summaryrefslogtreecommitdiffstats
path: root/tv/3modules
diff options
context:
space:
mode:
Diffstat (limited to 'tv/3modules')
-rw-r--r--tv/3modules/Xresources.nix38
-rw-r--r--tv/3modules/charybdis/config.nix519
-rw-r--r--tv/3modules/charybdis/default.nix81
l---------tv/3modules/charybdis/lib1
-rw-r--r--tv/3modules/default.nix8
-rw-r--r--tv/3modules/dnsmasq.nix58
-rw-r--r--tv/3modules/ejabberd/default.nix275
l---------tv/3modules/ejabberd/lib1
-rw-r--r--tv/3modules/focus.nix4
-rw-r--r--tv/3modules/hosts.nix9
-rw-r--r--tv/3modules/hw.nix16
-rw-r--r--tv/3modules/im.nix110
-rw-r--r--tv/3modules/iptables.nix208
l---------tv/3modules/lib1
-rw-r--r--tv/3modules/lidControl.nix45
-rw-r--r--tv/3modules/org.freedesktop.machine1.host-shell.nix29
-rw-r--r--tv/3modules/slock.nix78
-rw-r--r--tv/3modules/systemd.nix47
-rw-r--r--tv/3modules/unbound.nix84
-rw-r--r--tv/3modules/wwan.nix182
-rw-r--r--tv/3modules/x0vncserver.nix45
21 files changed, 0 insertions, 1839 deletions
diff --git a/tv/3modules/Xresources.nix b/tv/3modules/Xresources.nix
deleted file mode 100644
index 266531de9..000000000
--- a/tv/3modules/Xresources.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }: let
- cfg = {
- enable = config.services.xserver.enable && config.tv.Xresources != {};
- user = config.krebs.build.user;
- };
-in {
- options.tv.Xresources = mkOption {
- default = {};
- type = types.attrsOf types.str;
- };
- config = {
- nixpkgs.overlays = singleton (self: super: {
- tv = super.tv or {} // {
- Xresources =
- self.writeText "Xresources"
- (concatStrings (mapAttrsToList (name: value: /* xdefaults */ ''
- ${name}: ${value}
- '') config.tv.Xresources));
- };
- });
- systemd.services.${if cfg.enable then "Xresources" else null} = {
- wantedBy = [ "graphical.target" ];
- after = [ "xmonad.service" ];
- environment = {
- DISPLAY = ":${toString config.services.xserver.display}";
- };
- serviceConfig = {
- ExecStart = "${pkgs.xorg.xrdb}/bin/xrdb ${pkgs.tv.Xresources}";
- RemainAfterExit = true;
- SyslogIdentifier = "Xresources";
- Type = "oneshot";
- User = cfg.user.name;
- WorkingDirectory = cfg.user.home;
- };
- };
- };
-}
diff --git a/tv/3modules/charybdis/config.nix b/tv/3modules/charybdis/config.nix
deleted file mode 100644
index 4669345eb..000000000
--- a/tv/3modules/charybdis/config.nix
+++ /dev/null
@@ -1,519 +0,0 @@
-{ config, ... }: with import ./lib; let
- cfg = config.tv.charybdis;
-in toFile "charybdis.conf" ''
- /* doc/example.conf - brief example configuration file
- *
- * Copyright (C) 2000-2002 Hybrid Development Team
- * Copyright (C) 2002-2005 ircd-ratbox development team
- * Copyright (C) 2005-2006 charybdis development team
- *
- * $Id: example.conf 3582 2007-11-17 21:55:48Z jilles $
- *
- * See reference.conf for more information.
- */
-
- /* Extensions */
- #loadmodule "extensions/chm_operonly_compat.so";
- #loadmodule "extensions/chm_quietunreg_compat.so";
- #loadmodule "extensions/chm_sslonly_compat.so";
- #loadmodule "extensions/createauthonly.so";
- #loadmodule "extensions/extb_account.so";
- #loadmodule "extensions/extb_canjoin.so";
- #loadmodule "extensions/extb_channel.so";
- #loadmodule "extensions/extb_extgecos.so";
- #loadmodule "extensions/extb_oper.so";
- #loadmodule "extensions/extb_realname.so";
- #loadmodule "extensions/extb_server.so";
- #loadmodule "extensions/extb_ssl.so";
- #loadmodule "extensions/hurt.so";
- #loadmodule "extensions/m_findforwards.so";
- #loadmodule "extensions/m_identify.so";
- #loadmodule "extensions/no_oper_invis.so";
- #loadmodule "extensions/sno_farconnect.so";
- #loadmodule "extensions/sno_globalkline.so";
- #loadmodule "extensions/sno_globaloper.so";
- #loadmodule "extensions/sno_whois.so";
- loadmodule "extensions/override.so";
-
- /*
- * IP cloaking extensions: use ip_cloaking_4.0
- * if you're linking 3.2 and later, otherwise use
- * ip_cloaking.so, for compatibility with older 3.x
- * releases.
- */
-
- #loadmodule "extensions/ip_cloaking_4.0.so";
- #loadmodule "extensions/ip_cloaking.so";
-
- serverinfo {
- name = ${toJSON (head config.krebs.build.host.nets.retiolum.aliases)};
- sid = "4z3";
- description = "miep!";
- network_name = "irc.r";
- #network_desc = "Retiolum IRC Network";
- hub = yes;
-
- /* On multi-homed hosts you may need the following. These define
- * the addresses we connect from to other servers. */
- /* for IPv4 */
- vhost = ${toJSON config.krebs.build.host.nets.retiolum.ip4.addr};
- /* for IPv6 */
- vhost6 = ${toJSON config.krebs.build.host.nets.retiolum.ip6.addr};
-
- /* ssl_private_key: our ssl private key */
- ssl_private_key = "/tmp/credentials/ssl_private_key";
-
- /* ssl_cert: certificate for our ssl server */
- ssl_cert = ${toJSON cfg.ssl_cert};
-
- /* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */
- ssl_dh_params = "/tmp/credentials/ssl_dh_params";
-
- /* ssld_count: number of ssld processes you want to start, if you
- * have a really busy server, using N-1 where N is the number of
- * cpu/cpu cores you have might be useful. A number greater than one
- * can also be useful in case of bugs in ssld and because ssld needs
- * two file descriptors per SSL connection.
- */
- ssld_count = 1;
-
- /* default max clients: the default maximum number of clients
- * allowed to connect. This can be changed once ircd has started by
- * issuing:
- * /quote set maxclients <limit>
- */
- default_max_clients = 1024;
-
- /* nicklen: enforced nickname length (for this server only; must not
- * be longer than the maximum length set while building).
- */
- nicklen = 30;
- };
-
- admin {
- name = "tv";
- description = "peer";
- };
-
- log {
- fname_userlog = "/dev/stderr";
- fname_fuserlog = "/dev/stderr";
- fname_operlog = "/dev/stderr";
- fname_foperlog = "/dev/stderr";
- fname_serverlog = "/dev/stderr";
- fname_klinelog = "/dev/stderr";
- fname_killlog = "/dev/stderr";
- fname_operspylog = "/dev/stderr";
- fname_ioerrorlog = "/dev/stderr";
- };
-
- /* class {} blocks MUST be specified before anything that uses them. That
- * means they must be defined before auth {} and before connect {}.
- */
-
- class "krebs" {
- ping_time = 2 minutes;
- number_per_ident = 10;
- number_per_ip = 2048;
- number_per_ip_global = 4096;
- cidr_ipv4_bitlen = 24;
- cidr_ipv6_bitlen = 64;
- number_per_cidr = 65536;
- max_number = 3000;
- sendq = 1 megabyte;
- };
-
- class "users" {
- ping_time = 2 minutes;
- number_per_ident = 10;
- number_per_ip = 1024;
- number_per_ip_global = 4096;
- cidr_ipv4_bitlen = 24;
- cidr_ipv6_bitlen = 64;
- number_per_cidr = 65536;
- max_number = 3000;
- sendq = 400 kbytes;
- };
-
- class "opers" {
- ping_time = 5 minutes;
- number_per_ip = 10;
- max_number = 1000;
- sendq = 1 megabyte;
- };
-
- class "server" {
- ping_time = 5 minutes;
- connectfreq = 5 minutes;
- max_number = 1;
- sendq = 4 megabytes;
- };
-
- listen {
- /* defer_accept: wait for clients to send IRC handshake data before
- * accepting them. if you intend to use software which depends on the
- * server replying first, such as BOPM, you should disable this feature.
- * otherwise, you probably want to leave it on.
- */
- defer_accept = yes;
-
- /* If you want to listen on a specific IP only, specify host.
- * host definitions apply only to the following port line.
- */
- #host = ${toJSON config.krebs.build.host.nets.retiolum.ip4.addr};
- port = ${toString cfg.port};
- sslport = ${toString cfg.sslport};
- };
-
- /* auth {}: allow users to connect to the ircd (OLD I:)
- * auth {} blocks MUST be specified in order of precedence. The first one
- * that matches a user will be used. So place spoofs first, then specials,
- * then general access, then restricted.
- */
- auth {
- /* user: the user@host allowed to connect. Multiple IPv4/IPv6 user
- * lines are permitted per auth block. This is matched against the
- * hostname and IP address (using :: shortening for IPv6 and
- * prepending a 0 if it starts with a colon) and can also use CIDR
- * masks.
- */
- user = "*@10.243.0.0/16";
- user = "*@42::/16";
-
- /* password: an optional password that is required to use this block.
- * By default this is not encrypted, specify the flag "encrypted" in
- * flags = ...; below if it is.
- */
- #password = "letmein";
-
- /* spoof: fake the users user@host to be be this. You may either
- * specify a host or a user@host to spoof to. This is free-form,
- * just do everyone a favour and dont abuse it. (OLD I: = flag)
- */
- #spoof = "I.still.hate.packets";
-
- /* Possible flags in auth:
- *
- * encrypted | password is encrypted with mkpasswd
- * spoof_notice | give a notice when spoofing hosts
- * exceed_limit (old > flag) | allow user to exceed class user limits
- * kline_exempt (old ^ flag) | exempt this user from k/g/xlines&dnsbls
- * dnsbl_exempt | exempt this user from dnsbls
- * spambot_exempt | exempt this user from spambot checks
- * shide_exempt | exempt this user from serverhiding
- * jupe_exempt | exempt this user from generating
- * warnings joining juped channels
- * resv_exempt | exempt this user from resvs
- * flood_exempt | exempt this user from flood limits
- * USE WITH CAUTION.
- * no_tilde (old - flag) | don't prefix ~ to username if no ident
- * need_ident (old + flag) | require ident for user in this class
- * need_ssl | require SSL/TLS for user in this class
- * need_sasl | require SASL id for user in this class
- */
- flags = kline_exempt, exceed_limit, flood_exempt;
-
- /* class: the class the user is placed in */
- class = "krebs";
- };
-
- auth {
- user = "*@*";
- class = "users";
- };
-
- /* privset {} blocks MUST be specified before anything that uses them. That
- * means they must be defined before operator {}.
- */
- privset "local_op" {
- privs = oper:local_kill, oper:operwall;
- };
-
- privset "server_bot" {
- extends = "local_op";
- privs = oper:kline, oper:remoteban, snomask:nick_changes;
- };
-
- privset "global_op" {
- extends = "local_op";
- privs = oper:global_kill, oper:routing, oper:kline, oper:unkline, oper:xline,
- oper:resv, oper:mass_notice, oper:remoteban;
- };
-
- privset "admin" {
- extends = "global_op";
- privs = oper:admin, oper:die, oper:rehash, oper:spy, oper:override;
- };
-
- privset "aids" {
- privs = oper:override, oper:rehash;
- };
-
- operator "aids" {
- user = "*@10.243.*";
- privset = "aids";
- flags = ~encrypted;
- password = "balls";
- };
-
- operator "god" {
- /* name: the name of the oper must go above */
-
- /* user: the user@host required for this operator. CIDR *is*
- * supported now. auth{} spoofs work here, other spoofs do not.
- * multiple user="" lines are supported.
- */
- user = "*god@127.0.0.1";
-
- /* password: the password required to oper. Unless ~encrypted is
- * contained in flags = ...; this will need to be encrypted using
- * mkpasswd, MD5 is supported
- */
- password = "5";
-
- /* rsa key: the public key for this oper when using Challenge.
- * A password should not be defined when this is used, see
- * doc/challenge.txt for more information.
- */
- #rsa_public_key_file = "/usr/local/ircd/etc/oper.pub";
-
- /* umodes: the specific umodes this oper gets when they oper.
- * If this is specified an oper will not be given oper_umodes
- * These are described above oper_only_umodes in general {};
- */
- #umodes = locops, servnotice, operwall, wallop;
-
- /* fingerprint: if specified, the oper's client certificate
- * fingerprint will be checked against the specified fingerprint
- * below.
- */
- #fingerprint = "c77106576abf7f9f90cca0f63874a60f2e40a64b";
-
- /* snomask: specific server notice mask on oper up.
- * If this is specified an oper will not be given oper_snomask.
- */
- snomask = "+Zbfkrsuy";
-
- /* flags: misc options for the operator. You may prefix an option
- * with ~ to disable it, e.g. ~encrypted.
- *
- * Default flags are encrypted.
- *
- * Available options:
- *
- * encrypted: the password above is encrypted [DEFAULT]
- * need_ssl: must be using SSL/TLS to oper up
- */
- flags = encrypted;
-
- /* privset: privileges set to grant */
- privset = "admin";
- };
-
- service {
- name = "services.int";
- };
-
- cluster {
- name = "*";
- flags = kline, tkline, unkline, xline, txline, unxline, resv, tresv, unresv;
- };
-
- shared {
- oper = "*@*", "*";
- flags = all, rehash;
- };
-
- /* exempt {}: IPs that are exempt from Dlines and rejectcache. (OLD d:) */
- exempt {
- ip = "127.0.0.1";
- };
-
- channel {
- use_invex = yes;
- use_except = yes;
- use_forward = yes;
- use_knock = yes;
- knock_delay = 5 minutes;
- knock_delay_channel = 1 minute;
- max_chans_per_user = 15;
- max_bans = 100;
- max_bans_large = 500;
- default_split_user_count = 0;
- default_split_server_count = 0;
- no_create_on_split = no;
- no_join_on_split = no;
- burst_topicwho = yes;
- kick_on_split_riding = no;
- only_ascii_channels = no;
- resv_forcepart = yes;
- channel_target_change = yes;
- disable_local_channels = no;
- };
-
- serverhide {
- flatten_links = yes;
- links_delay = 5 minutes;
- hidden = no;
- disable_hidden = no;
- };
-
- /* These are the blacklist settings.
- * You can have multiple combinations of host and rejection reasons.
- * They are used in pairs of one host/rejection reason.
- *
- * These settings should be adequate for most networks, and are (presently)
- * required for use on StaticBox.
- *
- * Word to the wise: Do not use blacklists like SPEWS for blocking IRC
- * connections.
- *
- * As of charybdis 2.2, you can do some keyword substitution on the rejection
- * reason. The available keyword substitutions are:
- *
- * ''${ip} - the user's IP
- * ''${host} - the user's canonical hostname
- * ''${dnsbl-host} - the dnsbl hostname the lookup was done against
- * ''${nick} - the user's nickname
- * ''${network-name} - the name of the network
- *
- * As of charybdis 3.4, a type parameter is supported, which specifies the
- * address families the blacklist supports. IPv4 and IPv6 are supported.
- * IPv4 is currently the default as few blacklists support IPv6 operation
- * as of this writing.
- *
- * Note: AHBL (the providers of the below *.ahbl.org BLs) request that they be
- * contacted, via email, at admins@2mbit.com before using these BLs.
- * See <http://www.ahbl.org/services.php> for more information.
- */
- blacklist {
- host = "rbl.efnetrbl.org";
- type = ipv4;
- reject_reason = "''${nick}, your IP (''${ip}) is listed in EFnet's RBL. For assistance, see http://efnetrbl.org/?i=''${ip}";
-
- # host = "ircbl.ahbl.org";
- # type = ipv4;
- # reject_reason = "''${nick}, your IP (''${ip}) is listed in ''${dnsbl-host} for having an open proxy. In order to protect ''${network-name} from abuse, we are not allowing connections with open proxies to connect.";
- #
- # host = "tor.ahbl.org";
- # type = ipv4;
- # reject_reason = "''${nick}, your IP (''${ip}) is listed as a TOR exit node. In order to protect ''${network-name} from tor-based abuse, we are not allowing TOR exit nodes to connect to our network.";
- #
- /* Example of a blacklist that supports both IPv4 and IPv6 */
- # host = "foobl.blacklist.invalid";
- # type = ipv4, ipv6;
- # reject_reason = "''${nick}, your IP (''${ip}) is listed in ''${dnsbl-host} for some reason. In order to protect ''${network-name} from abuse, we are not allowing connections listed in ''${dnsbl-host} to connect";
- };
-
- alias "NickServ" {
- target = "NickServ";
- };
-
- alias "ChanServ" {
- target = "ChanServ";
- };
-
- alias "OperServ" {
- target = "OperServ";
- };
-
- alias "MemoServ" {
- target = "MemoServ";
- };
-
- alias "NS" {
- target = "NickServ";
- };
-
- alias "CS" {
- target = "ChanServ";
- };
-
- alias "OS" {
- target = "OperServ";
- };
-
- alias "MS" {
- target = "MemoServ";
- };
-
- general {
- hide_error_messages = opers;
- hide_spoof_ips = yes;
-
- /*
- * default_umodes: umodes to enable on connect.
- * If you have enabled the new ip_cloaking_4.0 module, and you want
- * to make use of it, add +x to this option, i.e.:
- * default_umodes = "+ix";
- *
- * If you have enabled the old ip_cloaking module, and you want
- * to make use of it, add +h to this option, i.e.:
- * default_umodes = "+ih";
- */
- default_umodes = "+i";
-
- default_operstring = "is an IRC Operator";
- default_adminstring = "is a Server Administrator";
- servicestring = "is a Network Service";
- disable_fake_channels = no;
- tkline_expire_notices = no;
- default_floodcount = 1000;
- failed_oper_notice = yes;
- dots_in_ident=2;
- min_nonwildcard = 4;
- min_nonwildcard_simple = 3;
- max_accept = 100;
- max_monitor = 100;
- anti_nick_flood = yes;
- max_nick_time = 20 seconds;
- max_nick_changes = 5;
- anti_spam_exit_message_time = 5 minutes;
- ts_warn_delta = 30 seconds;
- ts_max_delta = 5 minutes;
- client_exit = yes;
- collision_fnc = yes;
- resv_fnc = yes;
- global_snotices = yes;
- dline_with_reason = yes;
- kline_delay = 0 seconds;
- kline_with_reason = yes;
- kline_reason = "K-Lined";
- identify_service = "NickServ@services.int";
- identify_command = "IDENTIFY";
- non_redundant_klines = yes;
- warn_no_nline = yes;
- use_propagated_bans = yes;
- stats_e_disabled = no;
- stats_c_oper_only=no;
- stats_h_oper_only=no;
- client_flood_max_lines = 16000;
- client_flood_burst_rate = 32000;
- client_flood_burst_max = 32000;
- client_flood_message_num = 32000;
- client_flood_message_time = 32000;
- use_whois_actually = no;
- oper_only_umodes = operwall, locops, servnotice;
- oper_umodes = locops, servnotice, operwall, wallop;
- oper_snomask = "+s";
- burst_away = yes;
- nick_delay = 0 seconds; # 15 minutes if you want to enable this
- reject_ban_time = 1 minute;
- reject_after_count = 3;
- reject_duration = 5 minutes;
- throttle_duration = 1;
- throttle_count = 1000;
- max_ratelimit_tokens = 30;
- away_interval = 30;
- disable_auth = yes;
- };
-
- modules {
- path = "modules";
- path = "modules/autoload";
- };
-
- exempt {
- ip = "10.243.0.0/16";
- };
-''
diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix
deleted file mode 100644
index 1fdcea572..000000000
--- a/tv/3modules/charybdis/default.nix
+++ /dev/null
@@ -1,81 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }@args: let
- cfg = config.tv.charybdis;
-in {
- options.tv.charybdis = {
- enable = mkEnableOption "tv.charybdis";
- motd = mkOption {
- type = types.str;
- default = "/join #retiolum";
- };
- port = mkOption {
- type = types.int;
- default = 6667;
- };
- ssl_cert = mkOption {
- type = types.path;
- };
- ssl_dh_params = mkOption {
- type = types.absolute-pathname;
- default = "${config.krebs.secret.directory}/charybdis.dh.pem";
- };
- ssl_private_key = mkOption {
- type = types.absolute-pathname;
- default = "${config.krebs.secret.directory}/charybdis.key.pem";
- };
- sslport = mkOption {
- type = types.int;
- default = 6697;
- };
- user = mkOption {
- type = types.user;
- default = {
- name = "charybdis";
- home = "/var/lib/charybdis";
- };
- };
- };
- config = lib.mkIf cfg.enable {
-
- environment.etc."charybdis-ircd.motd".text = cfg.motd;
-
- krebs.systemd.services.charybdis = {};
-
- systemd.services.charybdis = {
- wantedBy = [ "multi-user.target" ];
- after = [ "network-online.target" ];
- environment = {
- BANDB_DBPATH = "${cfg.user.home}/ban.db";
- };
- serviceConfig = {
- SyslogIdentifier = "charybdis";
- User = cfg.user.name;
- PrivateTmp = true;
- Restart = "always";
- ExecStartPre = [
- "${pkgs.coreutils}/bin/ln -s /etc/charybdis-ircd.motd /tmp/ircd.motd"
- "${pkgs.coreutils}/bin/ln -s \${CREDENTIALS_DIRECTORY} /tmp/credentials"
- ];
- ExecStart = toString [
- "${pkgs.charybdis}/bin/charybdis"
- "-configfile ${import ./config.nix args}"
- "-foreground"
- "-logfile /dev/stderr"
- ];
- LoadCredential = [
- "ssl_dh_params:${cfg.ssl_dh_params}"
- "ssl_private_key:${cfg.ssl_private_key}"
- ];
- };
- };
-
- users.users.${cfg.user.name} = {
- inherit (cfg.user) home name uid;
- createHome = true;
- group = cfg.user.name;
- isSystemUser = true;
- };
-
- users.groups.${cfg.user.name} = {};
- };
-}
diff --git a/tv/3modules/charybdis/lib b/tv/3modules/charybdis/lib
deleted file mode 120000
index dc598c56d..000000000
--- a/tv/3modules/charybdis/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib \ No newline at end of file
diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
deleted file mode 100644
index 1a0971ec6..000000000
--- a/tv/3modules/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-with import ./lib;
-{
- imports =
- map
- (name: ./. + "/${name}")
- (attrNames
- (filterAttrs isNixDirEntry (readDir ./.)));
-}
diff --git a/tv/3modules/dnsmasq.nix b/tv/3modules/dnsmasq.nix
deleted file mode 100644
index e1dfdea34..000000000
--- a/tv/3modules/dnsmasq.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-with import ./lib;
-{ config, ... }: let
- cfg = config.tv.dnsmasq;
-in {
-
- options.tv.dnsmasq = {
- enable = mkEnableOption "tv.dnsmasq";
- dhcp-range = mkOption {
- type = types.str;
- };
- interface = mkOption {
- type = types.str;
- };
- address = mkOption {
- type = types.str;
- };
- prefixLength = mkOption {
- type = types.addCheck types.int (x: x >= 0 && x <= 32);
- };
- };
-
- config = mkIf cfg.enable (mkMerge [
- {
- networking.dhcpcd.denyInterfaces = [ cfg.interface ];
- services.dnsmasq.resolveLocalQueries = false;
- networking.interfaces.${cfg.interface} = {
- ipv4.addresses = singleton {
- address = cfg.address;
- prefixLength = cfg.prefixLength;
- };
- };
- services.dnsmasq.enable = true;
- services.dnsmasq.extraConfig = ''
- bind-interfaces
- dhcp-range=${cfg.dhcp-range}
- listen-address=${cfg.address}
- '';
- tv.iptables.extra.filter.INPUT = [
- "-i ${cfg.interface} -p tcp -m tcp --dport bootps -j ACCEPT"
- "-i ${cfg.interface} -p udp -m udp --dport bootps -j ACCEPT"
- "-i ${cfg.interface} -p tcp -m tcp --dport domain -j ACCEPT"
- "-i ${cfg.interface} -p udp -m udp --dport domain -j ACCEPT"
- ];
- }
- {
- # enable forwarding
- boot.kernel.sysctl."net.ipv4.ip_forward" = true;
- tv.iptables.extra.filter.FORWARD = [
- "-m state --state RELATED,ESTABLISHED -j ACCEPT"
- "-i ${cfg.interface} -j ACCEPT"
- ];
- tv.iptables.extra.nat.POSTROUTING = [
- "-j MASQUERADE"
- ];
- }
- ]);
-
-}
diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix
deleted file mode 100644
index 61fd8fdf1..000000000
--- a/tv/3modules/ejabberd/default.nix
+++ /dev/null
@@ -1,275 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }: let
- cfg = config.tv.ejabberd;
-
- gen-dhparam = pkgs.writeDash "gen-dhparam" ''
- set -efu
- path=$1
- bits=2048
- # TODO regenerate dhfile after some time?
- if ! test -e "$path"; then
- ${pkgs.openssl}/bin/openssl dhparam "$bits" > "$path"
- fi
- '';
-
- settingsFormat = pkgs.formats.json {};
-
-in {
- options.tv.ejabberd = {
- enable = mkEnableOption "tv.ejabberd";
- certfiles = mkOption {
- type = types.listOf types.absolute-pathname;
- default = [
- "${config.krebs.secret.directory}/ejabberd.pem"
- ];
- };
- configFile = mkOption {
- type = types.either types.package types.absolute-pathname;
- default = settingsFormat.generate "ejabberd.yaml" cfg.settings;
- };
- ciphers = mkOption {
- type = types.listOf types.str;
- default = [
- "ECDHE-ECDSA-AES256-GCM-SHA384"
- "ECDHE-RSA-AES256-GCM-SHA384"
- "ECDHE-ECDSA-CHACHA20-POLY1305"
- "ECDHE-RSA-CHACHA20-POLY1305"
- "ECDHE-ECDSA-AES128-GCM-SHA256"
- "ECDHE-RSA-AES128-GCM-SHA256"
- "ECDHE-ECDSA-AES256-SHA384"
- "ECDHE-RSA-AES256-SHA384"
- "ECDHE-ECDSA-AES128-SHA256"
- "ECDHE-RSA-AES128-SHA256"
- ];
- };
- credentials.certfiles = mkOption {
- internal = true;
- readOnly = true;
- default =
- imap
- (i: const "/tmp/credentials/certfile${toJSON i}")
- cfg.certfiles;
- };
- hosts = mkOption {
- type = with types; listOf str;
- };
- pkgs.ejabberd = mkOption {
- type = types.package;
- default = pkgs.symlinkJoin {
- name = "ejabberd-wrapper";
- paths = [
- (pkgs.writeDashBin "ejabberdctl" ''
- exec ${pkgs.ejabberd}/bin/ejabberdctl \
- --config /etc/ejabberd/ejabberd.yaml \
- --ctl-config /etc/ejabberd/ejabberdctl.cfg \
- --logs ${cfg.stateDir} \
- --spool ${cfg.stateDir} \
- "$@"
- '')
- pkgs.ejabberd
- ];
- };
- };
- protocol_options = mkOption {
- type = types.listOf types.str;
- default = [
- "no_sslv2"
- "no_sslv3"
- "no_tlsv1"
- "no_tlsv1_10"
- ];
- };
- registration_watchers = mkOption {
- type = types.listOf types.str;
- default = [
- config.krebs.users.tv.mail
- ];
- };
- settings = mkOption {
- type = settingsFormat.type;
- default = {};
- };
- stateDir = mkOption {
- type =
- types.addCheck
- types.absolute-pathname
- (path:
- hasPrefix "/var/lib/" path &&
- types.filename.check (removePrefix "/var/lib/" path)
- );
- default = "/var/lib/ejabberd";
- };
- };
- config = lib.mkIf cfg.enable {
-
- environment.etc."ejabberd/ejabberd.yaml".source = cfg.configFile;
- environment.etc."ejabberd/ejabberdctl.cfg".source =
- builtins.toFile "ejabberdctl.cfg" /* sh */ ''
- ERL_OPTIONS='-setcookie ${cfg.stateDir}/.erlang.cookie'
- '';
-
- environment.systemPackages = [
- (pkgs.symlinkJoin {
- name = "ejabberd-sudo-wrapper";
- paths = [
- (pkgs.writeDashBin "ejabberdctl" ''
- exec ${pkgs.systemd}/bin/systemd-run \
- --unit=ejabberdctl \
- --property=StateDirectory=ejabberd \
- --property=User=ejabberd \
- --collect \
- --pipe \
- --quiet \
- ${cfg.pkgs.ejabberd}/bin/ejabberdctl "$@"
- '')
- cfg.pkgs.ejabberd
- ];
- })
- ];
-
- krebs.systemd.services.ejabberd.restartIfCredentialsChange = true;
-
- systemd.services.ejabberd = {
- wantedBy = [ "multi-user.target" ];
- after = [ "network.target" ];
- reloadTriggers = [
- config.environment.etc."ejabberd/ejabberd.yaml".source
- config.environment.etc."ejabberd/ejabberdctl.cfg".source
- ];
- serviceConfig = {
- ExecStartPre = [
- "${pkgs.coreutils}/bin/ln -s \${CREDENTIALS_DIRECTORY} /tmp/credentials"
- "${gen-dhparam} ${cfg.stateDir}/dhfile"
- ];
- ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground";
- ExecStop = [
- "${cfg.pkgs.ejabberd}/bin/ejabberdctl stop"
- "${cfg.pkgs.ejabberd}/bin/ejabberdctl stopped"
- ];
- ExecReload = "${cfg.pkgs.ejabberd}/bin/ejabberdctl reload_config";
- LoadCredential =
- zipListsWith
- (dst: src: "${baseNameOf dst}:${src}")
- cfg.credentials.certfiles
- cfg.certfiles;
- LimitNOFILE = 65536;
- PrivateDevices = true;
- PrivateTmp = true;
- SyslogIdentifier = "ejabberd";
- StateDirectory = "ejabberd";
- User = "ejabberd";
- DynamicUser = true;
- TimeoutSec = 60;
- RestartSec = 5;
- Restart = "on-failure";
- Type = "notify";
- NotifyAccess = "all";
- WatchdogSec = 30;
- };
- };
-
- # preset config values
- tv.ejabberd.settings = {
- access_rules = {
- announce = mkDefault [{ allow = "admin"; }];
- local = mkDefault [{ allow = "local"; }];
- configure = mkDefault [{ allow = "admin"; }];
- register = mkDefault ["allow"];
- s2s = mkDefault ["allow"];
- trusted_network = mkDefault [{ allow = "loopback"; }];
- };
-
- acl = {
- local.user_regexp = mkDefault "";
- loopback.ip = mkDefault [
- "127.0.0.0/8"
- "::1/128"
- "::FFFF:127.0.0.1/128"
- ];
- };
-
- certfiles = mkDefault cfg.credentials.certfiles;
-
- hosts = mkDefault cfg.hosts;
-
- language = mkDefault "en";
-
- listen = mkDefault [
- {
- port = 5222;
- ip = "::";
- module = "ejabberd_c2s";
- shaper = "c2s_shaper";
- ciphers = concatStringsSep ":" cfg.ciphers;
- protocol_options = cfg.protocol_options;
- starttls = true;
- starttls_required = true;
- tls = false;
- tls_compression = false;
- max_stanza_size = 65536;
- }
- {
- port = 5269;
- ip = "::";
- module = "ejabberd_s2s_in";
- shaper = "s2s_shaper";
- dhfile = "${cfg.stateDir}/dhfile";
- max_stanza_size = 131072;
- }
- ];
-
- loglevel = mkDefault "4";
-
- modules = {
- mod_adhoc = mkDefault {};
- mod_admin_extra = mkDefault {};
- mod_announce.access = mkDefault "announce";
- mod_caps = mkDefault {};
- mod_carboncopy = mkDefault {};
- mod_client_state = mkDefault {};
- mod_configure = mkDefault {};
- mod_disco = mkDefault {};
- mod_echo = mkDefault {};
- mod_bosh = mkDefault {};
- mod_last = mkDefault {};
- mod_offline.access_max_user_messages = mkDefault "max_user_offline_messages";
- mod_ping = mkDefault {};
- mod_privacy = mkDefault {};
- mod_private = mkDefault {};
- mod_register = {
- access_from = mkDefault "deny";
- access = mkDefault "register";
- ip_access = mkDefault "trusted_network";
- registration_watchers = mkDefault cfg.registration_watchers;
- };
- mod_roster = mkDefault {};
- mod_shared_roster = mkDefault {};
- mod_stats = mkDefault {};
- mod_time = mkDefault {};
- mod_vcard.search = mkDefault false;
- mod_version = mkDefault {};
- mod_http_api = mkDefault {};
- };
-
- s2s_access = mkDefault "s2s";
- s2s_ciphers = concatStringsSep ":" cfg.ciphers;
- s2s_dhfile = mkDefault "${cfg.stateDir}/dhfile";
- s2s_protocol_options = mkDefault cfg.protocol_options;
- s2s_tls_compression = mkDefault false;
- s2s_use_starttls = mkDefault "required";
-
- shaper_rules = {
- max_user_offline_messages = mkDefault [
- { "5000" = "admin"; }
- 100
- ];
- max_user_sessions = mkDefault 10;
- c2s_shaper = mkDefault [
- { "none" = "admin"; }
- "normal"
- ];
- s2s_shaper = mkDefault "fast";
- };
- };
- };
-}
diff --git a/tv/3modules/ejabberd/lib b/tv/3modules/ejabberd/lib
deleted file mode 120000
index dc598c56d..000000000
--- a/tv/3modules/ejabberd/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib \ No newline at end of file
diff --git a/tv/3modules/focus.nix b/tv/3modules/focus.nix
deleted file mode 100644
index c16d44243..000000000
--- a/tv/3modules/focus.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-with import ./lib;
-{
- options.tv.focus.enable = mkEnableOption "tv.focus";
-}
diff --git a/tv/3modules/hosts.nix b/tv/3modules/hosts.nix
deleted file mode 100644
index 2d382e266..000000000
--- a/tv/3modules/hosts.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-with import ./lib;
-{ config, ... }: {
- options.tv.hosts = mkOption {
- type = types.attrsOf types.host;
- default =
- filterAttrs (_: host: host.owner.name == "tv")
- config.krebs.hosts;
- };
-}
diff --git a/tv/3modules/hw.nix b/tv/3modules/hw.nix
deleted file mode 100644
index db1a77c85..000000000
--- a/tv/3modules/hw.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-with import ./lib;
-let
- local.types.screen = lib.types.submodule {
- options.width = lib.mkOption {
- type = lib.types.uint;
- };
- options.height = lib.mkOption {
- type = lib.types.uint;
- };
- };
-in {
- options.tv.hw.screens = lib.mkOption {
- type = lib.types.attrsOf local.types.screen;
- default = {};
- };
-}
diff --git a/tv/3modules/im.nix b/tv/3modules/im.nix
deleted file mode 100644
index 76a61b191..000000000
--- a/tv/3modules/im.nix
+++ /dev/null
@@ -1,110 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }: let
- im = config.tv.im;
-in {
- options = {
- tv.im.client.enable = lib.mkEnableOption "tv.im.client" // {
- default = config.krebs.build.host.name == im.client.host.name;
- };
- tv.im.client.term = lib.mkOption {
- default = "rxvt-unicode-256color";
- type = lib.types.filename;
- };
- tv.im.client.useIPv6 = lib.mkEnableOption "tv.im.client.useIPv6" // {
- default = true;
- };
- tv.im.client.host = lib.mkOption {
- default = config.krebs.hosts.xu;
- type = lib.types.host;
- };
- tv.im.client.user = lib.mkOption {
- default = config.krebs.users.tv;
- type = lib.types.user;
- };
-
- tv.im.server.enable = lib.mkEnableOption "tv.im.server" // {
- default = config.krebs.build.host.name == im.server.host.name;
- };
- tv.im.server.host = lib.mkOption {
- default = config.krebs.hosts.nomic;
- type = lib.types.host;
- };
- tv.im.server.mosh.enable = lib.mkEnableOption "tv.im.server.mosh" // {
- default = true;
- };
- tv.im.server.weechat.relay.enable =
- lib.mkEnableOption "tv.im.server.weechat.relay";
- tv.im.server.user = lib.mkOption {
- default = config.krebs.users.tv;
- type = lib.types.user;
- };
- };
- imports = [
- (lib.mkIf im.client.enable {
- users.users.${im.client.user.name}.packages = [
- (pkgs.writeDashBin "im" ''
- ${if im.server.mosh.enable then /* sh */ ''
- exec ${pkgs.mosh}/bin/mosh \
- ${lib.optionalString im.client.useIPv6 "-6"} \
- ${im.server.user.name}@${lib.head im.server.host.nets.retiolum.aliases} \
- env TERM=${im.client.term} im
- '' else /* sh */ ''
- exec ${pkgs.openssh}/bin/ssh \
- ${lib.optionalString im.client.useIPv6 "-6"} \
- ${im.server.user.name}@${lib.head im.server.host.nets.retiolum.aliases} \
- -t \
- im
- ''}
- '')
- ];
- })
- (lib.mkIf im.server.enable {
- services.bitlbee = {
- enable = true;
- plugins = [
- pkgs.bitlbee-facebook
- ];
- };
- users.users.${im.server.user.name}.packages = [
- pkgs.mosh
- (pkgs.writeDashBin "im" ''
- export PATH=${lib.makeSearchPath "bin" [
- pkgs.tmux
- pkgs.gnugrep
- pkgs.weechat-tv
- ]}
- if tmux list-sessions -F\#S | grep -q '^im''$'; then
- exec tmux attach -t im
- else
- exec tmux new -s im weechat
- fi
- '')
- ];
- })
- (lib.mkIf im.server.mosh.enable {
- krebs.setuid.utempter = {
- filename = "${pkgs.libutempter}/lib/utempter/utempter";
- owner = "nobody";
- group = "utmp";
- mode = "2111";
- };
- tv.iptables.extra4.filter.Retiolum = [
- "-s ${im.client.host.nets.retiolum.ip4.addr} -p udp --dport 60000:61000 -j ACCEPT"
- ];
- tv.iptables.extra6.filter.Retiolum = [
- "-s ${im.client.host.nets.retiolum.ip6.addr} -p udp --dport 60000:61000 -j ACCEPT"
- ];
- })
- (lib.mkIf im.server.weechat.relay.enable {
- krebs.iana-etc.services = {
- "9001".tcp.name = "weechat-ssl";
- };
- tv.iptables.extra4.filter.Retiolum = [
- "-s ${im.client.host.nets.retiolum.ip4.addr} -p tcp -m tcp --dport 9001 -j ACCEPT"
- ];
- tv.iptables.extra6.filter.Retiolum = [
- "-s ${im.client.host.nets.retiolum.ip6.addr} -p tcp -m tcp --dport 9001 -j ACCEPT"
- ];
- })
- ];
-}
diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix
deleted file mode 100644
index 5b36c5acb..000000000
--- a/tv/3modules/iptables.nix
+++ /dev/null
@@ -1,208 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }: let {
- cfg = config.tv.iptables;
-
- body = {
- options.tv.iptables = api;
- config = lib.mkIf cfg.enable imp;
- };
-
- extraTypes = {
- rules = types.submodule {
- options = {
- nat.OUTPUT = mkOption {
- type = with types; listOf str;
- default = [];
- };
- nat.PREROUTING = mkOption {
- type = with types; listOf str;
- default = [];
- };
- nat.POSTROUTING = mkOption {
- type = with types; listOf str;
- default = [];
- };
- filter.FORWARD = mkOption {
- type = with types; listOf str;
- default = [];
- };
- filter.INPUT = mkOption {
- type = with types; listOf str;
- default = [];
- };
- filter.Retiolum = mkOption {
- type = with types; listOf str;
- default = [];
- };
- filter.Wiregrill = mkOption {
- type = with types; listOf str;
- default = [];
- };
- };
- };
- };
-
- api = {
- enable = mkEnableOption "tv.iptables";
-
- accept-echo-request = mkOption {
- type = with types; nullOr (enum ["internet" "retiolum"]);
- default = "retiolum";
- };
-
- input-internet-accept-tcp = mkOption {
- type = with types; listOf (either int str);
- default = [];
- };
-
- input-internet-accept-udp = mkOption {
- type = with types; listOf (either int str);
- default = [];
- };
-
- input-retiolum-accept-tcp = mkOption {
- type = with types; listOf (either int str);
- default = [];
- };
-
- input-retiolum-accept-udp = mkOption {
- type = with types; listOf (either int str);
- default = [];
- };
-
- input-wiregrill-accept-tcp = mkOption {
- type = with types; listOf (either int str);
- default = [];
- };
-
- input-wiregrill-accept-udp = mkOption {
- type = with types; listOf (either int str);
- default = [];
- };
-
- extra = mkOption {
- default = {};
- type = extraTypes.rules;
- };
-
- extra4 = mkOption {
- default = {};
- type = extraTypes.rules;
- };
-
- extra6 = mkOption {
- default = {};
- type = extraTypes.rules;
- };
- };
-
- imp = {
- networking.firewall.enable = false;
-
- systemd.services.tv-iptables = {
- wantedBy = [ "sysinit.target" ];
- wants = [ "network-pre.target" ];
- before = [ "network-pre.target" ];
- after = [ "systemd-modules-load.service" ];
-
- path = with pkgs; [
- iptables
- ];
-
- restartIfChanged = true;
-
- serviceConfig = {
- Type = "simple";
- RemainAfterExit = true;
- Restart = "always";
- SyslogIdentifier = "tv-iptables_start";
- ExecStart = pkgs.writeDash "tv-iptables_start" ''
- set -euf
- iptables-restore < ${rules 4}
- ip6tables-restore < ${rules 6}
- '';
- };
-
- unitConfig.DefaultDependencies = false;
- };
- };
-
- formatTable = table:
- (concatStringsSep "\n"
- (mapAttrsToList
- (chain: concatMapStringsSep "\n" (rule: "-A ${chain} ${rule}"))
- table));
-
- rules = iptables-version: let
- accept-echo-request = {
- ip4tables = "-p icmp -m icmp --icmp-type echo-request -j ACCEPT";
- ip6tables = "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT";
- }."ip${toString iptables-version}tables";
- accept-tcp = port: "-p tcp -m tcp --dport ${port} -j ACCEPT";
- accept-udp = port: "-p udp -m udp --dport ${port} -j ACCEPT";
- in
- pkgs.writeText "tv-iptables-rules${toString iptables-version}" ''
- *nat
- :PREROUTING ACCEPT [0:0]
- :INPUT ACCEPT [0:0]
- :OUTPUT ACCEPT [0:0]
- :POSTROUTING ACCEPT [0:0]
- ${formatTable cfg."extra${toString iptables-version}".nat}
- ${formatTable cfg.extra.nat}
- COMMIT
- *filter
- :INPUT DROP [0:0]
- :FORWARD DROP [0:0]
- :OUTPUT ACCEPT [0:0]
- :Retiolum - [0:0]
- :Wiregrill - [0:0]
- ${concatMapStringsSep "\n" (rule: "-A INPUT ${rule}") ([]
- ++ [
- "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
- "-i lo -j ACCEPT"
- ]
- ++ optional (cfg.accept-echo-request == "internet") accept-echo-request
- ++ map accept-tcp (unique (map toString cfg.input-internet-accept-tcp))
- ++ map accept-udp (unique (map toString cfg.input-internet-accept-udp))
- ++ ["-i retiolum -j Retiolum"]
- ++ ["-i wiregrill -j Wiregrill"]
- )}
- ${formatTable cfg.extra.filter}
- ${formatTable cfg."extra${toString iptables-version}".filter}
- ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([]
- ++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request
- ++ map accept-tcp (unique (map toString cfg.input-retiolum-accept-tcp))
- ++ map accept-udp (unique (map toString cfg.input-retiolum-accept-udp))
- ++ {
- ip4tables = [
- "-p tcp -j REJECT --reject-with tcp-reset"
- "-p udp -j REJECT --reject-with icmp-port-unreachable"
- "-j REJECT --reject-with icmp-proto-unreachable"
- ];
- ip6tables = [
- "-p tcp -j REJECT --reject-with tcp-reset"
- "-p udp -j REJECT --reject-with icmp6-port-unreachable"
- "-j REJECT"
- ];
- }."ip${toString iptables-version}tables"
- )}
- ${concatMapStringsSep "\n" (rule: "-A Wiregrill ${rule}") ([]
- ++ optional (cfg.accept-echo-request == "wiregrill") accept-echo-request
- ++ map accept-tcp (unique (map toString cfg.input-wiregrill-accept-tcp))
- ++ map accept-udp (unique (map toString cfg.input-wiregrill-accept-udp))
- ++ {
- ip4tables = [
- "-p tcp -j REJECT --reject-with tcp-reset"
- "-p udp -j REJECT --reject-with icmp-port-unreachable"
- "-j REJECT --reject-with icmp-proto-unreachable"
- ];
- ip6tables = [
- "-p tcp -j REJECT --reject-with tcp-reset"
- "-p udp -j REJECT --reject-with icmp6-port-unreachable"
- "-j REJECT"
- ];
- }."ip${toString iptables-version}tables"
- )}
- COMMIT
- '';
-}
diff --git a/tv/3modules/lib b/tv/3modules/lib
deleted file mode 120000
index dc598c56d..000000000
--- a/tv/3modules/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib \ No newline at end of file
diff --git a/tv/3modules/lidControl.nix b/tv/3modules/lidControl.nix
deleted file mode 100644
index 6a48da18d..000000000
--- a/tv/3modules/lidControl.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }: {
- options = {
- tv.lidControl.enable = mkEnableOption "tv.lidControl";
- };
- config = let
- cfg = config.tv.lidControl;
- in mkIf cfg.enable {
- services.acpid.enable = true;
- services.acpid.lidEventCommands = /* sh */ ''
- set -- $1
-
- # usage: vt_is_xserver NUMBER
- vt_is_xserver() {
- ${pkgs.iproute}/bin/ss -lp src unix:/tmp/.X11-unix/X* |
- ${pkgs.gnused}/bin/sed -n 's|.*/tmp/.X11-unix/X\([0-9]\+\)\>.*|\1|p' |
- ${pkgs.gnugrep}/bin/grep -Fqx "$1"
- }
-
- console=$(${pkgs.kbd}/bin/fgconsole)
-
- if vt_is_xserver "$console"; then
- # usage: run_on_display COMMAND [ARG...]
- run_on_display() {
- owner=$(${pkgs.coreutils}/bin/stat -c %u /tmp/.X11-unix/X$console)
- ${pkgs.systemd}/bin/systemd-run -GPq \
- -E DISPLAY=:$console \
- --uid=$owner \
- "$@"
- }
- case $3 in
- open)
- run_on_display ${pkgs.xorg.xset}/bin/xset dpms force on
- ;;
- close)
- run_on_display ${pkgs.xorg.xset}/bin/xset dpms force off
- ;;
- esac
- fi
- '';
- services.logind.lidSwitch = "ignore";
- services.logind.lidSwitchDocked = "ignore";
- services.logind.lidSwitchExternalPower = "ignore";
- };
-}
diff --git a/tv/3modules/org.freedesktop.machine1.host-shell.nix b/tv/3modules/org.freedesktop.machine1.host-shell.nix
deleted file mode 100644
index 7d31edf9d..000000000
--- a/tv/3modules/org.freedesktop.machine1.host-shell.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-with import ./lib;
-{ config, ... }: {
- options.org.freedesktop.machine1.host-shell.access = lib.mkOption {
- default = {};
- type =
- lib.types.addCheck
- (lib.types.attrsOf (lib.types.attrsOf lib.types.bool))
- (x:
- lib.all
- lib.types.username.check
- (lib.concatLists
- (lib.mapAttrsToList
- (name: value: [name] ++ lib.attrNames value)
- x)));
- };
- config.security.polkit.extraConfig = let
- cfg = config.org.freedesktop.machine1.host-shell;
- enable = cfg.access != {};
- in lib.optionalString enable /* js */ ''
- polkit.addRule(function () {
- var access = ${lib.toJSON cfg.access};
- return function(action, subject) {
- if (action.id === "org.freedesktop.machine1.host-shell"
- && (access[subject.user]||{})[action.lookup("user")])
- return polkit.Result.YES;
- }
- }());
- '';
-}
diff --git a/tv/3modules/slock.nix b/tv/3modules/slock.nix
deleted file mode 100644
index a08303215..000000000
--- a/tv/3modules/slock.nix
+++ /dev/null
@@ -1,78 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }: let
- cfg = config.tv.slock;
-in {
- options.tv.slock = {
- enable = mkEnableOption "tv.slock";
- package = mkOption {
- default = pkgs.writeDashBin "slock" ''
- set -efu
- display=''${DISPLAY#:}
- service=slock-$LOGNAME@$display.service
- exec ${pkgs.systemd}/bin/systemctl start "$service"
- '';
- type = types.package;
- };
- user = mkOption {
- type = types.user;
- };
- };
- config = mkIf cfg.enable {
- security.polkit.extraConfig = /* js */ ''
- polkit.addRule(function(action, subject) {
- if (action.id === "org.freedesktop.systemd1.manage-units" &&
- subject.user === ${toJSON cfg.user.name} &&
- /^slock-${cfg.user.name}@[0-9]+\.service$/.test(action.lookup("unit")) ) {
- return polkit.Result.YES;
- }
- });
- '';
- systemd.services."slock-${cfg.user.name}@" = {
- conflicts = [
- "picom@%i.target"
- ];
- environment = {
- DISPLAY = ":%I";
- LD_PRELOAD = pkgs.runCommandCC "slock-${cfg.user.name}.so" {
- passAsFile = ["text"];
- text = /* c */ ''
- #include <shadow.h>
- #include <unistd.h>
-
- static struct spwd entry = {
- .sp_namp = "",
- .sp_pwdp =
- ${toC config.users.users.${cfg.user.name}.hashedPassword},
- .sp_lstchg = 0,
- .sp_min = 0,
- .sp_max = 0,
- .sp_warn = 0,
- .sp_inact = 0,
- .sp_expire = 0,
- .sp_flag = 0,
- };
-
- extern struct spwd *getspnam(const char *name) { return &entry; }
- extern int setgroups(size_t size, const gid_t *list) { return 0; }
- extern int setgid(gid_t gid) { return 0; }
- extern int setuid(uid_t uid) { return 0; }
- '';
- } /* sh */ ''
- gcc -Wall -shared -o $out -xc "$textPath"
- '';
- };
- restartIfChanged = false;
- serviceConfig = {
- ExecStart = "${pkgs.slock}/bin/slock";
- ExecStopPost =
- "+${pkgs.systemd}/bin/systemctl start xsession@%i.target";
- OOMScoreAdjust = -1000;
- Restart = "on-failure";
- RestartSec = "100ms";
- StartLimitBurst = 0;
- SyslogIdentifier = "slock";
- User = cfg.user.name;
- };
- };
- };
-}
diff --git a/tv/3modules/systemd.nix b/tv/3modules/systemd.nix
deleted file mode 100644
index db8a51994..000000000
--- a/tv/3modules/systemd.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-with import ./lib;
-{ config, ... }: let
- normalUsers = filterAttrs (_: getAttr "isNormalUser") config.users.users;
-in {
- options = {
- tv.systemd.services = mkOption {
- type = types.attrsOf (types.submodule (self: {
- options = {
- operators = mkOption {
- type = with types; listOf (enum (attrNames normalUsers));
- default = [];
- };
- };
- }));
- default = {};
- };
- };
- config = {
- security.polkit.extraConfig = let
- access =
- mapAttrs'
- (name: cfg:
- nameValuePair "${name}.service"
- (genAttrs cfg.operators (const true))
- )
- config.tv.systemd.services;
- in optionalString (access != {}) /* js */ ''
- polkit.addRule(function () {
- const access = ${lib.toJSON access};
- return function (action, subject) {
- if (action.id === "org.freedesktop.systemd1.manage-units") {
- const unit = action.lookup("unit");
- if (
- (access[unit]||{})[subject.user] ||
- (
- unit.includes("@") &&
- (access[unit.replace(/@[^.]+/, "@")]||{})[subject.user]
- )
- ) {
- return polkit.Result.YES;
- }
- }
- }
- }());
- '';
- };
-}
diff --git a/tv/3modules/unbound.nix b/tv/3modules/unbound.nix
deleted file mode 100644
index 6a5102753..000000000
--- a/tv/3modules/unbound.nix
+++ /dev/null
@@ -1,84 +0,0 @@
-{ config, lib, pkgs, ... }: {
- options.tv.unbound = {
- enable = lib.mkEnableOption "tv.unbound";
- DoH.enable = lib.mkEnableOption "tv.unbound.DoH";
- DoT.enable = lib.mkEnableOption "tv.unbound.DoT";
- host = lib.mkOption {
- type = lib.types.str;
- };
- useACMEHost = lib.mkOption {
- type = lib.types.str;
- };
- };
- imports = let
- cfg = config.tv.unbound;
- in [
- (lib.mkIf cfg.enable {
- services.unbound = {
- enable = true;
- settings.server = {
- access-control = [
- "::/0 allow"
- "0.0.0.0/0 allow"
- ];
- interface = [
- "127.0.0.1@53"
- "retiolum@53"
- "wiregrill@53"
- ];
- prefetch = true;
- prefetch-key = true;
- };
- };
- # Since we use this for local dns resolving, we don't want to stop/start
- # but just restart, so we quickly get it back.
- systemd.services.unbound.stopIfChanged = false;
-
- tv.iptables.input-retiolum-accept-udp = [ "domain" ];
- tv.iptables.input-wiregrill-accept-udp = [ "domain" ];
- })
- (lib.mkIf cfg.DoH.enable (let
- http-port = 8053;
- http-endpoint = "/query";
- in {
- services.unbound.package = pkgs.unbound-with-systemd.override {
- withDoH = true;
- };
- services.unbound.settings.server.interface = [
- "127.0.0.1@${toString http-port}"
- ];
- services.unbound.settings.server = {
- https-port = http-port;
- http-endpoint = http-endpoint;
- http-notls-downstream = true;
- };
- services.nginx.virtualHosts.${cfg.host} = {
- useACMEHost = cfg.useACMEHost;
- forceSSL = true;
- http2 = true;
- locations."/".return = ''404 "Not Found\n"'';
- locations.${http-endpoint}.extraConfig = ''
- grpc_pass grpc://127.0.0.1:${toString http-port};
- '';
- };
-
- tv.iptables.input-internet-accept-tcp = [ "https" ];
- }))
- (lib.mkIf cfg.DoT.enable {
- services.unbound.settings.server = {
- interface = [
- "::@853"
- "0.0.0.0@853"
- ];
- tls-service-key = "/run/credentials/unbound.service/tls-service-key";
- tls-service-pem = "/run/credentials/unbound.service/tls-service-pem";
- };
- krebs.systemd.services.unbound.restartIfCredentialsChange = true;
- systemd.services.unbound.serviceConfig.LoadCredential = [
- "tls-service-key:/var/lib/acme/${cfg.useACMEHost}/key.pem"
- "tls-service-pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem"
- ];
- tv.iptables.input-internet-accept-tcp = [ "domain-s" ];
- })
- ];
-}
diff --git a/tv/3modules/wwan.nix b/tv/3modules/wwan.nix
deleted file mode 100644
index 0cdfbf36c..000000000
--- a/tv/3modules/wwan.nix
+++ /dev/null
@@ -1,182 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }: {
- options = {
- tv.wwan.enable = mkEnableOption "tv.wwan";
- tv.wwan.apn = mkOption {
- type = with types; filename;
- };
- tv.wwan.device = mkOption {
- type = with types; pathname;
- default = "/dev/cdc-wdm0";
- };
- tv.wwan.interface = mkOption {
- type = with types; nullOr filename;
- default = null;
- };
- tv.wwan.operators = mkOption {
- type = with types; listOf username;
- default = [];
- };
- tv.wwan.secrets = mkOption {
- type = with types; pathname;
- default = "${config.krebs.secret.directory}/wwan.json";
- # format: {"pin1":number}
- };
- };
- config = let
- cfg = config.tv.wwan;
- in mkIf cfg.enable {
- nixpkgs.overlays = singleton (self: super: {
- uqmi-wrapper = pkgs.symlinkJoin {
- name = "uqmi-wrapper";
- paths = [
- (pkgs.writeDashBin "uqmi" ''
- exec ${pkgs.uqmi}/bin/uqmi --device=${cfg.device} "$@"
- '')
- (pkgs.writeTextDir "share/bash-completion/completions/uqmi" /* sh */''
- _uqmi_complete() {
- case ''${#COMP_WORDS[@]} in
- 2)
- COMPREPLY=($(compgen -W "$(
- ${pkgs.uqmi}/bin/uqmi --help 2>&1 |
- ${pkgs.coreutils}/bin/tr , \\n |
- ${pkgs.gnused}/bin/sed -nr 's/^ *(-[a-z-]+).*/\1/p'
- )" -- "''${COMP_WORDS[1]}"))
- ;;
- esac
- }
- complete -F _uqmi_complete uqmi
- '')
- pkgs.uqmi
- ];
- };
- });
- systemd.services.wwan = {
- environment = {
- SECRETS = "%d/secrets";
- };
- path = [
- pkgs.busybox
- pkgs.coreutils
- pkgs.iproute2
- pkgs.jq
- pkgs.uqmi-wrapper
- (pkgs.writeDashBin "get-interface" (
- if cfg.interface != null then /* sh */ ''
- echo ${cfg.interface}
- '' else /* sh */ ''
- exec ${pkgs.libqmi}/bin/qmicli -d ${cfg.device} -p --get-wwan-iface
- ''
- ))
- ];
- serviceConfig = {
- LoadCredential = [
- "secrets:${cfg.secrets}"
- ];
- Type = "oneshot";
- RemainAfterExit = true;
- SyslogIdentifier = "wwan";
- ExecStart = pkgs.writeDash "tv.wwan.start.sh" ''
- set -efu
-
- interface=$(get-interface)
-
- pin1_status=$(
- uqmi --uim-get-sim-state |
- jq -r '"\(.pin1_status)/\(.pin1_verify_tries)"'
- )
- case $pin1_status in
- verified/*)
- :
- ;;
- not_verified/3)
- pin1=$(jq .pin1 "$SECRETS")
- echo "verifying PIN1" >&2
- if ! uqmi --uim-verify-pin1 "$pin1"; then
- echo "error: failed to verify PIN1" >&2
- exit 1
- fi
- ;;
- not_verified/*)
- echo "error: not trying to verify PIN1: not enough tries left" >&2
- echo \
- "please check your configuration in ${cfg.secrets}" \
- " and verify if manually using:" \
- " ${pkgs.uqmi}/bin/uqmi -d $device --uim-veriy-pin1 XXXX" \
- >&2
- exit 1
- esac
-
- raw_ip_path=/sys/class/net/$interface/qmi/raw_ip
- raw_ip=$(cat "$raw_ip_path")
- if [ "$raw_ip" != Y ]; then
- echo "enabling raw-ip" >&2
- if ! echo Y > "$raw_ip_path"; then
- echo "error: failed to enable raw-ip" >&2
- exit 1
- fi
- fi
-
- operating_mode=$(uqmi --get-device-operating-mode | tr -d \")
- case $operating_mode in
- online)
- :
- ;;
- persistent_low_power|low_power)
- echo "settings device operating mode to online" >&2
- uqmi --set-device-operating-mode online
- operating_mode=$(uqmi --get-device-operating-mode | tr -d \")
- if test "$operating_mode" != online; then
- echo "error: failed to set device operating mode to online" >&2
- exit 1
- fi
- ;;
- *)
- echo "error: don't know how to change device operating mode to online: $operating_mode" >&2
- exit 1
- esac
-
- ip link set dev "$interface" up
-
- data_status=$(uqmi --get-data-status | tr -d \")
- case $data_status in
- connected)
- :
- ;;
- disconnected)
- echo "starting network (APN=${cfg.apn})" >&2
- sleep 1
- uqmi \
- --start-network \
- --autoconnect \
- --apn ${cfg.apn} \
- --ip-family ipv4
- sleep 1
- ;;
- *)
- echo "error: unsupported data status: $data_status" >&2
- exit 1
- esac
-
- udhcpc -q -f -n -i "$interface"
- '';
- Restart = "on-failure";
- ExecStop = pkgs.writeDash "tv.wwan.stop.sh" ''
- set -efu
-
- interface=$(get-interface)
-
- ip addr flush "$interface"
- ip link set dev "$interface" down
- uqmi --stop-network 0xFFFFFFFF --autoconnect
- uqmi --sync
- uqmi --set-device-operating-mode persistent_low_power
- '';
- };
- };
- users.users.root.packages = [
- pkgs.uqmi-wrapper
- ];
- tv.systemd.services.wwan.operators = cfg.operators;
- };
-}
diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix
deleted file mode 100644
index c8e23d06e..000000000
--- a/tv/3modules/x0vncserver.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }: let
- cfg = config.tv.x0vncserver;
-in {
- options.tv.x0vncserver = {
- display = mkOption {
- default = ":${toString config.services.xserver.display}";
- type = types.str;
- };
- enable = mkEnableOption "tv.x0vncserver";
- pwfile = mkOption {
- default = "${config.krebs.secret.directory}/vncpasswd";
- description = ''
- Use vncpasswd to edit pwfile.
- See: nix-shell -p tigervnc --run 'man vncpasswd'
- '';
- type = types.absolute-pathname;
- };
- rfbport = mkOption {
- default = 5900;
- type = types.int;
- };
- user = mkOption {
- default = config.krebs.build.user;
- type = types.user;
- };
- };
- config = mkIf cfg.enable {
- krebs.systemd.services.x0vncserver.restartIfCredentialsChange = true;
- systemd.services.x0vncserver = {
- after = [ "graphical.target" ];
- requires = [ "graphical.target" ];
- serviceConfig = {
- ExecStart = "${pkgs.tigervnc}/bin/x0vncserver ${toString [
- "-display ${cfg.display}"
- "-passwordfile \${CREDENTIALS_DIRECTORY}/pwfile"
- "-rfbport ${toString cfg.rfbport}"
- ]}";
- LoadCredential = "ssh_key:${cfg.pwfile}";
- User = cfg.user.name;
- };
- };
- tv.iptables.input-retiolum-accept-tcp = singleton (toString cfg.rfbport);
- };
-}
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-09 20:51:31 +0000
[cgit] Unable to lock slot /tmp/cgit/34300000.lock: No such file or directory (2)