remove unused configuration files · lass.pds.lassul.us/superconfig@a7de605

-143

2configs/AP.nix

··· 1 - { pkgs, ... }: 2 - let 3 - wifi = "wlp0s29u1u2"; 4 - in 5 - { 6 - boot.extraModulePackages = [ 7 - pkgs.linuxPackages.rtl8814au 8 - ]; 9 - networking.networkmanager.unmanaged = [ 10 - wifi 11 - "et0" 12 - ]; 13 - 14 - systemd.services.hostapd = { 15 - description = "hostapd wireless AP"; 16 - path = [ pkgs.hostapd ]; 17 - wantedBy = [ "network.target" ]; 18 - 19 - after = [ 20 - "${wifi}-cfg.service" 21 - "nat.service" 22 - "bind.service" 23 - "dhcpd.service" 24 - "sys-subsystem-net-devices-${wifi}.device" 25 - ]; 26 - 27 - serviceConfig = { 28 - ExecStart = "${pkgs.hostapd}/bin/hostapd ${pkgs.writeText "hostapd.conf" '' 29 - interface=${wifi} 30 - hw_mode=a 31 - channel=36 32 - ieee80211d=1 33 - country_code=DE 34 - ieee80211n=1 35 - ieee80211ac=1 36 - wmm_enabled=1 37 - 38 - # 5ghz 39 - ssid=krebsing 40 - auth_algs=1 41 - wpa=2 42 - wpa_key_mgmt=WPA-PSK 43 - rsn_pairwise=CCMP 44 - wpa_passphrase=aidsballz 45 - ''}"; 46 - Restart = "always"; 47 - }; 48 - }; 49 - 50 - networking.bridges.br0.interfaces = [ 51 - wifi 52 - "et0" 53 - ]; 54 - 55 - networking.interfaces.br0.ipv4.addresses = [ 56 - { 57 - address = "10.99.0.1"; 58 - prefixLength = 24; 59 - } 60 - ]; 61 - services.dhcpd4 = { 62 - enable = true; 63 - interfaces = [ "br0" ]; 64 - extraConfig = '' 65 - option subnet-mask 255.255.255.0; 66 - option routers 10.99.0.1; 67 - option domain-name-servers 1.1.1.1, 8.8.8.8; 68 - subnet 10.99.0.0 netmask 255.255.255.0 { 69 - range 10.99.0.100 10.99.0.200; 70 - } 71 - ''; 72 - }; 73 - 74 - boot.kernel.sysctl."net.ipv4.ip_forward" = 1; 75 - krebs.iptables.tables.filter.FORWARD.rules = [ 76 - { 77 - v6 = false; 78 - predicate = "-d 10.99.0.0/24 -o br0 -m conntrack --ctstate RELATED,ESTABLISHED"; 79 - target = "ACCEPT"; 80 - } 81 - { 82 - v6 = false; 83 - predicate = "-s 10.99.0.0/24 -i br0"; 84 - target = "ACCEPT"; 85 - } 86 - { 87 - v6 = false; 88 - predicate = "-i br0 -o br0"; 89 - target = "ACCEPT"; 90 - } 91 - { 92 - v6 = false; 93 - predicate = "-i br0 -o br0"; 94 - target = "ACCEPT"; 95 - } 96 - { 97 - v6 = false; 98 - predicate = "-o br0"; 99 - target = "REJECT --reject-with icmp-port-unreachable"; 100 - } 101 - { 102 - v6 = false; 103 - predicate = "-i br0"; 104 - target = "REJECT --reject-with icmp-port-unreachable"; 105 - } 106 - ]; 107 - krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [ 108 - { 109 - v6 = false; 110 - predicate = "-s 10.99.0.0/24"; 111 - target = "ACCEPT"; 112 - } 113 - ]; 114 - krebs.iptables.tables.nat.POSTROUTING.rules = [ 115 - #TODO find out what this is about? 116 - { 117 - v6 = false; 118 - predicate = "-s 10.99.0.0/24 -d 224.0.0.0/24"; 119 - target = "RETURN"; 120 - } 121 - { 122 - v6 = false; 123 - predicate = "-s 10.99.0.0/24 -d 255.255.255.255"; 124 - target = "RETURN"; 125 - } 126 - 127 - { 128 - v6 = false; 129 - predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24"; 130 - target = "MASQUERADE"; 131 - } 132 - { 133 - v6 = false; 134 - predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p tcp"; 135 - target = "MASQUERADE --to-ports 1024-65535"; 136 - } 137 - { 138 - v6 = false; 139 - predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p udp"; 140 - target = "MASQUERADE --to-ports 1024-65535"; 141 - } 142 - ]; 143 - }

-41

2configs/IM.nix

··· 1 - { pkgs, ... }: 2 - let 3 - weechat = pkgs.weechat.override { 4 - configure = 5 - { ... }: 6 - { 7 - scripts = with pkgs.weechatScripts; [ 8 - weechat-matrix 9 - ]; 10 - }; 11 - }; 12 - 13 - tmux = "/run/current-system/sw/bin/tmux"; 14 - 15 - in 16 - { 17 - imports = [ 18 - ./bitlbee.nix 19 - ]; 20 - environment.systemPackages = [ weechat ]; 21 - systemd.services.chat = { 22 - description = "chat environment setup"; 23 - environment.WEECHAT_HOME = "\$HOME/.weechat"; 24 - after = [ "network.target" ]; 25 - wantedBy = [ "multi-user.target" ]; 26 - 27 - restartIfChanged = false; 28 - 29 - path = [ 30 - pkgs.rxvt-unicode-unwrapped.terminfo 31 - ]; 32 - 33 - serviceConfig = { 34 - User = "lass"; 35 - RemainAfterExit = true; 36 - Type = "oneshot"; 37 - ExecStart = "${tmux} -2 new-session -d -s IM ${weechat}/bin/weechat"; 38 - ExecStop = "${tmux} kill-session -t IM"; # TODO run save in weechat 39 - }; 40 - }; 41 - }

-13

2configs/bird.nix

··· 1 - { config, ... }: 2 - 3 - { 4 - config.services.bird = { 5 - enable = true; 6 - config = '' 7 - router id 192.168.122.1; 8 - protocol device { 9 - scan time 10; 10 - } 11 - ''; 12 - }; 13 - }

-111

2configs/blue-host.nix

··· 1 - { 2 - config, 3 - lib, 4 - pkgs, 5 - ... 6 - }: 7 - { 8 - imports = [ 9 - <stockholm/lass/2configs/container-networking.nix> 10 - { 11 - #hack for already defined 12 - systemd.services."container@blue".reloadIfChanged = lib.mkForce false; 13 - systemd.services."container@blue".preStart = '' 14 - ${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue' 15 - ''; 16 - systemd.services."container@blue".preStop = '' 17 - /run/wrappers/bin/fusermount -u /var/lib/containers/blue 18 - ''; 19 - } 20 - ]; 21 - 22 - system.activationScripts.containerPermissions = '' 23 - mkdir -p /var/lib/containers 24 - chmod 711 /var/lib/containers 25 - ''; 26 - 27 - containers.blue = { 28 - config = 29 - { ... }: 30 - { 31 - environment.systemPackages = [ 32 - pkgs.git 33 - pkgs.rxvt-unicode-unwrapped.terminfo 34 - ]; 35 - services.openssh.enable = true; 36 - users.users.root.openssh.authorizedKeys.keys = [ 37 - config.krebs.users.lass.pubkey 38 - ]; 39 - }; 40 - autoStart = false; 41 - enableTun = true; 42 - privateNetwork = true; 43 - hostAddress = "10.233.2.9"; 44 - localAddress = "10.233.2.10"; 45 - }; 46 - 47 - #systemd.services = builtins.listToAttrs (map (host: 48 - # let 49 - # in nameValuePair "sync-blue-${host}" { 50 - # bindsTo = [ "container@blue.service" ]; 51 - # wantedBy = [ "container@blue.service" ]; 52 - # # ssh needed for rsync 53 - # path = [ pkgs.openssh ]; 54 - # serviceConfig = { 55 - # Restart = "always"; 56 - # RestartSec = 10; 57 - # ExecStart = pkgs.writeDash "sync-blue-${host}" '' 58 - # set -efu 59 - # #make sure blue is running 60 - # /run/wrappers/bin/ping -c1 blue.r > /dev/null 61 - 62 - # #make sure the container is unlocked 63 - # ${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue' 64 - 65 - # #make sure our target is reachable 66 - # ${pkgs.untilport}/bin/untilport ${host}.r 22 2>/dev/null 67 - 68 - # #start sync 69 - # ${pkgs.lsyncd}/bin/lsyncd -log scarce ${pkgs.writeText "lsyncd-config.lua" '' 70 - # settings { 71 - # nodaemon = true, 72 - # inotifyMode = "CloseWrite or Modify", 73 - # } 74 - # sync { 75 - # default.rsyncssh, 76 - # source = "/var/lib/containers/.blue", 77 - # host = "${host}.r", 78 - # targetdir = "/var/lib/containers/.blue", 79 - # rsync = { 80 - # archive = true, 81 - # owner = true, 82 - # group = true, 83 - # }; 84 - # ssh = { 85 - # binary = "${pkgs.openssh}/bin/ssh"; 86 - # identityFile = "/var/lib/containers/blue/home/lass/.ssh/id_rsa", 87 - # }, 88 - # } 89 - # ''} 90 - # ''; 91 - # }; 92 - # unitConfig.ConditionPathExists = "!/var/run/ppp0.pid"; 93 - # } 94 - #) remote_hosts); 95 - 96 - environment.systemPackages = [ 97 - (pkgs.writeDashBin "start-blue" '' 98 - set -ef 99 - if ! $(mount | ${pkgs.gnugrep}/bin/grep -qi '^encfs on /var/lib/containers/blue'); then 100 - ${pkgs.encfs}/bin/encfs --public /var/lib/containers/.blue /var/lib/containers/blue 101 - fi 102 - nixos-container start blue 103 - nixos-container run blue -- nixos-rebuild -I /var/src dry-build 104 - if ping -c1 blue.r >/dev/null; then 105 - echo 'blue is already running. bailing out' 106 - exit 23 107 - fi 108 - nixos-container run blue -- nixos-rebuild -I /var/src switch 109 - '') 110 - ]; 111 - }

-14

2configs/changedetection.nix

··· 1 - { config, ... }: 2 - { 3 - services.changedetection-io = { 4 - enable = true; 5 - behindProxy = true; 6 - port = 5055; 7 - }; 8 - 9 - services.nginx.virtualHosts."cdio.lassul.us" = { 10 - enableACME = true; 11 - forceSSL = true; 12 - locations."/".proxyPass = "http://localhost:${toString config.services.changedetection-io.port}"; 13 - }; 14 - }

-37

2configs/copyq.nix

··· 1 - { config, pkgs, ... }: 2 - let 3 - copyqConfig = pkgs.writeDash "copyq-config" '' 4 - ${pkgs.copyq}/bin/copyq config check_clipboard true 5 - ${pkgs.copyq}/bin/copyq config check_selection true 6 - ${pkgs.copyq}/bin/copyq config copy_clipboard true 7 - ${pkgs.copyq}/bin/copyq config copy_selection true 8 - 9 - ${pkgs.copyq}/bin/copyq config activate_closes true 10 - ${pkgs.copyq}/bin/copyq config clipboard_notification_lines 0 11 - ${pkgs.copyq}/bin/copyq config clipboard_tab \&clipboard 12 - ${pkgs.copyq}/bin/copyq config disable_tray true 13 - ${pkgs.copyq}/bin/copyq config hide_tabs true 14 - ${pkgs.copyq}/bin/copyq config hide_toolbar true 15 - ${pkgs.copyq}/bin/copyq config item_popup_interval true 16 - ${pkgs.copyq}/bin/copyq config maxitems 1000 17 - ${pkgs.copyq}/bin/copyq config move true 18 - ${pkgs.copyq}/bin/copyq config text_wrap true 19 - ''; 20 - in 21 - { 22 - systemd.user.services.copyq = { 23 - wantedBy = [ "graphical-session.target" ]; 24 - requires = [ "xmonad.service" ]; 25 - environment = { 26 - DISPLAY = ":${toString config.services.xserver.display}"; 27 - }; 28 - serviceConfig = { 29 - SyslogIdentifier = "copyq"; 30 - ExecStart = "${pkgs.copyq}/bin/copyq"; 31 - ExecStartPost = copyqConfig; 32 - Restart = "always"; 33 - RestartSec = "15s"; 34 - StartLimitBurst = 0; 35 - }; 36 - }; 37 - }

-78

2configs/cunicu.nix

··· 1 - { 2 - config, 3 - lib, 4 - pkgs, 5 - ... 6 - }: 7 - { 8 - environment.systemPackages = [ 9 - pkgs.cunicu 10 - ]; 11 - 12 - networking.firewall.allowedUDPPorts = [ 42230 ]; 13 - 14 - environment.etc."cunicu.yaml".text = builtins.toJSON { 15 - # backends = [ 16 - # "grpc://signal.cunicu.li:443" 17 - # ]; 18 - rpc.socket = "/var/run/cunicu.sock"; 19 - 20 - listen_port = 51820; 21 - 22 - sync_routes = true; 23 - sync_hosts = true; 24 - 25 - domain = "c"; 26 - 27 - discover_peers = true; 28 - discover_endpoints = true; 29 - community = "aidsballs"; 30 - 31 - networks = [ 32 - "10.245.0.0/16" 33 - ]; 34 - 35 - ice = { 36 - urls = [ 37 - "stun:stun3.l.google.com:19302" 38 - "stun:relay.webwormhole.io" 39 - "stun:stun.sipgate.net" 40 - "stun:stun.ekiga.net" 41 - "stun:stun.services.mozilla.com" 42 - ]; 43 - interface_filter = "w*|e*|v*|i*"; 44 - }; 45 - 46 - interfaces.wiregrill = { }; 47 - 48 - peers = lib.mapAttrs ( 49 - _: host: 50 - { 51 - public_key = host.nets.wiregrill.wireguard.pubkey; 52 - allowed_ips = 53 - with host.nets.wiregrill; 54 - [ 55 - "${ip6.addr}/128" 56 - ] 57 - ++ (lib.optional (ip4 != null) "${ip4.addr}/32"); 58 - } 59 - // lib.optionalAttrs (host.nets.wiregrill.via != null) { 60 - endpoint = host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}"; 61 - } 62 - ) (lib.filterAttrs (_: host: lib.hasAttr "wiregrill" host.nets) config.krebs.hosts); 63 - }; 64 - 65 - systemd.services.cunicu = { 66 - wantedBy = [ "multi-user.target" ]; 67 - restartTriggers = [ config.environment.etc."cunicu.yaml".source ]; 68 - environment = { 69 - CUNICU_CONFIG_ALLOW_INSECURE = "true"; 70 - CUNICU_EXPERIMENTAL = "true"; 71 - }; 72 - serviceConfig = { 73 - ExecStart = pkgs.writers.writeDash "cunicu" '' 74 - ${pkgs.cunicu}/bin/cunicu daemon 75 - ''; 76 - }; 77 - }; 78 - }

-48

2configs/doc.nix

··· 1 - let 2 - pkgs = import <nixpkgs> { }; 3 - 4 - mkNixosManual = 5 - let 6 - inherit pkgs; 7 - inherit (pkgs) lib; 8 - # Reduces the attrs from a package set so broken packages evaluate (I think?) 9 - scrubDerivations = 10 - namePrefix: pkgSet: 11 - lib.mapAttrs ( 12 - name: value: 13 - let 14 - wholeName = "${namePrefix}.${name}"; 15 - in 16 - if lib.isAttrs value then 17 - scrubDerivations wholeName value 18 - // (lib.optionalAttrs (lib.isDerivation value) { outPath = "\${${wholeName}}"; }) 19 - else 20 - value 21 - ) pkgSet; 22 - # An evluation of the specified system version with only the modules and no config 23 - scrubbedEval = lib.evalModules { 24 - modules = [ 25 - { 26 - #imports = [ ./default.nix ]; 27 - } 28 - ] ++ (import (pkgs.path + /nixos/modules/module-list.nix)); 29 - # Forward the filtered package set and the modules path 30 - specialArgs = { 31 - pkgs = scrubDerivations "pkgs" pkgs; 32 - modulesPath = pkgs.path + /nixos/modules; 33 - }; 34 - }; 35 - in 36 - (import (pkgs.path + /nixos/doc/manual)) rec { 37 - # From parent scope 38 - inherit (scrubbedEval) config; 39 - # From let 40 - inherit pkgs; 41 - version = scrubbedEval.config.system.nixos.release; 42 - revision = "release-${version}"; 43 - 44 - extraSources = [ ../. ]; 45 - options = scrubbedEval.options; 46 - }; 47 - in 48 - mkNixosManual

-6

2configs/docker.nix

··· 1 - { pkgs, ... }: 2 - { 3 - systemd.services.krebs-iptables.serviceConfig.ExecStartPost = pkgs.writeDash "kick_docker" '' 4 - ${pkgs.systemd}/bin/systemctl restart docker.service 5 - ''; 6 - }

-81

2configs/fysiirc.nix

··· 1 - { 2 - config, 3 - lib, 4 - pkgs, 5 - ... 6 - }: 7 - let 8 - 9 - format-github-message = pkgs.writeDashBin "format-github-message" '' 10 - set -efu 11 - export PATH=${ 12 - lib.makeBinPath [ 13 - pkgs.jq 14 - ] 15 - } 16 - INPUT=$(jq -c .) 17 - if $(printf '%s' "$INPUT" | jq 'has("issue") or has("pull_request")'); then 18 - ${write_to_irc} "$(printf '%s' "$INPUT" | jq -r ' 19 - "\(.action): " + 20 - "[\(.issue.title // .pull_request.title)] " + 21 - "\(.comment.html_url // .issue.html_url // .pull_request.html_url) " 22 - ')" 23 - fi 24 - ''; 25 - 26 - write_to_irc = pkgs.writeDash "write_to_irc" '' 27 - ${pkgs.curl}/bin/curl -fsSv http://localhost:44001 \ 28 - -H content-type:application/json \ 29 - -d "$(${pkgs.jq}/bin/jq -n \ 30 - --arg text "$1" '{ 31 - command:"PRIVMSG", 32 - params:["#fysi",$text] 33 - }' 34 - )" 35 - ''; 36 - 37 - in 38 - { 39 - krebs.iptables.tables.filter.INPUT.rules = [ 40 - { 41 - predicate = "-p tcp --dport 44002"; 42 - target = "ACCEPT"; 43 - } 44 - ]; 45 - krebs.reaktor2.fysiweb-github = { 46 - hostname = "irc.libera.chat"; 47 - port = "6697"; 48 - useTLS = true; 49 - nick = "fysiweb-github"; 50 - API.listen = "inet://127.0.0.1:44001"; 51 - plugins = [ 52 - { 53 - plugin = "register"; 54 - config = { 55 - channels = [ 56 - "#fysi" 57 - ]; 58 - }; 59 - } 60 - ]; 61 - }; 62 - krebs.htgen.fysiweb-github = { 63 - port = 44002; 64 - user = { 65 - name = "reaktor2-fysiweb-github"; 66 - }; 67 - script = ''. ${pkgs.writeDash "github-irc" '' 68 - set -xefu 69 - case "$Method $Request_URI" in 70 - "POST /") 71 - payload=$(head -c "$req_content_length") 72 - printf '%s' "$payload" | ${format-github-message}/bin/format-github-message 73 - printf 'HTTP/1.1 200 OK\r\n' 74 - printf 'Connection: close\r\n' 75 - printf '\r\n' 76 - exit 77 - ;; 78 - esac 79 - ''}''; 80 - }; 81 - }

-11

2configs/hardening.nix

··· 1 - { lib, ... }: 2 - with lib; 3 - { 4 - security.chromiumSuidSandbox.enable = true; 5 - security.lockKernelModules = false; 6 - boot.kernel.sysctl."user.max_user_namespaces" = 63414; 7 - 8 - imports = [ 9 - <nixpkgs/nixos/modules/profiles/hardened.nix> 10 - ]; 11 - }

-73

2configs/idc.nix

··· 1 - { 2 - config, 3 - pkgs, 4 - lib, 5 - ... 6 - }: 7 - let 8 - interdimensional-cable = 9 - let 10 - nimaid-github-io = pkgs.fetchFromGitHub { 11 - owner = "nimaid"; 12 - repo = "nimaid.github.io"; 13 - rev = "5c4f8dda1216d578ad7cd6b0052d5ebf3696ea12"; 14 - sha256 = "sha256-w0u72Q0CkxRu8lr/pp863POzAg09xssbot9pOhSsAn4="; 15 - }; 16 - in 17 - pkgs.writeShellScriptBin "interdimensional-cable" '' 18 - export PATH=${ 19 - lib.makeBinPath [ 20 - pkgs.mpv 21 - pkgs.jq 22 - pkgs.gnused 23 - ] 24 - } 25 - mpv --shuffle --playlist=<(jq -r '.videos[]' ${nimaid-github-io}/tv/interdimensional_database.json | sed 's#^#https://youtu.be/#') 26 - ''; 27 - in 28 - { 29 - systemd.services.reaktor2-idc.serviceConfig.DynamicUser = lib.mkForce false; 30 - systemd.services.reaktor2-idc.serviceConfig.Group = lib.mkForce "users"; 31 - 32 - environment.systemPackages = [ interdimensional-cable ]; 33 - 34 - krebs.reaktor2.idc = { 35 - hostname = "irc.r"; 36 - username = "lass"; 37 - port = "6667"; 38 - nick = "inter_dimensional_cable"; 39 - plugins = [ 40 - { 41 - plugin = "register"; 42 - config = { 43 - channels = [ 44 - # "#xxx" 45 - "#noise" 46 - ]; 47 - }; 48 - } 49 - { 50 - plugin = "system"; 51 - config = { 52 - hooks.PRIVMSG = [ 53 - { 54 - activate = "match"; 55 - pattern = ''^!([^ ]+)(?:\s*(.*))?''; 56 - command = 1; 57 - arguments = [ 2 ]; 58 - commands = { 59 - next.filename = pkgs.writeDash "next" '' 60 - DISPLAY=:0 ${pkgs.xdotool}/bin/xdotool key "enter" 61 - ''; 62 - mute.filename = pkgs.writeDash "mute" '' 63 - TMUX_TMPDIR=/tmp ${pkgs.tmux}/bin/tmux send-keys -t radio m 64 - DISPLAY=:0 ${pkgs.xdotool}/bin/xdotool key "m" 65 - ''; 66 - }; 67 - } 68 - ]; 69 - }; 70 - } 71 - ]; 72 - }; 73 - }

-12

2configs/livestream.nix

··· 1 - { pkgs, ... }: 2 - 3 - let 4 - 5 - stream = pkgs.writeDashBin "stream" '' 6 - ${pkgs.python27Packages.livestreamer}/bin/livestreamer --http-header Client-ID=jzkbprff40iqj646a697cyrvl0zt2m6 -p mpv "$@" 7 - ''; 8 - 9 - in 10 - { 11 - environment.systemPackages = [ stream ]; 12 - }

-16

2configs/minetest.nix

··· 1 - { ... }: 2 - { 3 - services.minetest-server = { 4 - enable = true; 5 - }; 6 - krebs.iptables.tables.filter.INPUT.rules = [ 7 - { 8 - predicate = "-p tcp --dport 30000"; 9 - target = "ACCEPT"; 10 - } 11 - { 12 - predicate = "-p udp --dport 30000"; 13 - target = "ACCEPT"; 14 - } 15 - ]; 16 - }

-41

2configs/muchsync.nix

··· 1 - { config, pkgs, ... }: 2 - 3 - { 4 - systemd.services.muchsync = 5 - let 6 - hosts = [ 7 - "coaxmetal.r" 8 - "mors.r" 9 - "green.r" 10 - ]; 11 - in 12 - { 13 - description = "sync mails"; 14 - environment = { 15 - NOTMUCH_CONFIG = config.environment.variables.NOTMUCH_CONFIG; 16 - }; 17 - after = [ "network.target" ]; 18 - 19 - restartIfChanged = false; 20 - 21 - path = [ 22 - pkgs.notmuch 23 - pkgs.openssh 24 - ]; 25 - 26 - startAt = "*:*"; # run every minute 27 - serviceConfig = { 28 - User = "lass"; 29 - Type = "oneshot"; 30 - ExecStart = pkgs.writeDash "sync-mails" '' 31 - set -euf 32 - 33 - /run/current-system/sw/bin/nm-tag-init 2>/dev/null 34 - ${concatMapStringsSep "\n" (host: '' 35 - echo syncing ${host}: 36 - ${pkgs.muchsync}/bin/muchsync -s 'ssh -CTaxq -o ConnectTimeout=4' --nonew lass@${host} || : 37 - '') hosts} 38 - ''; 39 - }; 40 - }; 41 - }

-18

2configs/otp-ssh.nix

··· 1 - { ... }: 2 - # Enables second factor for ssh password login 3 - 4 - ## Usage: 5 - # gen-oath-safe <username> totp 6 - ## scan the qrcode with google authenticator (or FreeOTP) 7 - ## copy last line into secrets/<host>/users.oath (chmod 700) 8 - { 9 - security.pam.oath = { 10 - # enabling it will make it a requisite of `all` services 11 - # enable = true; 12 - digits = 6; 13 - # TODO assert existing 14 - usersFile = "${config.krebs.secret.directory}/users.oath"; 15 - }; 16 - # I want TFA only active for sshd with password-auth 17 - security.pam.services.sshd.oathAuth = true; 18 - }

-53

2configs/prism-share.nix

···

-31

2configs/radicale.nix

··· 1 - { config, ... }: 2 - 3 - { 4 - services.radicale = { 5 - enable = true; 6 - config = '' 7 - [server] 8 - hosts = 0.0.0.0:5555 9 - [auth] 10 - type = htpasswd 11 - htpasswd_filename = ${config.krebs.secret.directory}/radicale.htpasswd 12 - htpasswd_encryption = plain 13 - ''; 14 - }; 15 - krebs.iptables.tables.filter.INPUT.rules = [ 16 - { 17 - predicate = "-i retiolum -p tcp --dport 5555"; 18 - target = "ACCEPT"; 19 - } 20 - { 21 - predicate = "-i wiregrill -p tcp --dport 5555"; 22 - target = "ACCEPT"; 23 - } 24 - ]; 25 - #services.nginx.virtualHosts."lassul.us".locations."/radicale/".extraConfig = '' 26 - # proxy_pass http://localhost:5555/; # The / is important! 27 - # proxy_set_header X-Script-Name /radicale; 28 - # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 29 - # proxy_pass_header Authorization; 30 - #''; 31 - }

-17

2configs/rebuild-on-boot.nix

··· 1 - { pkgs, ... }: 2 - { 3 - systemd.services.rebuild-on-boot = { 4 - wantedBy = [ "multi-user.target" ]; 5 - environment = { 6 - NIX_REMOTE = "daemon"; 7 - HOME = "/var/empty"; 8 - }; 9 - serviceConfig = { 10 - ExecStart = pkgs.writeScript "rebuild" '' 11 - #!${pkgs.bash}/bin/bash 12 - (/run/current-system/sw/bin/nixos-rebuild -I /var/src switch) & 13 - ''; 14 - ExecStop = "${pkgs.coreutils}/bin/sleep 10"; 15 - }; 16 - }; 17 - }

-8

2configs/redis.nix

··· 1 - { config, ... }: 2 - 3 - { 4 - config.services.redis = { 5 - enable = true; 6 - bind = "127.0.0.1"; 7 - }; 8 - }

-25

2configs/searx.nix

··· 1 - { pkgs, ... }: 2 - let 3 - port = 8889; 4 - in 5 - { 6 - services.nginx.virtualHosts.search = { 7 - serverAliases = [ "search.r" ]; 8 - locations."/".extraConfig = '' 9 - proxy_set_header Host $host; 10 - proxy_pass http://127.0.0.1:${builtins.toString port}; 11 - ''; 12 - }; 13 - 14 - services.searx = { 15 - enable = true; 16 - configFile = pkgs.writeText "searx.cfg" ( 17 - builtins.toJSON { 18 - use_default_settings = true; 19 - server = { 20 - port = port; 21 - }; 22 - } 23 - ); 24 - }; 25 - }

-17

2configs/smartd.nix

··· 1 - { config, ... }: 2 - 3 - { 4 - services.smartd = { 5 - enable = true; 6 - devices = [ 7 - { 8 - device = "DEVICESCAN"; 9 - options = toString [ 10 - "-a" 11 - "-m ${config.krebs.users.lass.mail}" 12 - "-s (O/../.././09|S/../.././04|L/../../6/05)" 13 - ]; 14 - } 15 - ]; 16 - }; 17 - }

-15

2configs/ssh-cryptsetup.nix

··· 1 - { config, ... }: 2 - { 3 - boot.initrd = { 4 - network = { 5 - enable = true; 6 - ssh = { 7 - enable = true; 8 - authorizedKeys = with config.krebs.users; [ 9 - config.krebs.users.lass.pubkey 10 - config.krebs.users.lass-blue.pubkey 11 - ]; 12 - }; 13 - }; 14 - }; 15 - }

-23

2configs/starcraft.nix

··· 1 - { config, pkgs, ... }: 2 - let 3 - mainUser = config.users.extraUsers.mainUser; 4 - in 5 - { 6 - users.users = { 7 - starcraft = { 8 - isNormalUser = true; 9 - extraGroups = [ 10 - "audio" 11 - "video" 12 - ]; 13 - packages = [ 14 - pkgs.wineWowPackages.minimal 15 - pkgs.winetricks 16 - pkgs.mpg123 17 - ]; 18 - }; 19 - }; 20 - security.sudo.extraConfig = '' 21 - ${mainUser.name} ALL=(starcraft) NOPASSWD: ALL 22 - ''; 23 - }

-20

2configs/terraria.nix

··· 1 - { ... }: 2 - { 3 - services.terraria = { 4 - enable = true; 5 - openFirewall = true; 6 - }; 7 - 8 - users.groups.terraria = { }; 9 - users.users.terraria.group = "terraria"; 10 - 11 - # mobile 12 - # nixpkgs.config.packageOverrides = pkgs: { 13 - # terraria-server = pkgs.terraria-server.overrideAttrs (_: { 14 - # src = pkgs.fetchurl { 15 - # url = "https://terraria.org/api/download/mobile-dedicated-server/Terraria-Mobile-Server-1.4.3.2.zip"; 16 - # sha256 = "sha256-Gl/pXylT6NPUY0SwhlPXtsRSkpVtJc5mWdxSYC4T30w="; 17 - # }; 18 - # }); 19 - # }; 20 - }

-15

2configs/testi-host.nix

··· 1 - { ... }: 2 - { 3 - imports = [ 4 - <stockholm/lass/2configs/container-networking.nix> 5 - <stockholm/lass/2configs/syncthing.nix> 6 - ]; 7 - krebs.sync-containers.containers.testi = { 8 - peers = [ 9 - "coaxmetal" 10 - ]; 11 - hostIp = "10.233.2.17"; 12 - localIp = "10.233.2.18"; 13 - format = "plain"; 14 - }; 15 - }

-14

2configs/texlive.nix

··· 1 - { pkgs, ... }: 2 - 3 - { 4 - environment.systemPackages = with pkgs; [ 5 - (texLiveAggregationFun { 6 - paths = [ 7 - texLive 8 - texLiveExtra 9 - texLiveCMSuper 10 - texLiveModerncv 11 - ]; 12 - }) 13 - ]; 14 - }

-52

2configs/tor-initrd.nix

··· 1 - { config, pkgs, ... }: 2 - ## unlock command: 3 - # (pass admin/$host/root;echo) | torify ssh root@$(pass hosts/$host/initrd/hostname) 'cat > /crypt-ramfs/passphrase' 4 - { 5 - boot.initrd.network.enable = true; 6 - boot.initrd.network.ssh = { 7 - enable = true; 8 - port = 22; 9 - authorizedKeys = [ 10 - config.krebs.users.lass.pubkey 11 - config.krebs.users.lass-mors.pubkey 12 - config.krebs.users.lass-green.pubkey 13 - ]; 14 - hostKeys = [ "${config.krebs.secret.directory}/ssh.ed25519_key" ]; 15 - }; 16 - boot.initrd.availableKernelModules = [ "e1000e" ]; 17 - 18 - boot.initrd.secrets = { 19 - "/etc/tor/onion/bootup" = "${config.krebs.secret.directory}/initrd"; 20 - }; 21 - 22 - boot.initrd.extraUtilsCommands = '' 23 - copy_bin_and_libs ${pkgs.tor}/bin/tor 24 - ''; 25 - 26 - # start tor during boot process 27 - boot.initrd.network.postCommands = 28 - let 29 - torRc = ( 30 - pkgs.writeText "tor.rc" '' 31 - DataDirectory /etc/tor 32 - SOCKSPort 127.0.0.1:9050 IsolateDestAddr 33 - SOCKSPort 127.0.0.1:9063 34 - HiddenServiceDir /etc/tor/onion/bootup 35 - HiddenServicePort 22 127.0.0.1:22 36 - '' 37 - ); 38 - in 39 - '' 40 - echo "tor: preparing onion folder" 41 - # have to do this otherwise tor does not want to start 42 - chmod -R 700 /etc/tor 43 - 44 - echo "make sure localhost is up" 45 - ip a a 127.0.0.1/8 dev lo 46 - ip link set lo up 47 - 48 - echo "tor: starting tor" 49 - tor -f ${torRc} --verify-config 50 - tor -f ${torRc} & 51 - ''; 52 - }

-207

2configs/tv.nix

··· 1 - { config, pkgs, ... }: 2 - let 3 - 4 - nginxCfg = pkgs.writeText "nginx.conf" '' 5 - daemon off; 6 - pid /var/lib/rtmp/nginx.pid; 7 - events { 8 - use epoll; 9 - worker_connections 128; 10 - } 11 - error_log stderr info; 12 - 13 - http { 14 - client_body_temp_path /var/lib/rtmp/nginx_cache_client_body; 15 - proxy_temp_path /var/lib/rtmp/nginx_cache_proxy; 16 - fastcgi_temp_path /var/lib/rtmp/nginx_cache_fastcgi; 17 - uwsgi_temp_path /var/lib/rtmp/nginx_cache_uwsgi; 18 - scgi_temp_path /var/lib/rtmp/nginx_cache_scgi; 19 - 20 - server { 21 - listen 8080; 22 - root /var/lib/rtmp; 23 - access_log stderr; 24 - error_log stderr; 25 - 26 - # This URL provides RTMP statistics in XML 27 - location /stat { 28 - rtmp_stat all; 29 - } 30 - } 31 - } 32 - 33 - rtmp { 34 - server { 35 - access_log stderr; 36 - listen 1935; 37 - ping 30s; 38 - notify_method get; 39 - 40 - application stream { 41 - live on; 42 - 43 - hls on; 44 - hls_path /var/lib/rtmp/tmp/hls; 45 - hls_fragment 1; 46 - hls_playlist_length 10; 47 - 48 - dash on; 49 - dash_path /var/lib/rtmp/tmp/dash; 50 - } 51 - } 52 - } 53 - ''; 54 - 55 - in 56 - { 57 - 58 - services.nginx = { 59 - enable = true; 60 - virtualHosts."streaming.lassul.us" = { 61 - enableACME = true; 62 - addSSL = true; 63 - locations."/hls".extraConfig = '' 64 - # Serve HLS fragments 65 - types { 66 - application/vnd.apple.mpegurl m3u8; 67 - video/mp2t ts; 68 - } 69 - root /var/lib/rtmp/tmp; 70 - 71 - # Allow CORS preflight requests 72 - if ($request_method = 'OPTIONS') { 73 - add_header 'Access-Control-Allow-Origin' '*'; 74 - add_header 'Access-Control-Max-Age' 1728000; 75 - add_header 'Content-Type' 'text/plain charset=UTF-8'; 76 - add_header 'Content-Length' 0; 77 - return 204; 78 - } 79 - 80 - if ($request_method != 'OPTIONS') { 81 - add_header Cache-Control no-cache; 82 - 83 - # CORS setup 84 - add_header 'Access-Control-Allow-Origin' '*' always; 85 - add_header 'Access-Control-Expose-Headers' 'Content-Length'; 86 - } 87 - ''; 88 - locations."/dash".extraConfig = '' 89 - # Serve DASH fragments 90 - types { 91 - application/dash+xml mpd; 92 - video/mp4 mp4; 93 - } 94 - root /var/lib/rtmp/tmp; 95 - 96 - # Allow CORS preflight requests 97 - if ($request_method = 'OPTIONS') { 98 - add_header 'Access-Control-Allow-Origin' '*'; 99 - add_header 'Access-Control-Max-Age' 1728000; 100 - add_header 'Content-Type' 'text/plain charset=UTF-8'; 101 - add_header 'Content-Length' 0; 102 - return 204; 103 - } 104 - if ($request_method != 'OPTIONS') { 105 - add_header Cache-Control no-cache; 106 - 107 - # CORS setup 108 - add_header 'Access-Control-Allow-Origin' '*' always; 109 - add_header 'Access-Control-Expose-Headers' 'Content-Length'; 110 - } 111 - ''; 112 - locations."= /dash.all.min.js".extraConfig = '' 113 - default_type "text/javascript"; 114 - alias ${ 115 - pkgs.fetchurl { 116 - url = "http://cdn.dashjs.org/v3.2.0/dash.all.min.js"; 117 - sha256 = "16f0b40gdqsnwqi01s5sz9f1q86dwzscgc3m701jd1sczygi481c"; 118 - } 119 - }; 120 - ''; 121 - locations."= /player".extraConfig = '' 122 - default_type "text/html"; 123 - alias ${pkgs.writeText "player.html" '' 124 - <!DOCTYPE html> 125 - <html lang="en"> 126 - <head> 127 - <meta charset="utf-8"> 128 - <title>lassulus livestream</title> 129 - </head> 130 - <body> 131 - <div> 132 - <video id="player" controls></video> 133 - </video> 134 - </div> 135 - <script src="/dash.all.min.js"></script> 136 - <script> 137 - (function(){ 138 - var url = "/dash/nixos.mpd"; 139 - var player = dashjs.MediaPlayer().create(); 140 - player.initialize(document.querySelector("#player"), url, true); 141 - })(); 142 - </script> 143 - </body> 144 - </html> 145 - ''}; 146 - ''; 147 - locations."/records".extraConfig = '' 148 - autoindex on; 149 - root /var/lib/rtmp; 150 - ''; 151 - }; 152 - }; 153 - 154 - fileSystems."/var/lib/rtmp/tmp" = { 155 - device = "tmpfs"; 156 - fsType = "tmpfs"; 157 - options = [ 158 - "nosuid" 159 - "nodev" 160 - "noatime" 161 - ]; 162 - }; 163 - 164 - users.users.rtmp = { 165 - home = "/var/lib/rtmp"; 166 - uid = genid_uint31 "rtmp"; 167 - isNormalUser = true; 168 - createHome = true; 169 - openssh.authorizedKeys.keys = with config.krebs.users; [ 170 - mic92.pubkey 171 - palo.pubkey 172 - ]; 173 - }; 174 - 175 - systemd.services.nginx-rtmp = { 176 - wantedBy = [ "multi-user.target" ]; 177 - after = [ "network.target" ]; 178 - restartIfChanged = true; 179 - script = '' 180 - ${ 181 - pkgs.nginx.override { 182 - modules = [ 183 - pkgs.nginxModules.rtmp 184 - ]; 185 - } 186 - }/bin/nginx -c ${nginxCfg} -p /var/lib/rtmp 187 - ''; 188 - serviceConfig = { 189 - ExecStartPre = pkgs.writers.writeDash "setup-rtmp" '' 190 - mkdir -p /var/lib/rtmp/tmp/hls 191 - mkdir -p /var/lib/rtmp/tmp/dash 192 - chown rtmp:users /var/lib/rtmp/tmp/hls 193 - chown rtmp:users /var/lib/rtmp/tmp/dash 194 - chmod 755 /var/lib/rtmp/tmp/hls 195 - chmod 755 /var/lib/rtmp/tmp/dash 196 - ''; 197 - User = "rtmp"; 198 - }; 199 - }; 200 - 201 - krebs.iptables.tables.filter.INPUT.rules = [ 202 - { 203 - predicate = "-p tcp --dport 1935"; 204 - target = "ACCEPT"; 205 - } 206 - ]; 207 - }

-29

2configs/virtualbox.nix

··· 1 - { config, ... }: 2 - 3 - let 4 - mainUser = config.users.extraUsers.mainUser; 5 - 6 - in 7 - { 8 - #services.virtualboxHost.enable = true; 9 - virtualisation.virtualbox.host.enable = true; 10 - virtualisation.virtualbox.host.enableHardening = false; 11 - 12 - users.extraUsers = { 13 - virtual = { 14 - name = "virtual"; 15 - description = "user for running VirtualBox"; 16 - home = "/home/virtual"; 17 - useDefaultShell = true; 18 - extraGroups = [ 19 - "vboxusers" 20 - "audio" 21 - "video" 22 - ]; 23 - createHome = true; 24 - }; 25 - }; 26 - security.sudo.extraConfig = '' 27 - ${mainUser.name} ALL=(virtual) NOPASSWD: ALL 28 - ''; 29 - }

-7

2configs/xonsh.nix

··· 1 - { pkgs, ... }: 2 - { 3 - environment.systemPackages = [ 4 - pkgs.xonsh 5 - pkgs.xonsh2 6 - ]; 7 - }

-8

2configs/boot/stock-x220.nix

··· 1 - { ... }: 2 - 3 - { 4 - boot = { 5 - loader.systemd-boot.enable = true; 6 - loader.efi.canTouchEfiVariables = true; 7 - }; 8 - }

-105

2configs/green-hosts/cryfs.nix

··· 1 - # seems to work, very slow though 2 - 3 - { config, pkgs, ... }: 4 - let 5 - 6 - cname = "green-cryfs"; 7 - 8 - in 9 - { 10 - imports = [ 11 - <stockholm/lass/2configs/container-networking.nix> 12 - <stockholm/lass/2configs/syncthing.nix> 13 - ]; 14 - 15 - programs.fuse.userAllowOther = true; 16 - 17 - services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/cryfs" = { 18 - devices = [ 19 - "icarus" 20 - "skynet" 21 - "littleT" 22 - "shodan" 23 - "mors" 24 - "morpheus" 25 - ]; 26 - ignorePerms = false; 27 - }; 28 - 29 - lass.bindfs."/var/lib/sync-containers/${cname}/cryfs" = { 30 - source = "/var/lib/sync-containers/${cname}/cryfs"; 31 - options = [ 32 - "-M ${toString config.users.users.syncthing.uid} -u root -g root" 33 - ]; 34 - }; 35 - 36 - systemd.services."container@${cname}".reloadIfChanged = mkForce false; 37 - containers.${cname} = { 38 - config = 39 - { ... }: 40 - { 41 - environment.systemPackages = [ 42 - pkgs.git 43 - pkgs.rxvt-unicode-unwrapped.terminfo 44 - ]; 45 - services.openssh.enable = true; 46 - users.users.root.openssh.authorizedKeys.keys = [ 47 - config.krebs.users.lass.pubkey 48 - ]; 49 - system.activationScripts.fuse = { 50 - text = '' 51 - ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229 52 - ''; 53 - deps = [ ]; 54 - }; 55 - }; 56 - allowedDevices = [ 57 - { 58 - modifier = "rwm"; 59 - node = "/dev/fuse"; 60 - } 61 - ]; 62 - autoStart = false; 63 - enableTun = true; 64 - privateNetwork = true; 65 - hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs 66 - localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs 67 - }; 68 - 69 - environment.systemPackages = [ 70 - (pkgs.writeDashBin "init-${cname}" '' 71 - set -euf 72 - set -x 73 - 74 - mkdir -p /var/lib/sync-containers/${cname}/cryfs 75 - '') 76 - (pkgs.writeDashBin "start-${cname}" '' 77 - set -euf 78 - set -x 79 - 80 - mkdir -p /var/lib/containers/${cname}/var/state 81 - 82 - STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname}) 83 - if [ "$STATE" = 'down' ]; then 84 - ${pkgs.nixos-container}/bin/nixos-container start ${cname} 85 - fi 86 - 87 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" '' 88 - set -x 89 - 90 - mkdir -p /var/state/var_src 91 - ln -sfTr /var/state/var_src /var/src 92 - touch /etc/NIXOS 93 - ''} 94 - 95 - if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then 96 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch 97 - fi 98 - '') 99 - (pkgs.writeDashBin "stop-${cname}" '' 100 - set -euf 101 - 102 - ${pkgs.nixos-container}/bin/nixos-container stop ${cname} 103 - '') 104 - ]; 105 - }

-108

2configs/green-hosts/ecryptfs.nix

··· 1 - { config, pkgs, ... }: 2 - let 3 - 4 - cname = "green"; 5 - 6 - in 7 - { 8 - imports = [ 9 - <stockholm/lass/2configs/container-networking.nix> 10 - <stockholm/lass/2configs/syncthing.nix> 11 - ]; 12 - 13 - programs.fuse.userAllowOther = true; 14 - 15 - services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/ecryptfs" = { 16 - devices = [ 17 - "icarus" 18 - "skynet" 19 - "littleT" 20 - "shodan" 21 - "mors" 22 - "morpheus" 23 - ]; 24 - ignorePerms = false; 25 - }; 26 - 27 - krebs.permown."/var/lib/sync-containers/${cname}/ecryptfs" = { 28 - file-mode = "u+rw"; 29 - directory-mode = "u+rwx"; 30 - owner = "syncthing"; 31 - keepGoing = false; 32 - }; 33 - 34 - systemd.services."container@${cname}".reloadIfChanged = mkForce false; 35 - containers.${cname} = { 36 - config = 37 - { ... }: 38 - { 39 - environment.systemPackages = [ 40 - pkgs.git 41 - pkgs.rxvt-unicode-unwrapped.terminfo 42 - ]; 43 - services.openssh.enable = true; 44 - users.users.root.openssh.authorizedKeys.keys = [ 45 - config.krebs.users.lass.pubkey 46 - ]; 47 - system.activationScripts.fuse = { 48 - text = '' 49 - ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229 50 - ''; 51 - deps = [ ]; 52 - }; 53 - }; 54 - allowedDevices = [ 55 - { 56 - modifier = "rwm"; 57 - node = "/dev/fuse"; 58 - } 59 - ]; 60 - autoStart = false; 61 - enableTun = true; 62 - privateNetwork = true; 63 - hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs 64 - localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs 65 - }; 66 - 67 - environment.systemPackages = [ 68 - pkgs.ecryptfs 69 - pkgs.keyutils 70 - (pkgs.writeDashBin "start-${cname}" '' 71 - set -euf 72 - set -x 73 - 74 - mkdir -p /var/lib/containers/${cname}/var/state 75 - 76 - if ! mount | grep -q '/var/lib/sync-containers/${cname}/ecryptfs on /var/lib/containers/${cname}/var/state type ecryptfs'; then 77 - if [ -e /var/lib/sync-containers/${cname}/ecryptfs/.cfg.json ]; then 78 - ${pkgs.ecrypt}/bin/ecrypt mount /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state 79 - else 80 - ${pkgs.ecrypt}/bin/ecrypt init /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state 81 - fi 82 - fi 83 - 84 - STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname}) 85 - if [ "$STATE" = 'down' ]; then 86 - ${pkgs.nixos-container}/bin/nixos-container start ${cname} 87 - fi 88 - 89 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" '' 90 - set -x 91 - 92 - mkdir -p /var/state/var_src 93 - ln -sfTr /var/state/var_src /var/src 94 - touch /etc/NIXOS 95 - ''} 96 - 97 - if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then 98 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch 99 - fi 100 - '') 101 - (pkgs.writeDashBin "stop-${cname}" '' 102 - set -euf 103 - 104 - ${pkgs.nixos-container}/bin/nixos-container stop ${cname} 105 - ${pkgs.ecrypt}/bin/ecrypt unmount /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state 106 - '') 107 - ]; 108 - }

-100

2configs/green-hosts/plain-bindfs.nix

··· 1 - # this seems to work, sadly there are no inotify events on the state directory because bindfs hides them, 2 - 3 - { config, pkgs, ... }: 4 - 5 - let 6 - 7 - cname = "green-plain"; 8 - 9 - in 10 - { 11 - imports = [ 12 - <stockholm/lass/2configs/container-networking.nix> 13 - <stockholm/lass/2configs/syncthing.nix> 14 - ]; 15 - 16 - programs.fuse.userAllowOther = true; 17 - 18 - services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = { 19 - devices = [ 20 - "icarus" 21 - "skynet" 22 - "littleT" 23 - "shodan" 24 - "mors" 25 - "morpheus" 26 - ]; 27 - ignorePerms = false; 28 - }; 29 - 30 - lass.bindfs."/var/lib/containers/${cname}/var/state" = { 31 - source = "/var/lib/containers/${cname}/var/state"; 32 - options = [ 33 - "-M ${toString config.users.users.syncthing.uid} -u root -g root" 34 - ]; 35 - }; 36 - 37 - systemd.services."container@${cname}".reloadIfChanged = mkForce false; 38 - containers.${cname} = { 39 - config = 40 - { ... }: 41 - { 42 - environment.systemPackages = [ 43 - pkgs.git 44 - pkgs.rxvt-unicode-unwrapped.terminfo 45 - ]; 46 - services.openssh.enable = true; 47 - users.users.root.openssh.authorizedKeys.keys = [ 48 - config.krebs.users.lass.pubkey 49 - ]; 50 - system.activationScripts.fuse = { 51 - text = '' 52 - ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229 53 - ''; 54 - deps = [ ]; 55 - }; 56 - }; 57 - allowedDevices = [ 58 - { 59 - modifier = "rwm"; 60 - node = "/dev/fuse"; 61 - } 62 - ]; 63 - autoStart = false; 64 - enableTun = true; 65 - privateNetwork = true; 66 - hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs 67 - localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs 68 - }; 69 - 70 - environment.systemPackages = [ 71 - (pkgs.writeDashBin "start-${cname}" '' 72 - set -euf 73 - set -x 74 - 75 - mkdir -p /var/lib/containers/${cname}/var/state 76 - 77 - STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname}) 78 - if [ "$STATE" = 'down' ]; then 79 - ${pkgs.nixos-container}/bin/nixos-container start ${cname} 80 - fi 81 - 82 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" '' 83 - set -x 84 - 85 - mkdir -p /var/state/var_src 86 - ln -sfTr /var/state/var_src /var/src 87 - touch /etc/NIXOS 88 - ''} 89 - 90 - if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then 91 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch 92 - fi 93 - '') 94 - (pkgs.writeDashBin "stop-${cname}" '' 95 - set -euf 96 - 97 - ${pkgs.nixos-container}/bin/nixos-container stop ${cname} 98 - '') 99 - ]; 100 - }

-98

2configs/green-hosts/plain-permown.nix

··· 1 - # this seems to work fine, downsides are, all state is owned by syncthing and could be read by the guests syncthing 2 - 3 - { config, pkgs, ... }: 4 - 5 - let 6 - 7 - cname = "green-plain"; 8 - 9 - in 10 - { 11 - imports = [ 12 - <stockholm/lass/2configs/container-networking.nix> 13 - <stockholm/lass/2configs/syncthing.nix> 14 - ]; 15 - 16 - services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = { 17 - devices = [ 18 - "icarus" 19 - "skynet" 20 - "littleT" 21 - "shodan" 22 - "mors" 23 - "morpheus" 24 - ]; 25 - ignorePerms = false; 26 - }; 27 - 28 - krebs.permown."/var/lib/containers/${cname}/var/state" = { 29 - file-mode = "u+rw"; 30 - directory-mode = "u+rwx"; 31 - owner = "syncthing"; 32 - keepGoing = true; 33 - }; 34 - 35 - systemd.services."container@${cname}".reloadIfChanged = mkForce false; 36 - containers.${cname} = { 37 - config = 38 - { ... }: 39 - { 40 - environment.systemPackages = [ 41 - pkgs.git 42 - pkgs.rxvt-unicode-unwrapped.terminfo 43 - ]; 44 - services.openssh.enable = true; 45 - users.users.root.openssh.authorizedKeys.keys = [ 46 - config.krebs.users.lass.pubkey 47 - ]; 48 - system.activationScripts.fuse = { 49 - text = '' 50 - ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229 51 - ''; 52 - deps = [ ]; 53 - }; 54 - }; 55 - allowedDevices = [ 56 - { 57 - modifier = "rwm"; 58 - node = "/dev/fuse"; 59 - } 60 - ]; 61 - autoStart = false; 62 - enableTun = true; 63 - privateNetwork = true; 64 - hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs 65 - localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs 66 - }; 67 - 68 - environment.systemPackages = [ 69 - (pkgs.writeDashBin "start-${cname}" '' 70 - set -euf 71 - set -x 72 - 73 - mkdir -p /var/lib/containers/${cname}/var/state 74 - 75 - STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname}) 76 - if [ "$STATE" = 'down' ]; then 77 - ${pkgs.nixos-container}/bin/nixos-container start ${cname} 78 - fi 79 - 80 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" '' 81 - set -x 82 - 83 - mkdir -p /var/state/var_src 84 - ln -sfTr /var/state/var_src /var/src 85 - touch /etc/NIXOS 86 - ''} 87 - 88 - if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then 89 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch 90 - fi 91 - '') 92 - (pkgs.writeDashBin "stop-${cname}" '' 93 - set -euf 94 - 95 - ${pkgs.nixos-container}/bin/nixos-container stop ${cname} 96 - '') 97 - ]; 98 - }

-97

2configs/green-hosts/plain.nix

··· 1 - { config, pkgs, ... }: 2 - let 3 - 4 - cname = "green-plain"; 5 - 6 - in 7 - { 8 - imports = [ 9 - <stockholm/lass/2configs/container-networking.nix> 10 - <stockholm/lass/2configs/syncthing.nix> 11 - ]; 12 - 13 - programs.fuse.userAllowOther = true; 14 - 15 - services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = { 16 - devices = [ 17 - "icarus" 18 - "skynet" 19 - "littleT" 20 - "shodan" 21 - "mors" 22 - "morpheus" 23 - ]; 24 - ignorePerms = false; 25 - }; 26 - 27 - krebs.permown."/var/lib/containers/${cname}/var/state" = { 28 - file-mode = "u+rw"; 29 - directory-mode = "u+rwx"; 30 - owner = "syncthing"; 31 - keepGoing = true; 32 - }; 33 - 34 - systemd.services."container@${cname}".reloadIfChanged = mkForce false; 35 - containers.${cname} = { 36 - config = 37 - { ... }: 38 - { 39 - environment.systemPackages = [ 40 - pkgs.git 41 - pkgs.rxvt-unicode-unwrapped.terminfo 42 - ]; 43 - services.openssh.enable = true; 44 - users.users.root.openssh.authorizedKeys.keys = [ 45 - config.krebs.users.lass.pubkey 46 - ]; 47 - system.activationScripts.fuse = { 48 - text = '' 49 - ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229 50 - ''; 51 - deps = [ ]; 52 - }; 53 - }; 54 - allowedDevices = [ 55 - { 56 - modifier = "rwm"; 57 - node = "/dev/fuse"; 58 - } 59 - ]; 60 - autoStart = false; 61 - enableTun = true; 62 - privateNetwork = true; 63 - hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs 64 - localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs 65 - }; 66 - 67 - environment.systemPackages = [ 68 - (pkgs.writeDashBin "start-${cname}" '' 69 - set -euf 70 - set -x 71 - 72 - mkdir -p /var/lib/containers/${cname}/var/state 73 - 74 - STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname}) 75 - if [ "$STATE" = 'down' ]; then 76 - ${pkgs.nixos-container}/bin/nixos-container start ${cname} 77 - fi 78 - 79 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" '' 80 - set -x 81 - 82 - mkdir -p /var/state/var_src 83 - ln -sfTr /var/state/var_src /var/src 84 - touch /etc/NIXOS 85 - ''} 86 - 87 - if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then 88 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch 89 - fi 90 - '') 91 - (pkgs.writeDashBin "stop-${cname}" '' 92 - set -euf 93 - 94 - ${pkgs.nixos-container}/bin/nixos-container stop ${cname} 95 - '') 96 - ]; 97 - }

-111

2configs/green-hosts/securefs.nix

··· 1 - # broken, muchsync cant sync into the folders which should be handles by bindfs 2 - # ls -la also does not show the full directory permissions 3 - { config, pkgs, ... }: 4 - let 5 - 6 - cname = "green"; 7 - 8 - in 9 - { 10 - imports = [ 11 - <stockholm/lass/2configs/container-networking.nix> 12 - <stockholm/lass/2configs/syncthing.nix> 13 - ]; 14 - 15 - programs.fuse.userAllowOther = true; 16 - 17 - services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/securefs" = { 18 - devices = [ 19 - "icarus" 20 - "skynet" 21 - "littleT" 22 - "shodan" 23 - "mors" 24 - "morpheus" 25 - ]; 26 - ignorePerms = false; 27 - }; 28 - 29 - krebs.permown."/var/lib/sync-containers/${cname}/securefs" = { 30 - file-mode = "u+rw"; 31 - directory-mode = "u+rwx"; 32 - owner = "syncthing"; 33 - keepGoing = false; 34 - }; 35 - 36 - systemd.services."container@${cname}".reloadIfChanged = mkForce false; 37 - containers.${cname} = { 38 - config = 39 - { ... }: 40 - { 41 - environment.systemPackages = [ 42 - pkgs.git 43 - pkgs.rxvt-unicode-unwrapped.terminfo 44 - ]; 45 - services.openssh.enable = true; 46 - users.users.root.openssh.authorizedKeys.keys = [ 47 - config.krebs.users.lass.pubkey 48 - ]; 49 - system.activationScripts.fuse = { 50 - text = '' 51 - ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229 52 - ''; 53 - deps = [ ]; 54 - }; 55 - }; 56 - allowedDevices = [ 57 - { 58 - modifier = "rwm"; 59 - node = "/dev/fuse"; 60 - } 61 - ]; 62 - autoStart = false; 63 - enableTun = true; 64 - privateNetwork = true; 65 - hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs 66 - localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs 67 - }; 68 - 69 - environment.systemPackages = [ 70 - (pkgs.writeDashBin "start-${cname}" '' 71 - set -euf 72 - set -x 73 - 74 - mkdir -p /var/lib/containers/${cname}/var/state 75 - 76 - if ! mount | grep -q 'securefs on /var/lib/containers/${cname}/var/state type fuse.securefs'; then 77 - if ! ${pkgs.securefs}/bin/securefs info /var/lib/sync-containers/${cname}/securefs; then 78 - ${pkgs.securefs}/bin/securefs create --format 4 /var/lib/sync-containers/${cname}/securefs 79 - fi 80 - 81 - ${pkgs.securefs}/bin/securefs mount -b \ 82 - -o allow_other -o default_permissions \ 83 - --log /var/lib/sync-containers/${cname}/securefs.log \ 84 - /var/lib/sync-containers/${cname}/securefs /var/lib/containers/${cname}/var/state 85 - fi 86 - 87 - STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname}) 88 - if [ "$STATE" = 'down' ]; then 89 - ${pkgs.nixos-container}/bin/nixos-container start ${cname} 90 - fi 91 - 92 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" '' 93 - set -x 94 - 95 - mkdir -p /var/state/var_src 96 - ln -sfTr /var/state/var_src /var/src 97 - touch /etc/NIXOS 98 - ''} 99 - 100 - if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then 101 - ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch 102 - fi 103 - '') 104 - (pkgs.writeDashBin "stop-${cname}" '' 105 - set -euf 106 - 107 - ${pkgs.nixos-container}/bin/nixos-container stop ${cname} 108 - umount /var/lib/containers/${cname}/var/state 109 - '') 110 - ]; 111 - }

-36

2configs/hw/gpd-pocket.nix

··· 1 - { pkgs, ... }: 2 - 3 - let 4 - dummy_firmware = pkgs.writeTextFile { 5 - name = "brcmfmac4356-pcie.txt"; 6 - text = builtins.readFile ./brcmfmac4356-pcie.txt; 7 - destination = "/lib/firmware/brcm/brcmfmac4356-pcie.txt"; 8 - }; 9 - in 10 - { 11 - #imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ]; 12 - hardware.firmware = [ dummy_firmware ]; 13 - hardware.enableRedistributableFirmware = true; 14 - 15 - boot.initrd.availableKernelModules = [ 16 - "xhci_pci" 17 - "usbhid" 18 - "usb_storage" 19 - "sd_mod" 20 - "sdhci_acpi" 21 - "sdhci_pci" 22 - ]; 23 - boot.kernelPackages = pkgs.linuxPackages_4_14; 24 - boot.kernelParams = [ 25 - "fbcon=rotate:1" 26 - ]; 27 - services.xserver.displayManager.sessionCommands = '' 28 - (sleep 2 && ${pkgs.xorg.xrandr}/bin/xrandr --output DSI1 --rotate right) 29 - (sleep 2 && ${pkgs.xorg.xinput}/bin/xinput set-prop 'Goodix Capacitive TouchScreen' 'Coordinate Transformation Matrix' 0 1 0 -1 0 1 0 0 1) 30 - ''; 31 - services.xserver.dpi = 200; 32 - fonts.fontconfig.dpi = 200; 33 - lass.fonts.regular = "xft:Hack-Regular:pixelsize=22,xft:Symbola"; 34 - lass.fonts.bold = "xft:Hack-Bold:pixelsize=22,xft:Symbola"; 35 - lass.fonts.italic = "xft:Hack-RegularOblique:pixelsize=22,xft:Symbol"; 36 - }

-47

2configs/os-templates/CAC-CentOS-6.5-64bit.nix

··· 1 - _: 2 - 3 - { 4 - boot.loader.grub = { 5 - device = "/dev/sda"; 6 - splashImage = null; 7 - }; 8 - 9 - boot.initrd.availableKernelModules = [ 10 - "ata_piix" 11 - "vmw_pvscsi" 12 - ]; 13 - 14 - fileSystems."/" = { 15 - device = "/dev/VolGroup/lv_root"; 16 - fsType = "ext4"; 17 - }; 18 - 19 - fileSystems."/boot" = { 20 - device = "/dev/sda1"; 21 - fsType = "ext4"; 22 - }; 23 - 24 - swapDevices = [ 25 - { device = "/dev/VolGroup/lv_swap"; } 26 - ]; 27 - 28 - users.extraGroups = { 29 - # ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories 30 - # Loaded: loaded (/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/example/systemd/system/systemd-tmpfiles-setup.service) 31 - # Active: failed (Result: exit-code) since Mon 2015-03-16 10:29:18 UTC; 4s ago 32 - # Docs: man:tmpfiles.d(5) 33 - # man:systemd-tmpfiles(8) 34 - # Process: 19272 ExecStart=/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev (code=exited, status=1/FAILURE) 35 - # Main PID: 19272 (code=exited, status=1/FAILURE) 36 - # 37 - # Mar 16 10:29:17 cd systemd-tmpfiles[19272]: [/usr/lib/tmpfiles.d/legacy.conf:26] Unknown group 'lock'. 38 - # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal configured, ignoring. 39 - # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal/7b35116927d74ea58785e00b47ac0f0d configured, ignoring. 40 - # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service: main process exited, code=exited, status=1/FAILURE 41 - # Mar 16 10:29:18 cd systemd[1]: Failed to start Create Volatile Files and Directories. 42 - # Mar 16 10:29:18 cd systemd[1]: Unit systemd-tmpfiles-setup.service entered failed state. 43 - # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service failed. 44 - # warning: error(s) occured while switching to the new configuration 45 - lock.gid = 10001; 46 - }; 47 - }

-47

2configs/os-templates/CAC-CentOS-7-64bit.nix

··· 1 - _: 2 - 3 - { 4 - boot.loader.grub = { 5 - device = "/dev/sda"; 6 - splashImage = null; 7 - }; 8 - 9 - boot.initrd.availableKernelModules = [ 10 - "ata_piix" 11 - "vmw_pvscsi" 12 - ]; 13 - 14 - fileSystems."/" = { 15 - device = "/dev/centos/root"; 16 - fsType = "xfs"; 17 - }; 18 - 19 - fileSystems."/boot" = { 20 - device = "/dev/sda1"; 21 - fsType = "xfs"; 22 - }; 23 - 24 - swapDevices = [ 25 - { device = "/dev/centos/swap"; } 26 - ]; 27 - 28 - users.extraGroups = { 29 - # ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories 30 - # Loaded: loaded (/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/example/systemd/system/systemd-tmpfiles-setup.service) 31 - # Active: failed (Result: exit-code) since Mon 2015-03-16 10:29:18 UTC; 4s ago 32 - # Docs: man:tmpfiles.d(5) 33 - # man:systemd-tmpfiles(8) 34 - # Process: 19272 ExecStart=/nix/store/2l33gg7nmncqkpysq9f5fxyhlw6ncm2j-systemd-217/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev (code=exited, status=1/FAILURE) 35 - # Main PID: 19272 (code=exited, status=1/FAILURE) 36 - # 37 - # Mar 16 10:29:17 cd systemd-tmpfiles[19272]: [/usr/lib/tmpfiles.d/legacy.conf:26] Unknown group 'lock'. 38 - # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal configured, ignoring. 39 - # Mar 16 10:29:18 cd systemd-tmpfiles[19272]: Two or more conflicting lines for /var/log/journal/7b35116927d74ea58785e00b47ac0f0d configured, ignoring. 40 - # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service: main process exited, code=exited, status=1/FAILURE 41 - # Mar 16 10:29:18 cd systemd[1]: Failed to start Create Volatile Files and Directories. 42 - # Mar 16 10:29:18 cd systemd[1]: Unit systemd-tmpfiles-setup.service entered failed state. 43 - # Mar 16 10:29:18 cd systemd[1]: systemd-tmpfiles-setup.service failed. 44 - # warning: error(s) occured while switching to the new configuration 45 - lock.gid = 10001; 46 - }; 47 - }

-33

2configs/ppp/x220-modem.nix

··· 1 - { pkgs, ... }: 2 - { 3 - 4 - # usage: pppd call x220 5 - 6 - environment.etc."ppp/peers/x220".text = '' 7 - /dev/ttyACM2 8 - 921600 9 - crtscts 10 - defaultroute 11 - holdoff 10 12 - lock 13 - maxfail 0 14 - noauth 15 - nodetach 16 - noipdefault 17 - passive 18 - persist 19 - usepeerdns 20 - connect "${pkgs.ppp}/bin/chat -f ${pkgs.writeText "default.chat" '' 21 - ABORT "BUSY" 22 - ABORT "NO CARRIER" 23 - REPORT CONNECT 24 - "" "ATDT*99#" 25 - CONNECT 26 - ''}" 27 - ''; 28 - 29 - environment.systemPackages = [ 30 - pkgs.ppp 31 - ]; 32 - 33 - }

-14

2configs/weron/signaler.nix

··· 1 - { pkgs, ... }: 2 - { 3 - systemd.services.weron-signaler = { 4 - wantedBy = [ "multi-user.target" ]; 5 - environment = 6 - { 7 - }; 8 - serviceConfig = { 9 - ExecStart = ''${pkgs.weron}/bin/weron signaler --verbose=7 --laddr ":23420"''; 10 - }; 11 - }; 12 - 13 - networking.firewall.allowedTCPPorts = [ 23420 ]; 14 - }

-1

2configs/tests/dummy-secrets/bepasty-secret.nix

··· 1 - "bla"

-4

2configs/tests/dummy-secrets/grafana_security.nix

··· 1 - { 2 - adminUser = "bla"; 3 - adminPassword = "blub"; 4 - }

-1

2configs/tests/dummy-secrets/hashedPasswords.nix

··· 1 - { }

-1

2configs/tests/dummy-secrets/iodinepw.nix

··· 1 - "derp"

-1

2configs/tests/dummy-secrets/mails.nix

··· 1 - [ ]

-1

2configs/tests/dummy-secrets/repos.nix

··· 1 - _: { }

Configure Feed

Configure Feed