1 files changed, 81 insertions, 23 deletions

diff --git a/hel.nix b/hel.nix
index 3753a8df..7a3a3af7 100644
--- a/hel.nix
+++ b/hel.nix
@@ -45,7 +45,6 @@
     git
     slock
     shadow
-    (callPackage ./custom/thinklight.nix { thinklight = "kbd_backlight"; })
     (callPackage ./utils/nix/rebuild-system.nix {})
     rewacom
   ];
@@ -58,7 +57,22 @@
     '';
 
     samsung-unified-linux-driver = pkgs.stdenv.lib.overrideDerivation pkgs.samsung-unified-linux-driver (oldAttrs: {
-      buildInputs = with pkgs; [cups];
+      buildInputs = oldAttrs.buildInputs ++ [ pkgs.makeWrapper ];
+      builder = pkgs.writeScript "builder.sh" ''
+        #!${pkgs.stdenv.shell}
+
+        source ${pkgs.stdenv}/setup
+
+        ${oldAttrs.builder} ${pkgs.lib.concatStringsSep " " oldAttrs.args}
+
+        export PATH=${pkgs.makeWrapper}/bin:$PATH
+      
+        echo "Wrapping samsung filters"
+        wrapProgram $out/lib/cups/filter/rastertosamsungspl \
+          --prefix PATH : ${pkgs.ghostscript}/bin
+        wrapProgram $out/lib/cups/filter/rastertosamsungsplc \
+          --prefix PATH : ${pkgs.ghostscript}/bin
+      '';
     });
   };
 
@@ -162,8 +176,8 @@
       nodeName = "hel";
       remoteNodes = ["isaac" "ymir"]; # legacy name for odin
       sshUser = {
-        openssh.authorizedKeys.keys = [ ''no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="/var/setuid-wrappers/uucico" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFH1QWdgoC03nzW5GBuCl2pqASHeIXIYtE9IInHdaKcO uucp@ymir''
-                                        ''no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="${pkgs.writeScript "odin.sh" "#!${pkgs.stdenv.shell}\necho .\nexec -a uucico /var/setuid-wrappers/uucico\n"}" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJhACtnt9+3j2ev4QVA2QBlPtblPnu7yol2njgfMlHtC uucp@odin''
+        openssh.authorizedKeys.keys = [ ''no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="${config.security.wrapperDir}/uucico" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFH1QWdgoC03nzW5GBuCl2pqASHeIXIYtE9IInHdaKcO uucp@ymir''
+                                        ''no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="${pkgs.writeScript "odin.sh" "#!${pkgs.stdenv.shell}\necho .\nexec -a uucico ${config.security.wrapperDir}/uucico\n"}" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJhACtnt9+3j2ev4QVA2QBlPtblPnu7yol2njgfMlHtC uucp@odin''
                                       ];
       };
       sshConfig = ''
@@ -174,7 +188,7 @@
           Hostname ymir.niflheim.yggdrasil
           IdentityFile ~/.ssh/ymir
       '';
-      commandPath = [ "${pkgs.callPackage ./hel/recv-media.nix {}}/bin" "/var/setuid-wrappers/" ];
+      commandPath = [ "${pkgs.callPackage ./hel/recv-media.nix {}}/bin" config.security.wrapperDir ];
       defaultCommands = [];
       commands = {
         "isaac" = ["recv-media" "notify-gkleen"];
@@ -195,12 +209,17 @@
       relayHost = "uucp:ymir";
       recipientDelimiter = "+";
       extraMasterConf = ''
-        uucp        unix - n n - - pipe flags=Fqhu user=uucp argv=/var/setuid-wrappers/uux -z -a $sender - $nexthop!rmail ($recipient)
+        uucp        unix - n n - - pipe flags=Fqhu user=uucp argv=${config.security.wrapperDir}/uux -z -a $sender - $nexthop!rmail ($recipient)
         sshsendmail unix - n n - - pipe flags=Fq user=postfix_ssh argv=${pkgs.openssh}/bin/ssh -F /var/db/postfix_ssh/ssh.config $nexthop sendmail -f $sender -G $recipient
       '';
+      transport = ''
+        gkleen+sent@yggdrasil.li uucp:isaac
+      '';
       extraConfig = ''
-        default_transport = uucp:ymir
+        always_bcc = gkleen+sent@yggdrasil.li
       
+        default_transport = uucp:ymir
+
         inet_interfaces = loopback-only
       
         authorized_submit_users = !uucp, static:anyone
@@ -265,6 +284,34 @@
     upower = {
       enable = true;
     };
+
+    locate = {
+      enable = true;
+      interval = "hourly";
+      locate = pkgs.mlocate;
+      localuser = null;
+      prunePaths = ["/tmp" "/var/tmp" "/var/cache" "/var/lock" "/var/run" "/var/spool"];
+    };
+
+    dbus = {
+      enable = true;
+      packages = [ (pkgs.writeTextFile {
+                      name = "eavesdrop.conf";
+                      text = ''
+                        <!DOCTYPE busconfig PUBLIC
+                        "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
+                        "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+                        <busconfig>
+                          <policy user="root">
+                            <allow eavesdrop="true"/>
+                            <allow eavesdrop="true" send_destination="*"/>
+                          </policy>
+                        </busconfig>
+                      '';
+                      destination = "/etc/dbus-1/system.d/eavesdrop.conf";
+                    })
+                 ];
+    };
   };
 
   users = {
@@ -304,17 +351,21 @@
       %wheel ALL=(ALL) NOPASSWD: SYSCTRL
     '';
 
-    setuidPrograms = ["slock" "mount" "mount.nfs" "umount" "newgrp" "thinklight"];
-
-    setuidOwners = [ { group = "users";
-                       owner = "gkleen";
-                       permissions = "u+rx,g+x,o+x";
-                       program = "notify-gkleen";
-                       setgid = true;
-                       setuid = true;
-                       source = ''${pkgs.callPackage ./custom/notify-user.nix { inherit (pkgs.haskellPackages) ghcWithPackages; }}/bin/notify-gkleen'';
-                     }
-                   ];
+    wrappers = { "slock".source = "${pkgs.slock}/bin/slock";
+                 "mount".source = "${pkgs.utillinux.bin}/bin/mount";
+                 "umount".source = "${pkgs.utillinux.bin}/bin/umount";
+                 "newgrp".source = "${pkgs.shadow}/bin/newgrp";
+                 "thinklight".source =
+                   "${(pkgs.callPackage ./custom/thinklight.nix { thinklight = "kbd_backlight"; })}/bin/thinklight";
+                 "notify-gkleen" = {
+                   group = "users";
+                   owner = "gkleen";
+                   setgid = true;
+                   setuid = true;
+                   permissions = "u+rx,g+x,o+x";
+                   source = ''${pkgs.callPackage ./custom/notify-user.nix { inherit (pkgs.haskellPackages) ghcWithPackages; }}/bin/notify-gkleen'';
+                 };
+               };
 
     polkit = {
       enable = true;
@@ -347,11 +398,11 @@
 
     bluetooth.enable = true;   
 
-    sane = {
-      enable = true;
-      extraBackends = with pkgs; [ samsung-unified-linux-driver ];
-      configDir = "/etc/sane.d";
-    };
+    # sane = {
+    #   enable = true;
+    #   extraBackends = with pkgs; [ samsung-unified-linux-driver ];
+    #   configDir = "/etc/sane.d";
+    # };
   };
 
   sound.enable = true;
@@ -374,6 +425,13 @@
   environment.etc."sane.d/dll.conf".text = "xerox_mfp";
   environment.etc."sane.d/xerox_mfp.conf".text = "tcp printer.asgard.yggdrasil";
 
+  environment.sessionVariables = {
+    "SANE_CONFIG_DIR" = "/etc/sane.d";
+    "TPRINT_BASEURL" = "http://bragi.asgard.yggdrasil/thermoprint/api";
+    "MPD_HOST" = "bragi.asgard.yggdrasil";
+    "MPD_PORT" = "6600";
+  };
+
   systemd.services."kill-user@" = {
     serviceConfig = {
       Type = "oneshot";