValues krebs-repos);
5
+
rules = lib.concatMap krebs-rules (lib.attrValues krebs-repos);
6
6
7
-
krebs-repos = mapAttrs make-krebs-repo {
7
+
krebs-repos = lib.mapAttrs make-krebs-repo {
8
8
brain = { };
9
9
};
10
10
···
31
31
set-owners repo [ config.krebs.users.lass ] ++ set-ro-access repo krebsminister;
32
32
33
33
set-ro-access = with git; repo: user:
34
-
singleton {
35
-
inherit user;
36
-
repo = [ repo ];
37
-
perm = fetch;
38
-
};
34
+
lib.singleton {
35
+
inherit user;
36
+
repo = [ repo ];
37
+
perm = fetch;
38
+
};
39
39
40
40
set-owners = with git;repo: user:
41
-
singleton {
42
-
inherit user;
43
-
repo = [ repo ];
44
-
perm = push "refs/*" [ non-fast-forward create delete merge ];
45
-
};
41
+
lib.singleton {
42
+
inherit user;
43
+
repo = [ repo ];
44
+
perm = push "refs/*" [ non-fast-forward create delete merge ];
45
+
};
46
46
47
47
in {
48
+
imports = [
49
+
self.inputs.stockholm.nixosModules.git
50
+
];
48
51
krebs.git = {
49
52
enable = true;
50
53
cgit = {
+19
-19
nixos/2configs/git.nix
+19
-19
nixos/2configs/git.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ self, config, lib, pkgs, ... }:
2
2
3
3
let
4
-
4
+
git = self.inputs.stockholm.lib.git;
5
5
out = {
6
+
imports = [
7
+
self.inputs.stockholm.nixosModules.git
8
+
];
6
9
services.nginx.enable = true;
7
10
krebs.git = {
8
11
enable = true;
···
31
34
32
35
repos =
33
36
public-repos //
34
-
optionalAttrs config.krebs.build.host.secure restricted-repos;
37
+
lib.optionalAttrs config.krebs.build.host.secure restricted-repos;
35
38
36
-
rules = concatMap make-rules (attrValues repos);
39
+
rules = lib.concatMap make-rules (lib.attrValues repos);
37
40
38
-
public-repos = mapAttrs make-public-repo {
41
+
public-repos = lib.mapAttrs make-public-repo {
39
42
Reaktor = {
40
43
cgit.desc = "Reaktor IRC bot";
41
44
cgit.section = "software";
···
119
122
cgit.desc = "krebs xmonad modules";
120
123
cgit.section = "configuration";
121
124
};
122
-
} // mapAttrs make-public-repo-silent {
123
125
};
124
126
125
-
restricted-repos = mapAttrs make-restricted-repo (
126
-
{
127
-
brain = {
128
-
collaborators = with config.krebs.users; [ tv makefu ];
129
-
announce = true;
130
-
};
127
+
restricted-repos = lib.mapAttrs make-restricted-repo {
128
+
brain = {
129
+
collaborators = with config.krebs.users; [ tv makefu ];
130
+
announce = true;
131
131
};
132
-
);
132
+
};
133
133
134
134
make-public-repo = name: { cgit ? {}, collaborators ? [], ... }: {
135
135
inherit cgit collaborators name;
···
159
159
public = false;
160
160
hooks = {
161
161
post-receive = ''
162
-
${optionalString announce (pkgs.git-hooks.irc-announce {
162
+
${lib.optionalString announce (pkgs.gystem.build.etct-hooks.irc-announce {
163
163
# TODO make nick = config.krebs.build.host.name the default
164
164
nick = config.krebs.build.host.name;
165
165
channel = "#xxx";
···
179
179
make-rules =
180
180
with git // config.krebs.users;
181
181
repo:
182
-
singleton {
182
+
lib.singleton {
183
183
user = [ lass lass-green ];
184
184
repo = [ repo ];
185
185
perm = push "refs/*" [ non-fast-forward create delete merge ];
186
186
} ++
187
-
optional (length (repo.admins or []) > 0) {
187
+
lib.optional (lib.length (repo.admins or []) > 0) {
188
188
user = repo.admins;
189
189
repo = [ repo ];
190
190
perm = push "refs/*" [ non-fast-forward create delete merge ];
191
191
} ++
192
-
optional (length (repo.collaborators or []) > 0) {
192
+
lib.optional (lib.length (repo.collaborators or []) > 0) {
193
193
user = repo.collaborators;
194
194
repo = [ repo ];
195
195
perm = fetch;
196
196
} ++
197
-
optional repo.public {
198
-
user = attrValues config.krebs.users;
197
+
lib.optional repo.public {
198
+
user = lib.attrValues config.krebs.users;
199
199
repo = [ repo ];
200
200
perm = fetch;
201
201
};
+5
-1
nixos/2configs/go.nix
+5
-1
nixos/2configs/go.nix
+2
-2
nixos/2configs/home-media.nix
+2
-2
nixos/2configs/home-media.nix
···
1
-
{ pkgs, ... }:
1
+
{ self, pkgs, ... }:
2
2
{
3
3
imports = [
4
4
./mpv.nix
5
5
];
6
6
users.users.media = {
7
7
isNormalUser = true;
8
-
uid = genid_uint31 "media";
8
+
uid = self.inputs.stockholm.lib.genid_uint31 "media";
9
9
extraGroups = [ "video" "audio" "pipewire" ];
10
10
packages = [
11
11
(pkgs.writers.writeDashBin "mpv" ''
-23
nixos/2configs/logf.nix
-23
nixos/2configs/logf.nix
···
1
-
{ config, pkgs, ... }:
2
-
let
3
-
host-colors = {
4
-
mors = "131";
5
-
prism = "95";
6
-
uriel = "61";
7
-
shodan = "51";
8
-
icarus = "53";
9
-
echelon = "197";
10
-
cloudkrebs = "119";
11
-
};
12
-
urgent = [
13
-
"\\blass@blue\\b"
14
-
];
15
-
in {
16
-
environment.systemPackages = [
17
-
(pkgs.writeDashBin "logf" ''
18
-
export LOGF_URGENT=${pkgs.writeJSON "urgent" urgent}
19
-
export LOGF_HOST_COLORS=${pkgs.writeJSON "host-colors" host-colors}
20
-
${pkgs.logf}/bin/logf ${concatMapStringsSep " " (name: "root@${name}") (attrNames config.lass.hosts)}
21
-
'')
22
-
];
23
-
}
+4
-1
nixos/2configs/mumble-reminder.nix
+4
-1
nixos/2configs/mumble-reminder.nix
···
1
-
{ config, lib, pkgs, ... }: let
1
+
{ self, config, lib, pkgs, ... }: let
2
2
write_to_irc = chan: pkgs.writeDash "write_to_irc" ''
3
3
${pkgs.curl}/bin/curl -fsSv --unix-socket '${lib.removePrefix "unix:" config.krebs.reaktor2.mumble-reminder.API.listen}' http://z/ \
4
4
-H content-type:application/json \
···
60
60
};
61
61
62
62
in {
63
+
imports = [
64
+
self.inputs.stockholm.nixosModules.reaktor2
65
+
];
63
66
krebs.reaktor2.mumble-reminder = {
64
67
hostname = "irc.hackint.org";
65
68
nick = "lassulus__";
+2
-2
nixos/2configs/paste.nix
+2
-2
nixos/2configs/paste.nix
···
1
-
{ config, pkgs, ... }:
1
+
{ config, lib, pkgs, ... }:
2
2
3
3
{
4
4
services.nginx.virtualHosts.cyberlocker = {
···
104
104
krebs.htgen.paste-form = {
105
105
port = 7770;
106
106
script = /* sh */ ''
107
-
export PATH=${makeBinPath [
107
+
export PATH=${lib.makeBinPath [
108
108
pkgs.curl
109
109
pkgs.gnused
110
110
]}:$PATH
+2
-2
nixos/2configs/radicale.nix
+2
-2
nixos/2configs/radicale.nix
···
1
-
{ ... }:
1
+
{ config, ... }:
2
2
3
3
{
4
4
services.radicale = {
···
8
8
hosts = 0.0.0.0:5555
9
9
[auth]
10
10
type = htpasswd
11
-
htpasswd_filename = ${<secrets/radicale.htpasswd>}
11
+
htpasswd_filename = ${config.krebs.secret.directory}/radicale.htpasswd
12
12
htpasswd_encryption = plain
13
13
'';
14
14
};
+5
-9
nixos/2configs/realwallpaper.nix
+5
-9
nixos/2configs/realwallpaper.nix
···
1
-
{ config, lib, pkgs, ... }:
2
-
3
-
let
4
-
hostname = config.krebs.build.host.name;
5
-
inherit (lib)
6
-
nameValuePair
7
-
;
8
-
9
-
in {
1
+
{ self, config, lib, pkgs, ... }:
2
+
{
3
+
imports = [
4
+
self.inputs.stockholm.nixosModules.realwallpaper
5
+
];
10
6
krebs.realwallpaper.enable = true;
11
7
12
8
system.activationScripts.wallpaper-chmod = ''
+4
-1
nixos/2configs/riot.nix
+4
-1
nixos/2configs/riot.nix
···
1
-
{ config, lib, pkgs, ... }: let
1
+
{ self, config, lib, pkgs, ... }: let
2
2
domains = [
3
3
"hackerfleet.eu"
4
4
"hackerfleet.de"
5
5
];
6
6
in {
7
+
imports = [
8
+
self.inputs.stockholm.nixosModules.exim-smarthost
9
+
];
7
10
containers.riot = {
8
11
config = {
9
12
environment.systemPackages = [
-21
nixos/2configs/termite.nix
-21
nixos/2configs/termite.nix
···
1
-
{ config, pkgs, ... }:
2
-
3
-
{
4
-
environment.systemPackages = [
5
-
pkgs.termite
6
-
];
7
-
8
-
krebs.per-user.lass.packages = let
9
-
termitecfg = pkgs.writeTextFile {
10
-
name = "termite-config";
11
-
destination = "/etc/xdg/termite/config";
12
-
text = ''
13
-
[colors]
14
-
foreground = #d0d7d0
15
-
background = #000000
16
-
'';
17
-
};
18
-
in [
19
-
termitecfg
20
-
];
21
-
}
+2
-2
nixos/2configs/tor-initrd.nix
+2
-2
nixos/2configs/tor-initrd.nix
···
11
11
config.krebs.users.lass-mors.pubkey
12
12
config.krebs.users.lass-green.pubkey
13
13
];
14
-
hostKeys = [ <secrets/initrd/ssh.ed25519_key> ];
14
+
hostKeys = [ "${config.krebs.secret.directory}/ssh.ed25519_key" ];
15
15
};
16
16
boot.initrd.availableKernelModules = [ "e1000e" ];
17
17
18
18
boot.initrd.secrets = {
19
-
"/etc/tor/onion/bootup" = ${config.krebs.secret.directory}/initrd;
19
+
"/etc/tor/onion/bootup" = "${config.krebs.secret.directory}/initrd";
20
20
};
21
21
22
22
boot.initrd.extraUtilsCommands = ''
+1
-1
nixos/2configs/vim.nix
+1
-1
nixos/2configs/vim.nix
···
125
125
let g:fzf_layout = { 'down': '~15%' }
126
126
'';
127
127
128
-
extra-runtimepath = lib.concatMapStringsSep "," (pkg: "${pkg.rtp}") [
128
+
extra-runtimepath = lib.concatMapStringsSep "," (pkg: "${pkg.outPath}") [
129
129
pkgs.vimPlugins.copilot-vim
130
130
pkgs.vimPlugins.undotree
131
131
pkgs.vimPlugins.fzf-vim
-1
nixos/3modules/default.nix
-1
nixos/3modules/default.nix
-12
nixos/3modules/hosts.nix
-12
nixos/3modules/hosts.nix
+4
-1
nixos/2configs/bgt-bot/default.nix
+4
-1
nixos/2configs/bgt-bot/default.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ self, pkgs, ... }:
2
2
let
3
3
4
4
bot_port = "7654";
5
5
irc_channel = "#binaergewitter";
6
6
in
7
7
{
8
+
imports = [
9
+
self.inputs.stockholm.nixosModules.reaktor2
10
+
];
8
11
krebs.reaktor2.bgt-announce = {
9
12
hostname = "irc.libera.chat";
10
13
port = "6697";
+2
-2
nixos/2configs/hw/x220.nix
+2
-2
nixos/2configs/hw/x220.nix
+7
-6
nixos/2configs/websites/domsen.nix
+7
-6
nixos/2configs/websites/domsen.nix
···
1
-
{ config, pkgs, lib, ... }:
1
+
{ self, config, pkgs, lib, ... }:
2
2
3
3
let
4
4
5
-
inherit (import <stockholm/lib>)
6
-
genid
5
+
inherit (self.inputs.stockholm.lib)
7
6
genid_uint31
8
7
;
9
-
inherit (import <stockholm/lass/2configs/websites/util.nix> {inherit lib pkgs;})
8
+
inherit (import ./util.nix {inherit lib pkgs;})
10
9
servePage
11
10
serveOwncloud
12
11
serveWordpress;
···
23
22
24
23
in {
25
24
imports = [
25
+
self.inputs.stockholm.nixosModules.acl
26
+
self.inputs.stockholm.nixosModules.on-failure
26
27
./default.nix
27
28
./sqlBackup.nix
28
29
(servePage [ "aldonasiech.com" "www.aldonasiech.com" ])
···
101
102
path = "/run/nextcloud.pw";
102
103
owner.name = "nextcloud";
103
104
group-name = "nextcloud";
104
-
source-path = toString <secrets> + "/nextcloud_pw";
105
+
source-path = "${config.krebs.secret.directory}/nextcloud_pw";
105
106
};
106
107
services.nextcloud = {
107
108
enable = true;
···
412
413
services.restic.backups.domsen = {
413
414
initialize = true;
414
415
repository = "/backups/domsen";
415
-
passwordFile = toString <secrets> + "/domsen_backup_pw";
416
+
passwordFile = "${config.krebs.secret.directory}/domsen_backup_pw";
416
417
timerConfig = { OnCalendar = "00:05"; RandomizedDelaySec = "5h"; };
417
418
paths = [
418
419
"/home/domsen/Mail"
+1
-1
nixos/machines/blue/config.nix
+1
-1
nixos/machines/blue/config.nix
+19
-21
nixos/machines/coaxmetal/config.nix
+19
-21
nixos/machines/coaxmetal/config.nix
···
2
2
3
3
{
4
4
imports = [
5
-
<stockholm/lass>
6
-
7
-
<stockholm/lass/2configs/retiolum.nix>
8
-
<stockholm/lass/2configs/exim-retiolum.nix>
9
-
<stockholm/lass/2configs/baseX.nix>
10
-
<stockholm/lass/2configs/browsers.nix>
11
-
<stockholm/lass/2configs/programs.nix>
12
-
<stockholm/lass/2configs/network-manager.nix>
13
-
<stockholm/lass/2configs/syncthing.nix>
14
-
<stockholm/lass/2configs/sync/sync.nix>
15
-
<stockholm/lass/2configs/games.nix>
16
-
<stockholm/lass/2configs/steam.nix>
17
-
<stockholm/lass/2configs/wine.nix>
18
-
<stockholm/lass/2configs/fetchWallpaper.nix>
19
-
<stockholm/lass/2configs/yellow-mounts/samba.nix>
20
-
<stockholm/lass/2configs/pass.nix>
21
-
<stockholm/lass/2configs/mail.nix>
22
-
<stockholm/lass/2configs/bitcoin.nix>
23
-
<stockholm/lass/2configs/review.nix>
24
-
<stockholm/lass/2configs/dunst.nix>
25
-
# <stockholm/krebs/2configs/ircd.nix>
5
+
../../.
6
+
../../2configs/retiolum.nix
7
+
../../2configs/exim-retiolum.nix
8
+
../../2configs/baseX.nix
9
+
../../2configs/browsers.nix
10
+
../../2configs/programs.nix
11
+
../../2configs/network-manager.nix
12
+
../../2configs/syncthing.nix
13
+
../../2configs/sync/sync.nix
14
+
../../2configs/games.nix
15
+
../../2configs/steam.nix
16
+
../../2configs/wine.nix
17
+
../../2configs/fetchWallpaper.nix
18
+
../../2configs/yellow-mounts/samba.nix
19
+
../../2configs/pass.nix
20
+
../../2configs/mail.nix
21
+
../../2configs/bitcoin.nix
22
+
../../2configs/review.nix
23
+
../../2configs/dunst.nix
26
24
];
27
25
28
26
krebs.build.host = config.krebs.hosts.coaxmetal;
+4
-4
nixos/machines/daedalus/config.nix
+4
-4
nixos/machines/daedalus/config.nix
···
1
-
{ config, pkgs, ... }:
1
+
{ self, config, lib, pkgs, ... }:
2
2
3
3
{
4
4
imports = [
5
-
../../
5
+
../../.
6
6
7
7
../../2configs/retiolum.nix
8
8
../../2configs/pipewire.nix
9
9
{
10
10
# bubsy config
11
11
users.users.bubsy = {
12
-
uid = genid "bubsy";
12
+
uid = self.inputs.stockholm.lib.genid "bubsy";
13
13
home = "/home/bubsy";
14
14
group = "users";
15
15
createHome = true;
···
23
23
isNormalUser = true;
24
24
};
25
25
networking.networkmanager.enable = true;
26
-
networking.wireless.enable = mkForce false;
26
+
networking.wireless.enable = lib.mkForce false;
27
27
# programs.chromium = {
28
28
# enable = true;
29
29
# extensions = [
+3
-2
nixos/machines/daedalus/physical.nix
+3
-2
nixos/machines/daedalus/physical.nix
+5
-5
nixos/machines/dishfire/config.nix
+5
-5
nixos/machines/dishfire/config.nix
···
2
2
3
3
{
4
4
imports = [
5
-
<stockholm/lass>
6
-
<stockholm/lass/2configs/retiolum.nix>
7
-
<stockholm/lass/2configs/monitoring/prometheus.nix>
8
-
<stockholm/lass/2configs/monitoring/telegraf.nix>
9
-
<stockholm/lass/2configs/consul.nix>
5
+
../../.
6
+
../../2configs/retiolum.nix
7
+
../../2configs/monitoring/prometheus.nix
8
+
../../2configs/monitoring/telegraf.nix
9
+
../../2configs/consul.nix
10
10
];
11
11
12
12
krebs.build.host = config.krebs.hosts.dishfire;
+5
-6
nixos/machines/echelon/config.nix
+5
-6
nixos/machines/echelon/config.nix
···
1
1
{ config, pkgs, ... }:
2
2
{
3
3
imports = [
4
-
<stockholm/lass>
5
-
6
-
<stockholm/lass/2configs/retiolum.nix>
7
-
<stockholm/lass/2configs/tor-initrd.nix>
8
-
<stockholm/lass/2configs/syncthing.nix>
9
-
<stockholm/lass/2configs/green-host.nix>
4
+
../../.
5
+
../../2configs/retiolum.nix
6
+
../../2configs/tor-initrd.nix
7
+
../../2configs/syncthing.nix
8
+
../../2configs/green-host.nix
10
9
];
11
10
12
11
krebs.build.host = config.krebs.hosts.echelon;
+1
-1
nixos/machines/green/config.nix
+1
-1
nixos/machines/green/config.nix
+4
-11
nixos/machines/hilum/config.nix
+4
-11
nixos/machines/hilum/config.nix
···
1
1
{ config, pkgs, ... }:
2
2
{
3
3
imports = [
4
-
<stockholm/lass>
5
-
6
-
<stockholm/lass/2configs/retiolum.nix>
7
-
# <stockholm/lass/2configs/baseX.nix>
8
-
# <stockholm/lass/2configs/pipewire.nix>
9
-
# <stockholm/lass/2configs/browsers.nix>
10
-
# <stockholm/lass/2configs/programs.nix>
11
-
<stockholm/lass/2configs/network-manager.nix>
12
-
# <stockholm/lass/2configs/mail.nix>
13
-
<stockholm/lass/2configs/syncthing.nix>
14
-
# <stockholm/lass/2configs/nfs-dl.nix>
4
+
../../.
5
+
../../2configs/retiolum.nix
6
+
../../2configs/network-manager.nix
7
+
../../2configs/syncthing.nix
15
8
];
16
9
17
10
krebs.build.host = config.krebs.hosts.hilum;
+3
-2
nixos/machines/hilum/physical.nix
+3
-2
nixos/machines/hilum/physical.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ self, modulesPath, config, lib, pkgs, ... }:
2
2
3
3
{
4
4
imports = [
5
5
./config.nix
6
-
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
6
+
(modulesPath + "/installer/scan/not-detected.nix")
7
+
self.inputs.disko.nixosModules.disko
7
8
{
8
9
# nice hack to carry around state passed impurely at the beginning
9
10
options.mainDisk = let
+18
-18
nixos/machines/icarus/config.nix
+18
-18
nixos/machines/icarus/config.nix
···
2
2
3
3
{
4
4
imports = [
5
-
../../
5
+
../../.
6
6
7
-
../../2configs/mouse.nix>
8
-
../../2configs/retiolum.nix>
9
-
../../2configs/git.nix>
10
-
../../2configs/exim-retiolum.nix>
11
-
../../2configs/baseX.nix>
12
-
../../2configs/pipewire.nix>
13
-
../../2configs/browsers.nix>
14
-
../../2configs/programs.nix>
15
-
../../2configs/fetchWallpaper.nix>
16
-
../../2configs/games.nix>
17
-
../../2configs/bitcoin.nix>
18
-
../../2configs/wine.nix>
19
-
../../2configs/network-manager.nix>
20
-
../../2configs/red-host.nix>
21
-
../../2configs/ipfs.nix>
22
-
../../2configs/snapclient.nix>
23
-
../../2configs/consul.nix>
7
+
../../2configs/mouse.nix
8
+
../../2configs/retiolum.nix
9
+
../../2configs/git.nix
10
+
../../2configs/exim-retiolum.nix
11
+
../../2configs/baseX.nix
12
+
../../2configs/pipewire.nix
13
+
../../2configs/browsers.nix
14
+
../../2configs/programs.nix
15
+
../../2configs/fetchWallpaper.nix
16
+
../../2configs/games.nix
17
+
../../2configs/bitcoin.nix
18
+
../../2configs/wine.nix
19
+
../../2configs/network-manager.nix
20
+
../../2configs/red-host.nix
21
+
../../2configs/ipfs.nix
22
+
../../2configs/snapclient.nix
23
+
../../2configs/consul.nix
24
24
{ # === logging playground ===
25
25
# --- client ---
26
26
+3
-5
nixos/machines/icarus/physical.nix
+3
-5
nixos/machines/icarus/physical.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ self, modulesPath, lib, ... }:
2
2
{
3
3
imports = [
4
4
./config.nix
5
-
#<stockholm/lass/2configs/hw/x220.nix>
6
-
#<stockholm/lass/2configs/boot/universal.nix>
7
-
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
8
-
<stockholm/krebs/2configs/hw/x220.nix>
5
+
(modulesPath + "/installer/scan/not-detected.nix")
6
+
(self.inputs.stockholm + "/krebs/2configs/hw/x220.nix")
9
7
];
10
8
11
9
boot.loader.grub.enable = true;
+3
-3
nixos/machines/lasspi/config.nix
+3
-3
nixos/machines/lasspi/config.nix
-29
nixos/machines/littleT/config.nix
-29
nixos/machines/littleT/config.nix
···
1
-
{ config, pkgs, ... }:
2
-
3
-
{
4
-
imports = [
5
-
../../
6
-
7
-
../../2configs/retiolum.nix
8
-
../../2configs/blue-host.nix
9
-
../../2configs/green-host.nix
10
-
../../2configs/syncthing.nix
11
-
];
12
-
13
-
networking.networkmanager.enable = true;
14
-
networking.wireless.enable = mkForce false;
15
-
time.timeZone = "Europe/Berlin";
16
-
17
-
hardware.trackpoint = {
18
-
enable = true;
19
-
sensitivity = 220;
20
-
speed = 0;
21
-
emulateWheel = true;
22
-
};
23
-
24
-
services.logind.extraConfig = ''
25
-
HandleLidSwitch=ignore
26
-
'';
27
-
28
-
krebs.build.host = config.krebs.hosts.littleT;
29
-
}
-25
nixos/machines/littleT/physical.nix
-25
nixos/machines/littleT/physical.nix
···
1
-
{
2
-
imports = [
3
-
./config.nix
4
-
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
5
-
];
6
-
fileSystems."/" =
7
-
{ device = "rpool/root";
8
-
fsType = "zfs";
9
-
};
10
-
11
-
fileSystems."/boot" =
12
-
{ device = "/dev/disk/by-uuid/5B2E-3734";
13
-
fsType = "vfat";
14
-
};
15
-
boot.loader.grub.enable = true;
16
-
boot.loader.grub.version = 2;
17
-
boot.loader.grub.efiSupport = true;
18
-
boot.loader.grub.efiInstallAsRemovable = true;
19
-
boot.loader.grub.device = "nodev";
20
-
networking.hostId = "584248c6";
21
-
22
-
boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
23
-
boot.kernelModules = [ "kvm-intel" ];
24
-
25
-
}
+1
-7
nixos/machines/mors/config.nix
+1
-7
nixos/machines/mors/config.nix
···
2
2
3
3
{
4
4
imports = [
5
-
../../
5
+
../../.
6
6
7
7
../../2configs/mouse.nix
8
8
../../2configs/retiolum.nix
···
14
14
../../2configs/browsers.nix
15
15
../../2configs/games.nix
16
16
../../2configs/pass.nix
17
-
../../2configs/elster.nix
18
17
../../2configs/steam.nix
19
18
../../2configs/wine.nix
20
19
../../2configs/fetchWallpaper.nix
21
20
../../2configs/mail.nix
22
-
../../2configs/logf.nix
23
21
../../2configs/syncthing.nix
24
22
../../2configs/sync/sync.nix
25
23
../../2configs/sync/decsync.nix
···
121
119
"virtual"
122
120
];
123
121
};
124
-
};
125
-
126
-
krebs.repo-sync.timerConfig = {
127
-
OnCalendar = "00:37";
128
122
};
129
123
130
124
nixpkgs.config.android_sdk.accept_license = true;
+2
-2
nixos/machines/mors/physical.nix
+2
-2
nixos/machines/mors/physical.nix
+17
-17
nixos/machines/neoprism/config.nix
+17
-17
nixos/machines/neoprism/config.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ self, config, lib, pkgs, ... }:
2
2
3
3
{
4
4
imports = [
5
-
<stockholm/lass>
6
-
<stockholm/lass/2configs/retiolum.nix>
7
-
<stockholm/lass/2configs/mail/internet-gateway.nix>
8
-
<stockholm/lass/2configs/binary-cache/server.nix>
9
-
<stockholm/lass/2configs/matrix.nix>
10
-
<stockholm/lass/2configs/gsm-wiki.nix>
5
+
../../.
6
+
../../2configs/retiolum.nix
7
+
../../2configs/mail/internet-gateway.nix
8
+
../../2configs/binary-cache/server.nix
9
+
../../2configs/matrix.nix
10
+
../../2configs/gsm-wiki.nix
11
11
12
12
# sync-containers
13
-
<stockholm/lass/2configs/consul.nix>
14
-
<stockholm/lass/2configs/services/flix/container-host.nix>
15
-
<stockholm/lass/2configs/services/radio/container-host.nix>
16
-
<stockholm/lass/2configs/ubik-host.nix>
17
-
<stockholm/lass/2configs/orange-host.nix>
18
-
<stockholm/krebs/2configs/hotdog-host.nix>
13
+
../../2configs/consul.nix
14
+
../../2configs/services/flix/container-host.nix
15
+
../../2configs/services/radio/container-host.nix
16
+
../../2configs/ubik-host.nix
17
+
../../2configs/orange-host.nix
18
+
(self.inputs.stockholm + "/krebs/2configs/hotdog-host.nix")
19
19
20
20
# other containers
21
-
<stockholm/lass/2configs/riot.nix>
21
+
../../2configs/riot.nix
22
22
23
23
# proxying of services
24
-
<stockholm/lass/2configs/services/radio/proxy.nix>
25
-
<stockholm/lass/2configs/services/flix/proxy.nix>
26
-
<stockholm/lass/2configs/services/coms/proxy.nix>
24
+
../../2configs/services/radio/proxy.nix
25
+
../../2configs/services/flix/proxy.nix
26
+
../../2configs/services/coms/proxy.nix
27
27
];
28
28
29
29
krebs.build.host = config.krebs.hosts.neoprism;
+3
-2
nixos/machines/neoprism/physical.nix
+3
-2
nixos/machines/neoprism/physical.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ self, modulesPath, config, lib, ... }:
2
2
3
3
{
4
4
5
5
imports = [
6
6
./config.nix
7
-
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
7
+
(modulesPath + "/installer/scan/not-detected.nix")
8
+
self.inputs.disko.nixosModules.disko
8
9
];
9
10
10
11
disko.devices = import ./disk.nix;
+5
-5
nixos/machines/orange/config.nix
+5
-5
nixos/machines/orange/config.nix
···
1
1
{ config, lib, pkgs, ... }:
2
2
{
3
3
imports = [
4
-
<stockholm/lass>
5
-
<stockholm/lass/2configs>
6
-
<stockholm/lass/2configs/retiolum.nix>
7
-
<stockholm/lass/2configs/mumble-reminder.nix>
8
-
<stockholm/lass/2configs/services/git>
4
+
../../.
5
+
../../2configs
6
+
../../2configs/retiolum.nix
7
+
../../2configs/mumble-reminder.nix
8
+
../../2configs/services/git
9
9
];
10
10
11
11
krebs.build.host = config.krebs.hosts.orange;
+17
-18
nixos/machines/prism/config.nix
+17
-18
nixos/machines/prism/config.nix
···
1
-
{ config, lib, pkgs, ... }:
2
-
3
-
{
1
+
{ self, config, lib, pkgs, ... }: let
2
+
slib = self.inputs.stockholm.lib;
3
+
in {
4
4
imports = [
5
5
./backup.nix
6
-
../../
6
+
../../.
7
7
../../2configs/retiolum.nix
8
8
../../2configs/libvirt.nix
9
9
../../2configs/websites/lassulus.nix
···
27
27
}
28
28
{ # TODO make new hfos.nix out of this vv
29
29
users.users.riot = {
30
-
uid = genid_uint31 "riot";
30
+
uid = slib.genid_uint31 "riot";
31
31
isNormalUser = true;
32
32
extraGroups = [ "libvirtd" ];
33
33
openssh.authorizedKeys.keys = [
34
34
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC6o6sdTu/CX1LW2Ff5bNDqGEAGwAsjf0iIe5DCdC7YikCct+7x4LTXxY+nDlPMeGcOF88X9/qFwdyh+9E4g0nUAZaeL14Uc14QDqDt/aiKjIXXTepxE/i4JD9YbTqStAnA/HYAExU15yqgUdj2dnHu7OZcGxk0ZR1OY18yclXq7Rq0Fd3pN3lPP1T4QHM9w66r83yJdFV9szvu5ral3/QuxQnCNohTkR6LoJ4Ny2RbMPTRtb+jPbTQYTWUWwV69mB8ot5nRTP4MRM9pu7vnoPF4I2S5DvSnx4C5zdKzsb7zmIvD4AmptZLrXj4UXUf00Xf7Js5W100Ne2yhYyhq+35 riot@lagrange"
35
35
];
36
36
};
37
-
krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
37
+
krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
38
38
{ v6 = false; predicate = "--destination 95.216.1.130"; target = "ACCEPT"; }
39
39
{ v6 = false; predicate = "--source 95.216.1.130"; target = "ACCEPT"; }
40
40
];
41
41
}
42
42
{
43
43
users.users.tv = {
44
-
uid = genid_uint31 "tv";
44
+
uid = slib.genid_uint31 "tv";
45
45
isNormalUser = true;
46
46
openssh.authorizedKeys.keys = [
47
47
config.krebs.users.tv.pubkey
48
48
];
49
49
};
50
50
users.users.makefu = {
51
-
uid = genid_uint31 "makefu";
51
+
uid = slib.genid_uint31 "makefu";
52
52
isNormalUser = true;
53
53
openssh.authorizedKeys.keys = [
54
54
config.krebs.users.makefu.pubkey
55
55
];
56
56
};
57
57
users.extraUsers.dritter = {
58
-
uid = genid_uint31 "dritter";
58
+
uid = slib.genid_uint31 "dritter";
59
59
isNormalUser = true;
60
60
extraGroups = [
61
61
"download"
···
72
72
];
73
73
};
74
74
users.users.hellrazor = {
75
-
uid = genid_uint31 "hellrazor";
75
+
uid = slib.genid_uint31 "hellrazor";
76
76
isNormalUser = true;
77
77
extraGroups = [
78
78
"download"
···
115
115
../../2configs/paste.nix
116
116
../../2configs/syncthing.nix
117
117
../../2configs/reaktor-coders.nix
118
-
../../2configs/ciko.nix
119
118
../../2configs/container-networking.nix
120
119
../../2configs/fysiirc.nix
121
120
../../2configs/bgt-bot
122
121
../../2configs/matrix.nix
123
-
<stockholm/krebs/2configs/mastodon-proxy.nix>
122
+
(self.inputs.stockholm + "/krebs/2configs/mastodon-proxy.nix")
124
123
{
125
124
services.tor = {
126
125
enable = true;
···
142
141
'';
143
142
};
144
143
}
145
-
/2configs/minecraft.nix
146
-
/2configs/codimd.nix
147
-
/2configs/go.nix
144
+
../../2configs/minecraft.nix
145
+
../../2configs/codimd.nix
146
+
../../2configs/go.nix
148
147
{
149
148
lass.nichtparasoup.enable = true;
150
149
services.nginx = {
···
162
161
imports = [
163
162
../../2configs/wiregrill.nix
164
163
];
165
-
krebs.iptables.tables.nat.PREROUTING.rules = mkOrder 999 [
164
+
krebs.iptables.tables.nat.PREROUTING.rules = lib.mkOrder 999 [
166
165
{ v6 = false; predicate = "-s 10.244.0.0/16"; target = "ACCEPT"; }
167
166
{ v4 = false; predicate = "-s 42:1::/32"; target = "ACCEPT"; }
168
167
];
169
-
krebs.iptables.tables.filter.FORWARD.rules = mkBefore [
168
+
krebs.iptables.tables.filter.FORWARD.rules = lib.mkBefore [
170
169
{ predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
171
170
{ predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
172
171
];
···
242
241
name = "download";
243
242
home = "/var/download";
244
243
useDefaultShell = true;
245
-
uid = genid "download";
244
+
uid = slib.genid "download";
246
245
isSystemUser = true;
247
246
openssh.authorizedKeys.keys = with config.krebs.users; [
248
247
lass.pubkey
+2
-2
nixos/machines/prism/physical.nix
+2
-2
nixos/machines/prism/physical.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ modulesPath, config, lib, pkgs, ... }:
2
2
3
3
{
4
4
5
5
imports = [
6
6
./config.nix
7
-
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
7
+
(modulesPath + "/installer/scan/not-detected.nix")
8
8
];
9
9
10
10
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "sd_mod" ];
+5
-6
nixos/machines/radio/config.nix
+5
-6
nixos/machines/radio/config.nix
···
1
1
{ config, lib, pkgs, ... }:
2
2
{
3
3
imports = [
4
-
<stockholm/lass>
5
-
<stockholm/lass/2configs>
6
-
<stockholm/lass/2configs/retiolum.nix>
7
-
8
-
<stockholm/lass/2configs/syncthing.nix>
9
-
<stockholm/lass/2configs/services/radio>
4
+
../../.
5
+
../../2configs
6
+
../../2configs/retiolum.nix
7
+
../../2configs/syncthing.nix
8
+
../../2configs/services/radio
10
9
];
11
10
12
11
krebs.build.host = config.krebs.hosts.radio;
+14
-15
nixos/machines/shodan/config.nix
+14
-15
nixos/machines/shodan/config.nix
···
2
2
3
3
{
4
4
imports = [
5
-
<stockholm/lass>
6
-
7
-
<stockholm/lass/2configs/mouse.nix>
8
-
<stockholm/lass/2configs/retiolum.nix>
9
-
<stockholm/lass/2configs/baseX.nix>
10
-
<stockholm/lass/2configs/pipewire.nix>
11
-
<stockholm/lass/2configs/exim-retiolum.nix>
12
-
<stockholm/lass/2configs/browsers.nix>
13
-
<stockholm/lass/2configs/programs.nix>
14
-
<stockholm/lass/2configs/wine.nix>
15
-
<stockholm/lass/2configs/bitcoin.nix>
16
-
<stockholm/lass/2configs/yellow-mounts/samba.nix>
17
-
<stockholm/lass/2configs/fetchWallpaper.nix>
18
-
<stockholm/lass/2configs/consul.nix>
19
-
<stockholm/lass/2configs/snapclient.nix>
5
+
../../.
6
+
../../2configs/mouse.nix
7
+
../../2configs/retiolum.nix
8
+
../../2configs/baseX.nix
9
+
../../2configs/pipewire.nix
10
+
../../2configs/exim-retiolum.nix
11
+
../../2configs/browsers.nix
12
+
../../2configs/programs.nix
13
+
../../2configs/wine.nix
14
+
../../2configs/bitcoin.nix
15
+
../../2configs/yellow-mounts/samba.nix
16
+
../../2configs/fetchWallpaper.nix
17
+
../../2configs/consul.nix
18
+
../../2configs/snapclient.nix
20
19
];
21
20
22
21
krebs.build.host = config.krebs.hosts.shodan;
+2
-1
nixos/machines/shodan/physical.nix
+2
-1
nixos/machines/shodan/physical.nix
+2
-2
nixos/machines/styx/config.nix
+2
-2
nixos/machines/styx/config.nix
···
1
-
{ config, pkgs, ... }:
1
+
{ config, lib, pkgs, ... }:
2
2
3
3
{
4
4
imports = [
···
30
30
networking.firewall.interfaces.int0.allowedTCPPorts = [ config.services.smokeping.port ];
31
31
networking.firewall.interfaces.retiolum.allowedTCPPorts = [ config.services.smokeping.port ];
32
32
networking.firewall.interfaces.wiregrill.allowedTCPPorts = [ config.services.smokeping.port ];
33
-
krebs.power-action.enable = mkForce false;
33
+
krebs.power-action.enable = lib.mkForce false;
34
34
35
35
environment.systemPackages = with pkgs; [
36
36
wol
+2
-2
nixos/machines/styx/physical.nix
+2
-2
nixos/machines/styx/physical.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ nixosModules, config, lib, pkgs, ... }:
2
2
3
3
{
4
4
imports = [
5
5
./config.nix
6
-
<nixpkgs/nixos/modules/installer/scan/not-detected.nix>
6
+
(nixosModules + "installer/scan/not-detected.nix")
7
7
];
8
8
9
9
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
+6
-4
nixos/machines/ubik/config.nix
+6
-4
nixos/machines/ubik/config.nix
···
1
-
{ config, lib, pkgs, ... }:
1
+
{ self, config, pkgs, ... }:
2
2
{
3
3
imports = [
4
-
<stockholm/lass>
5
-
<stockholm/lass/2configs>
6
-
<stockholm/lass/2configs/retiolum.nix>
4
+
../../.
5
+
../../2configs
6
+
../../2configs/retiolum.nix
7
+
8
+
self.inputs.stockholm.nixosModules.exim-smarthost
7
9
];
8
10
9
11
krebs.build.host = config.krebs.hosts.ubik;
-286
nixos/machines/wizard/config.nix
-286
nixos/machines/wizard/config.nix
···
1
-
{ config, lib, pkgs, ... }:
2
-
3
-
let
4
-
5
-
icon = pkgs.writeText "icon" ''
6
-
//
7
-
//
8
-
_ //
9
-
.' . // '.
10
-
'_ '_\/_' `_
11
-
. . \\ . .
12
-
.==. ` \\' .'
13
-
.\| //bd\\ \,
14
-
\_'`._\\__//_.'`.;
15
-
`.__ __,' \\
16
-
| | \\
17
-
| | `
18
-
| |
19
-
| |
20
-
|____|
21
-
l42 ==' '==
22
-
'';
23
-
24
-
messenger = pkgs.writeText "message" ''
25
-
.
26
-
| \/|
27
-
(\ _ ) )|/|
28
-
(/ _----. /.'.'
29
-
.-._________.. .' @ _\ .'
30
-
'.._______. '. / (_| .')
31
-
'._____. / '-/ | _.'
32
-
'.______ ( ) ) \
33
-
'..____ '._ ) )
34
-
.' __.--\ , , // ((
35
-
'.' mrf| \/ (_.'(
36
-
' \ .'
37
-
\ (
38
-
\ '.
39
-
\ \ '.)
40
-
'-'-'
41
-
'';
42
-
43
-
waiting = pkgs.writeText "waiting" ''
44
-
Z
45
-
Z
46
-
z
47
-
z
48
-
* '
49
-
/ \
50
-
/___\
51
-
( - - )
52
-
) L ( .--------------.
53
-
__()(-)()__ | \ |
54
-
.~~ )()()() ~. | . :
55
-
/ )()() ` | `-.__________)
56
-
| )() ~ | : :
57
-
| ) | : |
58
-
| _ | | [ ## :
59
-
\ ~~-. | , oo_______.'
60
-
`_ ( \) _____/~~~~ `--___
61
-
| ~`-) ) `-. `--- ( - a:f -
62
-
| '///` | `-.
63
-
| | | | `-.
64
-
| | | | `-.
65
-
| | |\ |
66
-
| | | \|
67
-
`-. | | |
68
-
`-| '
69
-
'';
70
-
71
-
wizard = pkgs.writers.writeDash "wizard" ''
72
-
cat ${icon}
73
-
74
-
echo -n '${''
75
-
welcome to the computer wizard
76
-
first we will check for internet connectivity
77
-
78
-
''}'
79
-
80
-
read -p '(press enter to continue...)' key
81
-
until ping -c1 8.8.8.8; do
82
-
${pkgs.nm-dmenu}/bin/nm-dmenu
83
-
done
84
-
85
-
mode=$(echo -n '${''
86
-
1. Help of the wizard
87
-
2. Install NixOS
88
-
3. I know what I need to do
89
-
''}' | ${pkgs.fzf}/bin/fzf --reverse)
90
-
case "$mode" in
91
-
1*)
92
-
echo 'mode_1' > /tmp/mode
93
-
clear
94
-
echo 'waiting for the messenger to reach the wizard'
95
-
cat ${messenger}
96
-
97
-
# get pubkeys
98
-
mkdir -p /root/.ssh/
99
-
touch /root/.ssh/authorized_keys
100
-
curl -Ss 'https://lassul.us/mors.pub' >> /root/.ssh/authorized_keys
101
-
curl -Ss 'https://lassul.us/blue.pub' >> /root/.ssh/authorized_keys
102
-
curl -Ss 'https://lassul.us/yubi.pub' >> /root/.ssh/authorized_keys
103
-
104
-
# write via irc
105
-
systemctl start hidden-ssh-announce.service
106
-
tmux new-session -s help ${pkgs.writers.writeDash "waiting" ''
107
-
cat ${waiting}
108
-
read -p 'waiting for the wizard to wake up' key
109
-
${pkgs.bashInteractive}/bin/bash
110
-
''}
111
-
;;
112
-
2*)
113
-
echo 'mode_2' > /tmp/mode
114
-
${pkgs.nixos-installer}/bin/nixos-installer
115
-
;;
116
-
3*)
117
-
echo 'mode_3' > /tmp/mode
118
-
;;
119
-
*)
120
-
echo 'no mode selected'
121
-
;;
122
-
esac
123
-
'';
124
-
125
-
in {
126
-
imports = [
127
-
<stockholm/krebs>
128
-
<stockholm/lass/3modules>
129
-
<stockholm/lass/2configs/vim.nix>
130
-
# <nixpkgs/nixos/modules/installer/cd-dvd/installation-cd-base.nix>
131
-
{
132
-
nixpkgs.config.packageOverrides = import <stockholm/lass/5pkgs> pkgs;
133
-
krebs.enable = true;
134
-
krebs.build.user = config.krebs.users.lass;
135
-
krebs.build.host = {};
136
-
}
137
-
# {
138
-
# systemd.services.wizard = {
139
-
# description = "Computer Wizard";
140
-
# wantedBy = [ "multi-user.target" ];
141
-
# serviceConfig = {
142
-
# ExecStart = pkgs.writers.writeDash "wizard" ''
143
-
# set -efu
144
-
# cat <<EOF
145
-
# welcome to the computer wizard
146
-
# you can choose between the following modes
147
-
# echo -n '1\n2\n3' | ${pkgs.fzf}/bin/fzf
148
-
# EOF
149
-
# '';
150
-
# StandardInput = "tty";
151
-
# StandardOutput = "tty";
152
-
# # TTYPath = "/dev/tty1";
153
-
# TTYPath = "/dev/ttyS0";
154
-
# TTYReset = true;
155
-
# TTYVTDisallocate = true;
156
-
# Restart = "always";
157
-
# };
158
-
# };
159
-
# }
160
-
];
161
-
162
-
networking.hostName = "wizard";
163
-
nixpkgs.config.allowUnfree = true;
164
-
165
-
# users.extraUsers = {
166
-
# root = {
167
-
# openssh.authorizedKeys.keys = [
168
-
# config.krebs.users.lass.pubkey
169
-
# config.krebs.users.lass-mors.pubkey
170
-
# ];
171
-
# };
172
-
# };
173
-
174
-
environment.systemPackages = with pkgs; [
175
-
#stockholm
176
-
git
177
-
gnumake
178
-
jq
179
-
parallel
180
-
proot
181
-
populate
182
-
183
-
#style
184
-
most
185
-
rxvt-unicode-unwrapped.terminfo
186
-
187
-
#monitoring tools
188
-
htop
189
-
iotop
190
-
191
-
#network
192
-
iptables
193
-
iftop
194
-
nm-dmenu
195
-
196
-
#stuff for dl
197
-
aria2
198
-
199
-
#neat utils
200
-
chntpw
201
-
hashPassword
202
-
krebspaste
203
-
pciutils
204
-
psmisc
205
-
tmux
206
-
usbutils
207
-
208
-
#unpack stuff
209
-
p7zip
210
-
unzip
211
-
unrar
212
-
213
-
#data recovery
214
-
ddrescue
215
-
ntfs3g
216
-
dosfstools
217
-
218
-
nixos-installer
219
-
];
220
-
221
-
environment.extraInit = ''
222
-
EDITOR=vim
223
-
'';
224
-
225
-
programs.bash = {
226
-
enableCompletion = true;
227
-
interactiveShellInit = ''
228
-
HISTCONTROL='erasedups:ignorespace'
229
-
HISTSIZE=65536
230
-
HISTFILESIZE=$HISTSIZE
231
-
232
-
shopt -s checkhash
233
-
shopt -s histappend histreedit histverify
234
-
shopt -s no_empty_cmd_completion
235
-
complete -d cd
236
-
'';
237
-
promptInit = ''
238
-
if test $UID = 0; then
239
-
PS1='\[\033[1;31m\]\w\[\033[0m\] '
240
-
PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
241
-
elif test $UID = 1337; then
242
-
PS1='\[\033[1;32m\]\w\[\033[0m\] '
243
-
PROMPT_COMMAND='echo -ne "\033]0;$$ $PWD\007"'
244
-
else
245
-
PS1='\[\033[1;33m\]\u@\w\[\033[0m\] '
246
-
PROMPT_COMMAND='echo -ne "\033]0;$$ $USER@$PWD\007"'
247
-
fi
248
-
if test -n "$SSH_CLIENT"; then
249
-
PS1='\[\033[35m\]\h'" $PS1"
250
-
PROMPT_COMMAND='echo -ne "\033]0;$$ $HOSTNAME $USER@$PWD\007"'
251
-
fi
252
-
if ! test -e /tmp/mode; then
253
-
${wizard}
254
-
fi
255
-
'';
256
-
};
257
-
258
-
services.openssh.enable = true;
259
-
systemd.services.sshd.wantedBy = mkForce [ "multi-user.target" ];
260
-
261
-
networking.firewall = {
262
-
enable = true;
263
-
allowedTCPPorts = [ 22 ];
264
-
};
265
-
networking.networkmanager.enable = true;
266
-
networking.wireless.enable = mkForce false;
267
-
268
-
krebs.hidden-ssh = {
269
-
enable = true;
270
-
channel = "##lassulus-wizard";
271
-
message = "lassulus: torify sshn root@";
272
-
};
273
-
systemd.services.hidden-ssh-announce.wantedBy = mkForce [];
274
-
services.getty.autologinUser = lib.mkForce "root";
275
-
276
-
nixpkgs.config.packageOverrides = super: {
277
-
dmenu = pkgs.writeDashBin "dmenu" ''
278
-
${pkgs.fzf}/bin/fzf \
279
-
--history=/dev/null \
280
-
--print-query \
281
-
--prompt=\"$PROMPT\"
282
-
'';
283
-
};
284
-
285
-
boot.tmpOnTmpfs = true;
286
-
}
-7
nixos/machines/wizard/generate-iso.sh
-7
nixos/machines/wizard/generate-iso.sh
-7
nixos/machines/wizard/run-vm.sh
-7
nixos/machines/wizard/run-vm.sh
-10
nixos/machines/wizard/test.nix
-10
nixos/machines/wizard/test.nix
+15
-16
nixos/machines/xerxes/config.nix
+15
-16
nixos/machines/xerxes/config.nix
···
2
2
3
3
{
4
4
imports = [
5
-
<stockholm/lass>
6
-
7
-
<stockholm/lass/2configs/retiolum.nix>
8
-
<stockholm/lass/2configs/exim-retiolum.nix>
9
-
<stockholm/lass/2configs/baseX.nix>
10
-
<stockholm/lass/2configs/pipewire.nix>
11
-
<stockholm/lass/2configs/browsers.nix>
12
-
<stockholm/lass/2configs/programs.nix>
13
-
<stockholm/lass/2configs/network-manager.nix>
14
-
<stockholm/lass/2configs/syncthing.nix>
15
-
<stockholm/lass/2configs/sync/sync.nix>
16
-
<stockholm/lass/2configs/steam.nix>
17
-
<stockholm/lass/2configs/wine.nix>
18
-
<stockholm/lass/2configs/fetchWallpaper.nix>
19
-
<stockholm/lass/2configs/pass.nix>
20
-
<stockholm/lass/2configs/mail.nix>
5
+
../../.
6
+
../../2configs/retiolum.nix
7
+
../../2configs/exim-retiolum.nix
8
+
../../2configs/baseX.nix
9
+
../../2configs/pipewire.nix
10
+
../../2configs/browsers.nix
11
+
../../2configs/programs.nix
12
+
../../2configs/network-manager.nix
13
+
../../2configs/syncthing.nix
14
+
../../2configs/sync/sync.nix
15
+
../../2configs/steam.nix
16
+
../../2configs/wine.nix
17
+
../../2configs/fetchWallpaper.nix
18
+
../../2configs/pass.nix
19
+
../../2configs/mail.nix
21
20
];
22
21
23
22
krebs.build.host = config.krebs.hosts.xerxes;
+2
-2
nixos/machines/xerxes/physical.nix
+2
-2
nixos/machines/xerxes/physical.nix
+4
-4
nixos/machines/yellow/config.nix
+4
-4
nixos/machines/yellow/config.nix
···
3
3
torrentport = 56709; # port forwarded in airvpn webinterface
4
4
in {
5
5
imports = [
6
-
<stockholm/lass>
7
-
<stockholm/lass/2configs>
8
-
<stockholm/lass/2configs/retiolum.nix>
9
-
<stockholm/lass/2configs/services/flix>
6
+
../../.
7
+
../../2configs
8
+
../../2configs/retiolum.nix
9
+
../../2configs/services/flix
10
10
];
11
11
12
12
krebs.build.host = config.krebs.hosts.yellow;
-45
nixos/machines/yubi/config.nix
-45
nixos/machines/yubi/config.nix
···
1
-
{ config, lib, pkgs, ... }:
2
-
3
-
# cryptsetup luksOpen /dev/xxx mmc
4
-
# mkdir /mnt
5
-
# mount /dev/mapper/mmc /mnt
6
-
# rm -rf $GNUPGHOME
7
-
# cp -rv /mnt/gnupghome $GNUPGHOME
8
-
#
9
-
### change yubikey pin
10
-
# gpg --card-edit
11
-
# > admin
12
-
# > passwd
13
-
# > 1
14
-
# > > 123456
15
-
# > > $newpin
16
-
# > 3
17
-
# > > 12345678
18
-
# > > $newpuk
19
-
#
20
-
### transfer keys
21
-
# gpg --edit-key $keyid
22
-
#
23
-
# for x in 1 2 3
24
-
# > key $x
25
-
# > expire
26
-
# > 2y
27
-
# > keytocard
28
-
# > > $newpuk
29
-
# > key $x (to unselect)
30
-
31
-
{
32
-
services.pcscd.enable = true;
33
-
services.udev.packages = [ yubikey-personalization ];
34
-
35
-
environment.systemPackages = [ gnupg pinentry-curses pinentry-qt paperkey wget ];
36
-
37
-
programs = {
38
-
ssh.startAgent = false;
39
-
gnupg.agent = {
40
-
enable = true;
41
-
enableSSHSupport = true;
42
-
};
43
-
};
44
-
boot.tmpOnTmpfs = true;
45
-
}
-7
nixos/machines/yubi/generate-iso.sh
-7
nixos/machines/yubi/generate-iso.sh
-7
nixos/machines/yubi/run-vm.sh
-7
nixos/machines/yubi/run-vm.sh
-10
nixos/machines/yubi/test.nix
-10
nixos/machines/yubi/test.nix
+4
-1
nixos/2configs/services/radio/container-host.nix
+4
-1
nixos/2configs/services/radio/container-host.nix