diff --git a/ansible/bk2.v.vstill.cz.yml b/ansible/bk2.v.vstill.cz.yml
deleted file mode 100644
index ceda48a3b0d890bede398b35476bab4bd1874e30..0000000000000000000000000000000000000000
--- a/ansible/bk2.v.vstill.cz.yml
+++ /dev/null
@@ -1,114 +0,0 @@
-- name: bk2.v.vstill.cz
- hosts: bk2.v.vstill.cz
- vars:
- ansible_fqdn: bk2.v.vstill.cz
- postfix: true
- mail_relay: 192.168.2.52
- pam_use_kerberos: false
- nft_extra:
- # Samba (local nets only)
-
- ip saddr 192.168.0.0/21 tcp dport { 139, 445 } accept
-
- ip saddr 192.168.0.0/21 tcp dport { 137, 138 } accept
-
- tasks:
- - fail:
- msg: possibly wrong server?
- when: ansible_distribution != 'Debian'
-
- - import_role:
- name: common_deb
-
- - name: Additional static IPv4 setup
- template:
- src: dhcpcd-ipv4-static-hook
- dest: /lib/dhcpcd/dhcpcd-hooks/09-ipv4-static
- vars:
- static_ip: 192.168.2.51/24
- static_dev: enp2s0
- notify:
- - restart dhcpcd
-
- - import_role:
- name: vstill_deb
-
-# - name: "Setup fstab"
-# mount:
-# path: '{{item.path}}'
-# src: '{{item.src}}'
-# fstype: '{{item.fstype}}'
-# opts: '{{item.opts|default("defaults")}}'
-# dump: "0"
-# passno: '{{item.passno|default("0")}}'
-# state: '{{item.state|default("mounted")}}'
-# with_items:
-# - path: "/"
-# src: /dev/vg.root/root-deb
-# fstype: xfs
-# opts: rw,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota
-# passno: 1
-# - path: none
-# src: /dev/vg.root/swap
-# fstype: swap
-# state: present
-# - path: /data
-# src: /dev/vg.data/data
-# fstype: xfs
-# opts: rw,relatime,attr2,inode64,noquota,noauto,x-systemd.automount
-# passno: 2
-# - path: /mnt/data-krull
-# src: /dev/vg.data/data-krull
-# fstype: ext4
-# opts: rw,relatime,noauto,x-systemd.automount
-# passno: 2
-
- - apt:
- pkg:
- - grub-efi
- - dpkg-dev
- - duperemove
-
- - apt:
- pkg:
- - linux-headers-amd64
- - linux-image-amd64
- - cryptsetup-bin
-
- - name: Integrity udev rule
- copy:
- content: |
- ENV{ID_PART_ENTRY_SCHEME}=="gpt", ENV{ID_PART_ENTRY_NAME}=="integrity?*", RUN+="/usr/sbin/integritysetup open $env{DEVNAME} $env{ID_PART_ENTRY_NAME} --integrity sha1"
- dest: /etc/udev/rules.d/99-integrity.rules
-
- - name: Initramfs modules
- lineinfile:
- regex: '^{{item}}$'
- line: '{{item}}'
- path: /etc/initramfs-tools/modules
- loop:
- - raid1
- - raid456
- - dm_integrity
-
- - name: OpenVPN service config
- template:
- src: openvpn-vstill.conf.j2
- dest: '/etc/openvpn/client/{{ovpn_hostname | default(inventory_hostname)}}.conf'
- register: ovpn_config
-
- - name: OpenVPN service
- systemd:
- name: 'openvpn-client@{{ovpn_hostname | default(inventory_hostname)}}.service'
- enabled: true
- state: '{{"restarted" if ovpn_config.changed else "started"}}'
-
- - name: Samba
- import_role:
- name: samba
- vars:
- shares:
- - name: "public"
- path: "/data/public"
- public: true
- writeable: true
diff --git a/ansible/eval-haskell.fi.muni.cz.yml b/ansible/eval-haskell.fi.muni.cz.yml
deleted file mode 100644
index c090b050cc243f417da64148d2d6ffe1db91bbf4..0000000000000000000000000000000000000000
--- a/ansible/eval-haskell.fi.muni.cz.yml
+++ /dev/null
@@ -1,495 +0,0 @@
-- name: eval-haskell
- hosts: eval-haskell.fi.muni.cz
- vars:
- dhcpcd: false
- postfix: true
- ghc_version: 9.2.1
- ghc_version_bootstrap: 9.0.2
- cabal_version: 3.6.2.0
- ghc_prefix: '/opt/ghc/{{ghc_version}}'
- cabal_dir: '/usr/local/bin'
- ib015_workers: 8
- ib016_workers: 2
- backports: false
- frag_eval_tools:
- - auto
- - cc
- - group
- - sandbox
- - sub
-
- tasks:
- - import_role:
- name: runner_install
- tags:
- - install
-
- - block:
- - import_role:
- name: common_deb
-
- - name: Install frag requisites
- apt:
- pkg:
- - darcs
- - clang
- - libcurl4-gnutls-dev
- - libexpat1-dev
- - libldap2-dev
- - libacl1-dev
- - libcap-dev
-
- - name: Postgres key
- apt_key:
- data: |
- -----BEGIN PGP PUBLIC KEY BLOCK-----
-
- mQINBE6XR8IBEACVdDKT2HEH1IyHzXkb4nIWAY7echjRxo7MTcj4vbXAyBKOfjja
- UrBEJWHN6fjKJXOYWXHLIYg0hOGeW9qcSiaa1/rYIbOzjfGfhE4x0Y+NJHS1db0V
- G6GUj3qXaeyqIJGS2z7m0Thy4Lgr/LpZlZ78Nf1fliSzBlMo1sV7PpP/7zUO+aA4
- bKa8Rio3weMXQOZgclzgeSdqtwKnyKTQdXY5MkH1QXyFIk1nTfWwyqpJjHlgtwMi
- c2cxjqG5nnV9rIYlTTjYG6RBglq0SmzF/raBnF4Lwjxq4qRqvRllBXdFu5+2pMfC
- IZ10HPRdqDCTN60DUix+BTzBUT30NzaLhZbOMT5RvQtvTVgWpeIn20i2NrPWNCUh
- hj490dKDLpK/v+A5/i8zPvN4c6MkDHi1FZfaoz3863dylUBR3Ip26oM0hHXf4/2U
- A/oA4pCl2W0hc4aNtozjKHkVjRx5Q8/hVYu+39csFWxo6YSB/KgIEw+0W8DiTII3
- RQj/OlD68ZDmGLyQPiJvaEtY9fDrcSpI0Esm0i4sjkNbuuh0Cvwwwqo5EF1zfkVj
- Tqz2REYQGMJGc5LUbIpk5sMHo1HWV038TWxlDRwtOdzw08zQA6BeWe9FOokRPeR2
- AqhyaJJwOZJodKZ76S+LDwFkTLzEKnYPCzkoRwLrEdNt1M7wQBThnC5z6wARAQAB
- tBxQb3N0Z3JlU1FMIERlYmlhbiBSZXBvc2l0b3J5iQJOBBMBCAA4AhsDBQsJCAcD
- BRUKCQgLBRYCAwEAAh4BAheAFiEEuXsK/KoaR/BE8kSgf8x9RqzMTPgFAlhtCD8A
- CgkQf8x9RqzMTPgECxAAk8uL+dwveTv6eH21tIHcltt8U3Ofajdo+D/ayO53LiYO
- xi27kdHD0zvFMUWXLGxQtWyeqqDRvDagfWglHucIcaLxoxNwL8+e+9hVFIEskQAY
- kVToBCKMXTQDLarz8/J030Pmcv3ihbwB+jhnykMuyyNmht4kq0CNgnlcMCdVz0d3
- z/09puryIHJrD+A8y3TD4RM74snQuwc9u5bsckvRtRJKbP3GX5JaFZAqUyZNRJRJ
- Tn2OQRBhCpxhlZ2afkAPFIq2aVnEt/Ie6tmeRCzsW3lOxEH2K7MQSfSu/kRz7ELf
- Cz3NJHj7rMzC+76Rhsas60t9CjmvMuGONEpctijDWONLCuch3Pdj6XpC+MVxpgBy
- 2VUdkunb48YhXNW0jgFGM/BFRj+dMQOUbY8PjJjsmVV0joDruWATQG/M4C7O8iU0
- B7o6yVv4m8LDEN9CiR6r7H17m4xZseT3f+0QpMe7iQjz6XxTUFRQxXqzmNnloA1T
- 7VjwPqIIzkj/u0V8nICG/ktLzp1OsCFatWXh7LbU+hwYl6gsFH/mFDqVxJ3+DKQi
- vyf1NatzEwl62foVjGUSpvh3ymtmtUQ4JUkNDsXiRBWczaiGSuzD9Qi0ONdkAX3b
- ewqmN4TfE+XIpCPxxHXwGq9Rv1IFjOdCX0iG436GHyTLC1tTUIKF5xV4Y0+cXIOI
- RgQQEQgABgUCTpdI7gAKCRDFr3dKWFELWqaPAKD1TtT5c3sZz92Fj97KYmqbNQZP
- +ACfSC6+hfvlj4GxmUjp1aepoVTo3weJAhwEEAEIAAYFAk6XSQsACgkQTFprqxLS
- p64F8Q//cCcutwrH50UoRFejg0EIZav6LUKejC6kpLeubbEtuaIH3r2zMblPGc4i
- +eMQKo/PqyQrceRXeNNlqO6/exHozYi2meudxa6IudhwJIOn1MQykJbNMSC2sGUp
- 1W5M1N5EYgt4hy+qhlfnD66LR4G+9t5FscTJSy84SdiOuqgCOpQmPkVRm1HX5X1+
- dmnzMOCk5LHHQuiacV0qeGO7JcBCVEIDr+uhU1H2u5GPFNHm5u15n25tOxVivb94
- xg6NDjouECBH7cCVuW79YcExH/0X3/9G45rjdHlKPH1OIUJiiX47OTxdG3dAbB4Q
- fnViRJhjehFscFvYWSqXo3pgWqUsEvv9qJac2ZEMSz9x2mj0ekWxuM6/hGWxJdB+
- +985rIelPmc7VRAXOjIxWknrXnPCZAMlPlDLu6+vZ5BhFX0Be3y38f7GNCxFkJzl
- hWZ4Cj3WojMj+0DaC1eKTj3rJ7OJlt9S9xnO7OOPEUTGyzgNIDAyCiu8F4huLPaT
- ape6RupxOMHZeoCVlqx3ouWctelB2oNXcxxiQ/8y+21aHfD4n/CiIFwDvIQjl7dg
- mT3u5Lr6yxuosR3QJx1P6rP5ZrDTP9khT30t+HZCbvs5Pq+v/9m6XDmi+NlU7Zuh
- Ehy97tL3uBDgoL4b/5BpFL5U9nruPlQzGq1P9jj40dxAaDAX/WKJAj0EEwEIACcC
- GwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlB5KywFCQPDFt8ACgkQf8x9RqzM
- TPhuCQ//QAjRSAOCQ02qmUAikT+mTB6baOAakkYq6uHbEO7qPZkv4E/M+HPIJ4wd
- nBNeSQjfvdNcZBA/x0hr5EMcBneKKPDj4hJ0panOIRQmNSTThQw9OU351gm3YQct
- AMPRUu1fTJAL/AuZUQf9ESmhyVtWNlH/56HBfYjE4iVeaRkkNLJyX3vkWdJSMwC/
- LO3Lw/0M3R8itDsm74F8w4xOdSQ52nSRFRh7PunFtREl+QzQ3EA/WB4AIj3VohIG
- kWDfPFCzV3cyZQiEnjAe9gG5pHsXHUWQsDFZ12t784JgkGyO5wT26pzTiuApWM3k
- /9V+o3HJSgH5hn7wuTi3TelEFwP1fNzI5iUUtZdtxbFOfWMnZAypEhaLmXNkg4zD
- kH44r0ss9fR0DAgUav1a25UnbOn4PgIEQy2fgHKHwRpCy20d6oCSlmgyWsR40EPP
- YvtGq49A2aK6ibXmdvvFT+Ts8Z+q2SkFpoYFX20mR2nsF0fbt1lfH65P64dukxeR
- GteWIeNakDD40bAAOH8+OaoTGVBJ2ACJfLVNM53PEoftavAwUYMrR910qvwYfd/4
- 6rh46g1Frr9SFMKYE9uvIJIgDsQB3QBp71houU4H55M5GD8XURYs+bfiQpJG1p7e
- B8e5jZx1SagNWc4XwL2FzQ9svrkbg1Y+359buUiP7T6QXX2zY++JAj0EEwEIACcC
- GwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlEqbZUFCQg2wEEACgkQf8x9RqzM
- TPhFMQ//WxAfKMdpSIA9oIC/yPD/dJpY/+DyouOljpE6MucMy/ArBECjFTBwi/j9
- NYM4ynAk34IkhuNexc1i9/05f5RM6+riLCLgAOsADDbHD4miZzoSxiVr6GQ3YXMb
- OGld9kV9Sy6mGNjcUov7iFcf5Hy5w3AjPfKuR9zXswyfzIU1YXObiiZT38l55pp/
- BSgvGVQsvbNjsff5CbEKXS7q3xW+WzN0QWF6YsfNVhFjRGj8hKtHvwKcA02wwjLe
- LXVTm6915ZUKhZXUFc0vM4Pj4EgNswH8Ojw9AJaKWJIZmLyW+aP+wpu6YwVCicxB
- Y59CzBO2pPJDfKFQzUtrErk9irXeuCCLesDyirxJhv8o0JAvmnMAKOLhNFUrSQ2m
- +3EnF7zhfz70gHW+EG8X8mL/EN3/dUM09j6TVrjtw43RLxBzwMDeariFF9yC+5bL
- tnGgxjsB9Ik6GV5v34/NEEGf1qBiAzFmDVFRZlrNDkq6gmpvGnA5hUWNr+y0i01L
- jGyaLSWHYjgw2UEQOqcUtTFK9MNzbZze4mVaHMEz9/aMfX25R6qbiNqCChveIm8m
- Yr5Ds2zdZx+G5bAKdzX7nx2IUAxFQJEE94VLSp3npAaTWv3sHr7dR8tSyUJ9poDw
- gw4W9BIcnAM7zvFYbLF5FNggg/26njHCCN70sHt8zGxKQINMc6SJAj0EEwEIACcC
- GwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlLpFRkFCQ6EJy0ACgkQf8x9RqzM
- TPjOZA//Zp0e25pcvle7cLc0YuFr9pBv2JIkLzPm83nkcwKmxaWayUIG4Sv6pH6h
- m8+S/CHQij/yFCX+o3ngMw2J9HBUvafZ4bnbI0RGJ70GsAwraQ0VlkIfg7GUw3Tz
- voGYO42rZTru9S0K/6nFP6D1HUu+U+AsJONLeb6oypQgInfXQExPZyliUnHdipei
- 4WR1YFW6sjSkZT/5C3J1wkAvPl5lvOVthI9Zs6bZlJLZwusKxU0UM4Btgu1Sf3nn
- JcHmzisixwS9PMHE+AgPWIGSec/N27a0KmTTvImV6K6nEjXJey0K2+EYJuIBsYUN
- orOGBwDFIhfRk9qGlpgt0KRyguV+AP5qvgry95IrYtrOuE7307SidEbSnvO5ezNe
- mE7gT9Z1tM7IMPfmoKph4BfpNoH7aXiQh1Wo+ChdP92hZUtQrY2Nm13cmkxYjQ4Z
- gMWfYMC+DA/GooSgZM5i6hYqyyfAuUD9kwRN6BqTbuAUAp+hCWYeN4D88sLYpFh3
- paDYNKJ+Gf7Yyi6gThcV956RUFDH3ys5Dk0vDL9NiWwdebWfRFbzoRM3dyGP889a
- OyLzS3mh6nHzZrNGhW73kslSQek8tjKrB+56hXOnb4HaElTZGDvD5wmrrhN94kby
- Gtz3cydIohvNO9d90+29h0eGEDYti7j7maHkBKUAwlcPvMg5m3Y=
- =DA1T
- -----END PGP PUBLIC KEY BLOCK-----
-
-
- - name: Postgres repo
- apt_repository:
- repo: deb http://apt.postgresql.org/pub/repos/apt bullseye-pgdg main
- filename: postgres
-
- - name: Postgres
- apt:
- pkg:
- - postgresql-client-12
- - libpq-dev
- default_release: bullseye-pgdg
-
-
- - name: Frag dir
- file:
- state: directory
- path: /var/frag
- owner: root
- group: systemd-journal
- mode: 02755
-
- - name: frag checkout exits?
- stat:
- path: /var/frag/frag/_darcs
- register: frag_chekout
-
- - name: Checkout frag
- command:
- chdir: /var/frag
- cmd: darcs get https://paradise.fi.muni.cz/~xstill/src/frag/
- when: not frag_chekout.stat.exists
-
- - name: Update frag darcs
- command:
- chdir: /var/frag/frag
- cmd: 'darcs pull -a'
-
- - name: "Gib config for frag"
- copy:
- src: frag/gib.local
- dest: /var/frag/frag/gib/local
-
- - name: Update frag build
- command:
- chdir: /var/frag/frag
- cmd: make
-
- - name: Builder user
- user:
- name: builder
- create_home: True
- shell: /bin/bash
- system: True
-
- - name: GHC requisites
- apt:
- pkg:
- - libtinfo-dev
- - libtinfo5
- - libgmp-dev
- - libgmp10
-
- - name: GHC target dir
- file:
- state: directory
- path: '{{ghc_prefix}}'
-
- - name: GHC installed?
- stat:
- path: '/opt/ghc/{{ghc_version}}/bin/ghc'
- register: ghc_bin
-
- - block:
- - name: GHC bootstrap directory
- file:
- state: directory
- path: /home/builder/ghc-bootstrap
-
- - name: Download GHC bootstrap
- get_url:
- url: 'https://downloads.haskell.org/~ghc/{{ghc_version_bootstrap}}/ghc-{{ghc_version_bootstrap}}-x86_64-deb9-linux.tar.xz'
- dest: /home/builder/ghc-bootstrap/ghc.tar.xz
-
- - name: Extract GHC bootstrap
- unarchive:
- src: /home/builder/ghc-bootstrap/ghc.tar.xz
- dest: /home/builder/ghc-bootstrap/
- remote_src: True
-
- - name: Build GHC bootstrap
- shell:
- chdir: '/home/builder/ghc-bootstrap/ghc-{{ghc_version_bootstrap}}'
- cmd: '{{item}}'
- loop:
- - './configure --prefix=/home/builder/ghc-bootstrap'
- - make install -j8
-
- - name: Download GHC
- get_url:
- url: 'https://downloads.haskell.org/~ghc/{{ghc_version}}/ghc-{{ghc_version}}-src.tar.xz'
- dest: /home/builder/ghc.tar.xz
-
- - name: Extract GHC
- unarchive:
- src: /home/builder/ghc.tar.xz
- dest: /home/builder/
- remote_src: True
-
- - name: Build GHC
- shell:
- chdir: '/home/builder/ghc-{{ghc_version}}'
- cmd: 'env LANG=en_US.UTF-8 PATH=/home/builder/ghc-bootstrap/bin:$PATH {{item}}'
- loop:
- - ./boot
- - './configure --prefix={{ghc_prefix}} --disable-large-address-space --with-system-libffi --with-ffi-includes=$(pkg-config --variable=includedir libffi)'
- - make -j8
-
- become_user: builder
- become: true
- when: not ghc_bin.stat.exists
-
- - name: Install ghc
- shell:
- chdir: '/home/builder/ghc-{{ghc_version}}'
- cmd: 'env LANG=en_US.UTF-8 {{item}}'
- loop:
- - make install
- when: not ghc_bin.stat.exists
-
- - name: Symlink GHC to /usr/local/bin
- file:
- src: '/opt/ghc/{{ghc_version}}/bin/{{item}}'
- dest: '/usr/local/bin/{{item}}'
- state: link
- loop:
- - 'ghc'
- - 'ghc-{{ghc_version}}'
- - 'ghc-pkg'
- - 'ghc-pkg-{{ghc_version}}'
- - 'ghci'
- - 'ghci-{{ghc_version}}'
- - 'haddock'
- - 'haddock-ghc-{{ghc_version}}'
- - 'hp2ps'
- - 'hpc'
- - 'hsc2hs'
- - 'runghc'
- - 'runghc-{{ghc_version}}'
- - 'runhaskell'
-
- - name: IB015 eval users
- user:
- name: 'ib015_eval_{{item}}'
- create_home: True
- home: '/var/frag/ib015_eval_{{item}}/'
- shell: /bin/bash
- system: True
- loop: '{{range(ib015_workers)}}'
-
- - name: IB015 evals' env
- copy:
- content: |
- FRAG_SUBJECT=ib015
- FRAG_HOST=frag-db.fi.muni.cz
- dest: '/var/frag/ib015_eval_{{item}}/env'
- loop: '{{range(ib015_workers)}}'
-
- - name: IB015 evals' progs
- copy:
- src: '/var/frag/frag/_build/eval-{{item[1]}}'
- dest: '/var/frag/ib015_eval_{{item[0]}}/{{item[1]}}'
- remote_src: True
- mode: 0555
- loop: '{{range(ib015_workers) | product(frag_eval_tools) | list}}'
- register: ib015_ev_progs
-
- - name: IB015 eval deamons
- copy:
- src: '/var/frag/frag/_build/frag-eval'
- dest: '/var/frag/ib015_eval_{{item}}/'
- remote_src: true
- mode: 0555
- loop: '{{range(ib015_workers)}}'
- register: ib015_eval
-
- - name: Eval service
- get_url:
- url: https://gitlab.fi.muni.cz/xstill/frag-utils/-/raw/master/systemd/frag-eval@.service
- dest: /etc/systemd/system/frag-eval@.service
- register: eval_service
-
- - name: Enable IB015 evals
- systemd:
- name: 'frag-eval@ib015_eval_{{item}}'
- enabled: true
- state: '{{"re" if ib015_eval.changed or ib015_ev_progs.changed else ""}}started'
- daemon_reload: '{{eval_service.changed}}'
- loop: '{{range(ib015_workers)}}'
-
- - name: Add cabal
- unarchive:
- src: "https://downloads.haskell.org/~cabal/cabal-install-{{cabal_version}}/cabal-install-{{cabal_version}}-x86_64-linux-deb10.tar.xz"
- dest: "{{cabal_dir}}"
- remote_src: true
-
- - name: .cabal exits?
- stat:
- path: '/var/frag/ib015_eval_{{item}}/.cabal'
- loop: '{{range(ib015_workers)}}'
- register: dot_cabal_ib015
-
- - name: Cabal update
- command: "{{cabal_dir}}/cabal v2-update"
- become: True
- become_user: 'ib015_eval_{{item}}'
-# when: not dot_cabal_ib015.results[item].stat.exists
- when: false
- loop: '{{range(ib015_workers)}}'
-
- - name: Create empty GHC env file
- copy:
- content: ""
- dest: '/tmp/env.ib015.{{item}}'
- owner: 'ib015_eval_{{item}}'
- loop: '{{range(ib015_workers)}}'
-
-
- - name: Hackage modules
- command: "{{cabal_dir}}/cabal v2-install --lib --package-env=/tmp/env.ib015.{{item}} QuickCheck lens HUnit graph-wrapper data-default-class mtl exceptions-0.10.4"
- become: True
- become_user: 'ib015_eval_{{item}}'
- loop: '{{range(ib015_workers)}}'
-
- - name: hsExprTest checkout
- git:
- dest: '/var/frag/ib015_eval_{{item}}/hsExprTest'
- repo: https://github.com/vlstill/hsExprTest.git
- update: True
- become: True
- become_user: 'ib015_eval_{{item}}'
- loop: '{{range(ib015_workers)}}'
-
- - name: Install hsExprTest
- command:
- chdir: '/var/frag/ib015_eval_{{item}}/hsExprTest/'
- cmd: "{{cabal_dir}}/cabal v2-install --lib --package-env=/tmp/env.ib015.{{item}} "
- become: True
- become_user: 'ib015_eval_{{item}}'
- loop: '{{range(ib015_workers)}}'
-
- - name: Create GHC environment dir
- file:
- state: directory
- path: "~/.local/share/ghc/x86_64-linux-{{ghc_version}}/environments"
- become: True
- become_user: 'ib015_eval_{{item}}'
- loop: '{{range(ib015_workers)}}'
-
- - name: Deploy modified GHC environment
- command: "mv /tmp/env.ib015.{{item}} ~/.local/share/ghc/x86_64-linux-{{ghc_version}}/environments/default"
- become: True
- become_user: 'ib015_eval_{{item}}'
- loop: '{{range(ib015_workers)}}'
-
- # TODO: deduplicate
- - name: IB016 evals' progs
- copy:
- src: '/var/frag/frag/_build/eval-{{item[1]}}'
- dest: '/var/frag/ib016_eval_{{item[0]}}/{{item[1]}}'
- remote_src: true
- mode: 0555
- loop: '{{range(ib016_workers) | product(frag_eval_tools) | list}}'
- register: ib016_ev_progs
-
- - name: IB016 eval deamons
- copy:
- src: '/var/frag/frag/_build/frag-eval'
- dest: '/var/frag/ib016_eval_{{item}}/'
- remote_src: true
- mode: 0555
- loop: '{{range(ib016_workers)}}'
- register: ib016_eval
-
- - name: Enable IB016 evals
- systemd:
- name: 'frag-eval@ib016_eval_{{item}}'
- enabled: true
- state: '{{"re" if ib016_eval.changed or ib016_ev_progs.changed else ""}}started'
- daemon_reload: '{{eval_service.changed}}'
- loop: '{{range(ib016_workers)}}'
-
- - name: .cabal exits?
- stat:
- path: '/var/frag/ib016_eval_{{item}}/.cabal'
- loop: '{{range(ib016_workers)}}'
- register: dot_cabal_ib016
-
- - name: Cabal update
- command: "{{cabal_dir}}/cabal v2-update"
- become: True
- become_user: 'ib016_eval_{{item}}'
- # when: not dot_cabal_ib016.results[item].stat.exists
- loop: '{{range(ib016_workers)}}'
-
- - name: Remove stale GHC environments
- file:
- path: "/tmp/env.ib016.{{item}}"
- state: absent
- loop: '{{range(ib016_workers)}}'
-
- - name: Remove GHC environemnt from ~/.ghc
- file:
- path: "~/.ghc/x86_64-linux-9.2.1/environments/default"
- state: absent
- become: true
- become_user: 'ib016_eval_{{item}}'
- loop: '{{range(ib016_workers)}}'
-
- - name: Hackage modules
- command: "{{cabal_dir}}/cabal v2-install --lib --package-env=/tmp/env.ib016.{{item}} QuickCheck lens mtl exceptions base-unicode-symbols data-default-class HUnit"
- become: True
- become_user: 'ib016_eval_{{item}}'
- loop: '{{range(ib016_workers)}}'
-
- - name: Install parsec last, it is broken somehow otherwise
- command: "{{cabal_dir}}/cabal v2-install --lib --package-env=/tmp/env.ib016.{{item}} parsec"
- become: True
- become_user: 'ib016_eval_{{item}}'
- loop: '{{range(ib016_workers)}}'
-
- - name: hsExprTest checkout
- git:
- dest: '/var/frag/ib016_eval_{{item}}/hsExprTest'
- repo: https://github.com/vlstill/hsExprTest.git
- update: True
- become: True
- become_user: 'ib016_eval_{{item}}'
- loop: '{{range(ib016_workers)}}'
-
- - name: Install hsExprTest
- command:
- chdir: '/var/frag/ib016_eval_{{item}}/hsExprTest/'
- cmd: "{{cabal_dir}}/cabal v2-install --lib --package-env=/tmp/env.ib016.{{item}}"
- become: True
- become_user: 'ib016_eval_{{item}}'
- loop: '{{range(ib016_workers)}}'
-
- - name: Create GHC environment dir
- file:
- state: directory
- path: "~/.local/share/ghc/x86_64-linux-{{ghc_version}}/environments"
- become: True
- become_user: 'ib016_eval_{{item}}'
- loop: '{{range(ib016_workers)}}'
-
- - name: Deploy modified GHC environment
- command: "mv /tmp/env.ib016.{{item}} ~/.local/share/ghc/x86_64-linux-{{ghc_version}}/environments/default"
- become: True
- become_user: 'ib016_eval_{{item}}'
- loop: '{{range(ib016_workers)}}'
-
- - name: Enable user namespaces
- sysctl:
- name: kernel.unprivileged_userns_clone
- value: "1"
- state: present
- reload: yes
-
- tags:
- - deploy
-
-# vim: shiftwidth=2 tabstop=2 softtabstop=2 ft=yaml.ansible
diff --git a/ansible/eval-pv264.fi.muni.cz.yml b/ansible/eval-pv264.fi.muni.cz.yml
deleted file mode 100644
index 7ad95aa4f44f01953ecfef4c5a49994c8d7e23ce..0000000000000000000000000000000000000000
--- a/ansible/eval-pv264.fi.muni.cz.yml
+++ /dev/null
@@ -1,235 +0,0 @@
-# TODO: delete /etc/one-context.d/loc-05-grow-rootfs
-
-- name: eval-pv264
- hosts: eval-pv264.fi.muni.cz
- vars:
- dhcpcd: false
- postfix: true
- frag_workers:
- pv264: 2
- pb173llvm: 2
- frag_eval_tools:
- - auto
- - cc
- - group
- - sandbox
- - sub
- llvm11_state: present
-
- tasks:
- - import_role:
- name: runner_install
- tags:
- - install
-
- - block:
- - import_role:
- name: common_deb
-
- - import_role:
- name: llvm_deb
-
- - name: Install frag requisites
- apt:
- pkg:
- - darcs
- - clang
- - libcurl4-gnutls-dev
- - libexpat1-dev
- - libldap2-dev
- - libacl1-dev
- - libcap-dev
-
- - name: Postgres key
- apt_key:
- data: |
- -----BEGIN PGP PUBLIC KEY BLOCK-----
-
- mQINBE6XR8IBEACVdDKT2HEH1IyHzXkb4nIWAY7echjRxo7MTcj4vbXAyBKOfjja
- UrBEJWHN6fjKJXOYWXHLIYg0hOGeW9qcSiaa1/rYIbOzjfGfhE4x0Y+NJHS1db0V
- G6GUj3qXaeyqIJGS2z7m0Thy4Lgr/LpZlZ78Nf1fliSzBlMo1sV7PpP/7zUO+aA4
- bKa8Rio3weMXQOZgclzgeSdqtwKnyKTQdXY5MkH1QXyFIk1nTfWwyqpJjHlgtwMi
- c2cxjqG5nnV9rIYlTTjYG6RBglq0SmzF/raBnF4Lwjxq4qRqvRllBXdFu5+2pMfC
- IZ10HPRdqDCTN60DUix+BTzBUT30NzaLhZbOMT5RvQtvTVgWpeIn20i2NrPWNCUh
- hj490dKDLpK/v+A5/i8zPvN4c6MkDHi1FZfaoz3863dylUBR3Ip26oM0hHXf4/2U
- A/oA4pCl2W0hc4aNtozjKHkVjRx5Q8/hVYu+39csFWxo6YSB/KgIEw+0W8DiTII3
- RQj/OlD68ZDmGLyQPiJvaEtY9fDrcSpI0Esm0i4sjkNbuuh0Cvwwwqo5EF1zfkVj
- Tqz2REYQGMJGc5LUbIpk5sMHo1HWV038TWxlDRwtOdzw08zQA6BeWe9FOokRPeR2
- AqhyaJJwOZJodKZ76S+LDwFkTLzEKnYPCzkoRwLrEdNt1M7wQBThnC5z6wARAQAB
- tBxQb3N0Z3JlU1FMIERlYmlhbiBSZXBvc2l0b3J5iQJOBBMBCAA4AhsDBQsJCAcD
- BRUKCQgLBRYCAwEAAh4BAheAFiEEuXsK/KoaR/BE8kSgf8x9RqzMTPgFAlhtCD8A
- CgkQf8x9RqzMTPgECxAAk8uL+dwveTv6eH21tIHcltt8U3Ofajdo+D/ayO53LiYO
- xi27kdHD0zvFMUWXLGxQtWyeqqDRvDagfWglHucIcaLxoxNwL8+e+9hVFIEskQAY
- kVToBCKMXTQDLarz8/J030Pmcv3ihbwB+jhnykMuyyNmht4kq0CNgnlcMCdVz0d3
- z/09puryIHJrD+A8y3TD4RM74snQuwc9u5bsckvRtRJKbP3GX5JaFZAqUyZNRJRJ
- Tn2OQRBhCpxhlZ2afkAPFIq2aVnEt/Ie6tmeRCzsW3lOxEH2K7MQSfSu/kRz7ELf
- Cz3NJHj7rMzC+76Rhsas60t9CjmvMuGONEpctijDWONLCuch3Pdj6XpC+MVxpgBy
- 2VUdkunb48YhXNW0jgFGM/BFRj+dMQOUbY8PjJjsmVV0joDruWATQG/M4C7O8iU0
- B7o6yVv4m8LDEN9CiR6r7H17m4xZseT3f+0QpMe7iQjz6XxTUFRQxXqzmNnloA1T
- 7VjwPqIIzkj/u0V8nICG/ktLzp1OsCFatWXh7LbU+hwYl6gsFH/mFDqVxJ3+DKQi
- vyf1NatzEwl62foVjGUSpvh3ymtmtUQ4JUkNDsXiRBWczaiGSuzD9Qi0ONdkAX3b
- ewqmN4TfE+XIpCPxxHXwGq9Rv1IFjOdCX0iG436GHyTLC1tTUIKF5xV4Y0+cXIOI
- RgQQEQgABgUCTpdI7gAKCRDFr3dKWFELWqaPAKD1TtT5c3sZz92Fj97KYmqbNQZP
- +ACfSC6+hfvlj4GxmUjp1aepoVTo3weJAhwEEAEIAAYFAk6XSQsACgkQTFprqxLS
- p64F8Q//cCcutwrH50UoRFejg0EIZav6LUKejC6kpLeubbEtuaIH3r2zMblPGc4i
- +eMQKo/PqyQrceRXeNNlqO6/exHozYi2meudxa6IudhwJIOn1MQykJbNMSC2sGUp
- 1W5M1N5EYgt4hy+qhlfnD66LR4G+9t5FscTJSy84SdiOuqgCOpQmPkVRm1HX5X1+
- dmnzMOCk5LHHQuiacV0qeGO7JcBCVEIDr+uhU1H2u5GPFNHm5u15n25tOxVivb94
- xg6NDjouECBH7cCVuW79YcExH/0X3/9G45rjdHlKPH1OIUJiiX47OTxdG3dAbB4Q
- fnViRJhjehFscFvYWSqXo3pgWqUsEvv9qJac2ZEMSz9x2mj0ekWxuM6/hGWxJdB+
- +985rIelPmc7VRAXOjIxWknrXnPCZAMlPlDLu6+vZ5BhFX0Be3y38f7GNCxFkJzl
- hWZ4Cj3WojMj+0DaC1eKTj3rJ7OJlt9S9xnO7OOPEUTGyzgNIDAyCiu8F4huLPaT
- ape6RupxOMHZeoCVlqx3ouWctelB2oNXcxxiQ/8y+21aHfD4n/CiIFwDvIQjl7dg
- mT3u5Lr6yxuosR3QJx1P6rP5ZrDTP9khT30t+HZCbvs5Pq+v/9m6XDmi+NlU7Zuh
- Ehy97tL3uBDgoL4b/5BpFL5U9nruPlQzGq1P9jj40dxAaDAX/WKJAj0EEwEIACcC
- GwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlB5KywFCQPDFt8ACgkQf8x9RqzM
- TPhuCQ//QAjRSAOCQ02qmUAikT+mTB6baOAakkYq6uHbEO7qPZkv4E/M+HPIJ4wd
- nBNeSQjfvdNcZBA/x0hr5EMcBneKKPDj4hJ0panOIRQmNSTThQw9OU351gm3YQct
- AMPRUu1fTJAL/AuZUQf9ESmhyVtWNlH/56HBfYjE4iVeaRkkNLJyX3vkWdJSMwC/
- LO3Lw/0M3R8itDsm74F8w4xOdSQ52nSRFRh7PunFtREl+QzQ3EA/WB4AIj3VohIG
- kWDfPFCzV3cyZQiEnjAe9gG5pHsXHUWQsDFZ12t784JgkGyO5wT26pzTiuApWM3k
- /9V+o3HJSgH5hn7wuTi3TelEFwP1fNzI5iUUtZdtxbFOfWMnZAypEhaLmXNkg4zD
- kH44r0ss9fR0DAgUav1a25UnbOn4PgIEQy2fgHKHwRpCy20d6oCSlmgyWsR40EPP
- YvtGq49A2aK6ibXmdvvFT+Ts8Z+q2SkFpoYFX20mR2nsF0fbt1lfH65P64dukxeR
- GteWIeNakDD40bAAOH8+OaoTGVBJ2ACJfLVNM53PEoftavAwUYMrR910qvwYfd/4
- 6rh46g1Frr9SFMKYE9uvIJIgDsQB3QBp71houU4H55M5GD8XURYs+bfiQpJG1p7e
- B8e5jZx1SagNWc4XwL2FzQ9svrkbg1Y+359buUiP7T6QXX2zY++JAj0EEwEIACcC
- GwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlEqbZUFCQg2wEEACgkQf8x9RqzM
- TPhFMQ//WxAfKMdpSIA9oIC/yPD/dJpY/+DyouOljpE6MucMy/ArBECjFTBwi/j9
- NYM4ynAk34IkhuNexc1i9/05f5RM6+riLCLgAOsADDbHD4miZzoSxiVr6GQ3YXMb
- OGld9kV9Sy6mGNjcUov7iFcf5Hy5w3AjPfKuR9zXswyfzIU1YXObiiZT38l55pp/
- BSgvGVQsvbNjsff5CbEKXS7q3xW+WzN0QWF6YsfNVhFjRGj8hKtHvwKcA02wwjLe
- LXVTm6915ZUKhZXUFc0vM4Pj4EgNswH8Ojw9AJaKWJIZmLyW+aP+wpu6YwVCicxB
- Y59CzBO2pPJDfKFQzUtrErk9irXeuCCLesDyirxJhv8o0JAvmnMAKOLhNFUrSQ2m
- +3EnF7zhfz70gHW+EG8X8mL/EN3/dUM09j6TVrjtw43RLxBzwMDeariFF9yC+5bL
- tnGgxjsB9Ik6GV5v34/NEEGf1qBiAzFmDVFRZlrNDkq6gmpvGnA5hUWNr+y0i01L
- jGyaLSWHYjgw2UEQOqcUtTFK9MNzbZze4mVaHMEz9/aMfX25R6qbiNqCChveIm8m
- Yr5Ds2zdZx+G5bAKdzX7nx2IUAxFQJEE94VLSp3npAaTWv3sHr7dR8tSyUJ9poDw
- gw4W9BIcnAM7zvFYbLF5FNggg/26njHCCN70sHt8zGxKQINMc6SJAj0EEwEIACcC
- GwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AFAlLpFRkFCQ6EJy0ACgkQf8x9RqzM
- TPjOZA//Zp0e25pcvle7cLc0YuFr9pBv2JIkLzPm83nkcwKmxaWayUIG4Sv6pH6h
- m8+S/CHQij/yFCX+o3ngMw2J9HBUvafZ4bnbI0RGJ70GsAwraQ0VlkIfg7GUw3Tz
- voGYO42rZTru9S0K/6nFP6D1HUu+U+AsJONLeb6oypQgInfXQExPZyliUnHdipei
- 4WR1YFW6sjSkZT/5C3J1wkAvPl5lvOVthI9Zs6bZlJLZwusKxU0UM4Btgu1Sf3nn
- JcHmzisixwS9PMHE+AgPWIGSec/N27a0KmTTvImV6K6nEjXJey0K2+EYJuIBsYUN
- orOGBwDFIhfRk9qGlpgt0KRyguV+AP5qvgry95IrYtrOuE7307SidEbSnvO5ezNe
- mE7gT9Z1tM7IMPfmoKph4BfpNoH7aXiQh1Wo+ChdP92hZUtQrY2Nm13cmkxYjQ4Z
- gMWfYMC+DA/GooSgZM5i6hYqyyfAuUD9kwRN6BqTbuAUAp+hCWYeN4D88sLYpFh3
- paDYNKJ+Gf7Yyi6gThcV956RUFDH3ys5Dk0vDL9NiWwdebWfRFbzoRM3dyGP889a
- OyLzS3mh6nHzZrNGhW73kslSQek8tjKrB+56hXOnb4HaElTZGDvD5wmrrhN94kby
- Gtz3cydIohvNO9d90+29h0eGEDYti7j7maHkBKUAwlcPvMg5m3Y=
- =DA1T
- -----END PGP PUBLIC KEY BLOCK-----
-
-
- - name: Postgres repo
- apt_repository:
- repo: deb http://apt.postgresql.org/pub/repos/apt bullseye-pgdg main
- filename: postgres
-
- - name: Postgres
- apt:
- pkg:
- - postgresql-client-12
- - libpq-dev
- default_release: bullseye-pgdg
-
- - name: Frag prereqs
- apt:
- pkg:
- - libunistring-dev
-
-
- - name: Frag dir
- file:
- state: directory
- path: /var/frag
- owner: root
- group: systemd-journal
- mode: 02755
-
- - name: frag checkout exits?
- stat:
- path: /var/frag/frag/_darcs
- register: frag_chekout
-
- - name: Checkout frag
- command:
- chdir: /var/frag
- cmd: darcs get https://paradise.fi.muni.cz/~xstill/src/frag/
- when: not frag_chekout.stat.exists
-
- - name: Update frag
- command:
- chdir: /var/frag/frag
- cmd: '{{item}}'
- loop:
- - darcs pull -a
- - env CXX=clang++-12 PWD=/var/frag/frag make
-# - /var/frag/frag/frag-teacher init --subject ib015 --daemon eval --eval-count 8
-
- - name: Builder user
- user:
- name: builder
- create_home: True
- shell: /bin/bash
- system: True
-
-# - name: Frag eval users
-# user:
-# name: 'ib015_eval_{{item}}'
-# create_home: True
-# home: '/var/frag/ib015_eval_{{item}}/'
-# shell: /bin/bash
-# system: True
-# loop: '{{range(frag_workers)}}'
-#
-# - name: IB015 evals' env
-# copy:
-# content: |
-# FRAG_SUBJECT=ib015
-# FRAG_HOST=frag-db.fi.muni.cz
-# dest: '/var/frag/ib015_eval_{{item}}/env'
-# loop: '{{range(ib015_workers)}}'
-#
-# - name: IB015 evals' progs
-# copy:
-# src: '/var/frag/frag/eval-{{item[1]}}'
-# dest: '/var/frag/ib015_eval_{{item[0]}}/{{item[1]}}'
-# remote_src: True
-# mode: 0555
-# loop: '{{range(workers_workers) | product(frag_eval_tools) | list}}'
-#
-# - name: IB015 eval deamons
-# copy:
-# src: '/var/frag/frag/frag-eval'
-# dest: '/var/frag/ib015_eval_{{item}}/'
-# remote_src: True
-# mode: 0555
-# loop: '{{range(ib015_workers)}}'
-#
-# - name: Eval service
-# get_url:
-# url: https://gitlab.fi.muni.cz/xstill/frag-utils/-/raw/master/systemd/frag-eval@.service
-# dest: /etc/systemd/system/frag-eval@.service
-# register: eval_service
-#
-# - name: Enable evals
-# systemd:
-# name: 'frag-eval@ib015_eval_{{item}}'
-# enabled: True
-# daemon_reload: '{{eval_service.changed}}'
-# loop: '{{range(ib015_workers)}}'
-
-
- - name: Enable user namespaces
- sysctl:
- name: kernel.unprivileged_userns_clone
- value: "1"
- state: present
- reload: yes
-
- tags:
- - deploy
-
-# vim: shiftwidth=2 tabstop=2 softtabstop=2 ft=yaml.ansible
diff --git a/ansible/files/dhcpcd-ipv6-netbox-hook b/ansible/files/dhcpcd-ipv6-netbox-hook
deleted file mode 100644
index b51578f52e41b6de92e1db4ca08996a0378c1515..0000000000000000000000000000000000000000
--- a/ansible/files/dhcpcd-ipv6-netbox-hook
+++ /dev/null
@@ -1,13 +0,0 @@
-# WARNING: This file is automatically managed by ansible, any changes in it will be discarded on configuration reload
-if [ $reason = "PREINIT" ]; then
- if ! ip tunnel | grep -F netbox6; then
- ip tunnel add netbox6 mode sit local 95.82.181.136 remote 46.39.165.39 ttl 64
- ip link set mtu 1280 dev netbox6
- ip link set up dev netbox6
- fi
-fi
-set -x
-if [ $reason = "STATIC6" ]; then
- ip route add ::/0 dev netbox6
-fi
-# vim: ft=sh
diff --git a/ansible/files/dhcpd4@.service b/ansible/files/dhcpd4@.service
deleted file mode 100644
index dd7b2603f3578d04435e8e738aa37034ee610a7e..0000000000000000000000000000000000000000
--- a/ansible/files/dhcpd4@.service
+++ /dev/null
@@ -1,26 +0,0 @@
-[Unit]
-Description=IPv4 DHCP server (single interface)
-After=network.target network-online.target
-Wants=network-online.target
-Wants=dhcpcd.target
-After=dhcpcd.target
-
-[Service]
-Type=forking
-ExecStart=/usr/sbin/dhcpd -4 -q -cf /etc/dhcp/dhcpd.conf -pf /run/dhcpd4/dhcpd.pid %I
-RuntimeDirectory=dhcpd4
-PIDFile=/run/dhcpd4/dhcpd.pid
-User=dhcp
-AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
-ProtectSystem=full
-ProtectHome=on
-KillSignal=SIGINT
-# We pull in network-online.target for a configured network connection.
-# However this is not guaranteed to be the network connection our
-# networks are configured for. So try to restart on failure with a delay
-# of two seconds.
-RestartSec=2s
-Restart=on-failure
-
-[Install]
-WantedBy=multi-user.target
diff --git a/ansible/files/dhcpd6@.service b/ansible/files/dhcpd6@.service
deleted file mode 100644
index f7e3680afe03391484f42091251da526b0a0faa1..0000000000000000000000000000000000000000
--- a/ansible/files/dhcpd6@.service
+++ /dev/null
@@ -1,26 +0,0 @@
-[Unit]
-Description=IPv6 DHCP server (single interface)
-After=network.target network-online.target
-Wants=network-online.target
-Wants=dhcpcd.target
-After=dhcpcd.target
-
-[Service]
-Type=forking
-ExecStart=/usr/sbin/dhcpd -6 -q -cf /etc/dhcp/dhcpd6.conf -pf /run/dhcpd6/dhcpd.pid %I
-RuntimeDirectory=dhcpd6
-PIDFile=/run/dhcpd6/dhcpd.pid
-User=dhcp
-AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
-ProtectSystem=full
-ProtectHome=on
-KillSignal=SIGINT
-# We pull in network-online.target for a configured network connection.
-# However this is not guaranteed to be the network connection our
-# networks are configured for. So try to restart on failure with a delay
-# of two seconds.
-RestartSec=2s
-Restart=on-failure
-
-[Install]
-WantedBy=multi-user.target
diff --git a/ansible/files/dis-fi.service b/ansible/files/dis-fi.service
deleted file mode 100644
index f7f075cdd75bf771e3c679adc47c0c9fb7e6f8b0..0000000000000000000000000000000000000000
--- a/ansible/files/dis-fi.service
+++ /dev/null
@@ -1,28 +0,0 @@
-[Unit]
-Description=Discord IB015 IRC Bridge
-After=network.target remote-fs.target
-
-[Service]
-Type=simple
-WorkingDirectory=/srv/crs/dis-fi/
-ExecStart=/usr/local/bin/discord-irc --config /srv/crs/dis-fi/config.json
-User=dis-fi
-Group=dis-fi
-Restart=always
-RestartSec=2
-TimeoutStopSec=300
-
-CPUAccounting=true
-MemoryAccounting=true
-Nice=10
-# quota for one CPU
-CPUQuota=30%
-MemoryHigh=800M
-MemoryMax=1G
-
-[Unit]
-StartLimitBurst=0
-StartLimitIntervalSec=0
-
-[Install]
-WantedBy=default.target
diff --git a/ansible/files/fjaweb.service b/ansible/files/fjaweb.service
deleted file mode 100644
index 66f45b26a59c7f38b967ab9dbb4b8c2b8006b5ee..0000000000000000000000000000000000000000
--- a/ansible/files/fjaweb.service
+++ /dev/null
@@ -1,27 +0,0 @@
-[Unit]
-Description=FJA web frontend
-
-[Service]
-Type=simple
-WorkingDirectory=/home/fja/eval
-Environment=PYTHONPATH=/home/fja/eval
-ExecStart=/usr/bin/uwsgi -s /run/uwsgi/fjaweb.socket \
- --manage-script-name --plugin python3 \
- --mount '/=evalweb:create_app()'
-User=fja
-Group=www-data
-Restart=always
-RestartSec=2
-TimeoutStopSec=300
-
-CPUAccounting=true
-MemoryAccounting=true
-Nice=10
-# quota for one CPU
-CPUQuota=10%
-MemoryHigh=800M
-MemoryMax=1G
-
-[Unit]
-StartLimitBurst=0
-StartLimitIntervalSec=0
diff --git a/ansible/files/fjaweb.socket b/ansible/files/fjaweb.socket
deleted file mode 100644
index b253b26bb623053bb713971f59d67591857db7a5..0000000000000000000000000000000000000000
--- a/ansible/files/fjaweb.socket
+++ /dev/null
@@ -1,12 +0,0 @@
-[Unit]
-Description=Socket for FJA web frontend
-
-[Socket]
-ListenStream=/run/uwsgi/fjaweb.socket
-SocketUser=fja
-SocketGroup=www-data
-SocketMode=0660
-
-[Install]
-WantedBy=sockets.target
-
diff --git a/ansible/files/frag/gib.local b/ansible/files/frag/gib.local
deleted file mode 100644
index ecc00aa34c690293768b4a433a11ff2266e7b577..0000000000000000000000000000000000000000
--- a/ansible/files/frag/gib.local
+++ /dev/null
@@ -1,5 +0,0 @@
-set jobs 4
-set cxx /usr/bin/clang++
-set cc /usr/bin/clang
-add ldflags -lacl
-add cxxflags -I/usr/include/postgresql/server
diff --git a/ansible/files/gate/postfix/main.cf b/ansible/files/gate/postfix/main.cf
deleted file mode 100644
index b69316400e6255db7e3b7ff4c5b403fa846a386e..0000000000000000000000000000000000000000
--- a/ansible/files/gate/postfix/main.cf
+++ /dev/null
@@ -1,689 +0,0 @@
-# Global Postfix configuration file. This file lists only a subset
-# of all parameters. For the syntax, and for a complete parameter
-# list, see the postconf(5) manual page (command: "man 5 postconf").
-#
-# For common configuration examples, see BASIC_CONFIGURATION_README
-# and STANDARD_CONFIGURATION_README. To find these documents, use
-# the command "postconf html_directory readme_directory", or go to
-# http://www.postfix.org/BASIC_CONFIGURATION_README.html etc.
-#
-# For best results, change no more than 2-3 parameters at a time,
-# and test if Postfix still works after every change.
-
-# COMPATIBILITY
-#
-# The compatibility_level determines what default settings Postfix
-# will use for main.cf and master.cf settings. These defaults will
-# change over time.
-#
-# To avoid breaking things, Postfix will use backwards-compatible
-# default settings and log where it uses those old backwards-compatible
-# default settings, until the system administrator has determined
-# if any backwards-compatible default settings need to be made
-# permanent in main.cf or master.cf.
-#
-# When this review is complete, update the compatibility_level setting
-# below as recommended in the RELEASE_NOTES file.
-#
-# The level below is what should be used with new (not upgrade) installs.
-#
-compatibility_level = 2
-
-# SOFT BOUNCE
-#
-# The soft_bounce parameter provides a limited safety net for
-# testing. When soft_bounce is enabled, mail will remain queued that
-# would otherwise bounce. This parameter disables locally-generated
-# bounces, and prevents the SMTP server from rejecting mail permanently
-# (by changing 5xx replies into 4xx replies). However, soft_bounce
-# is no cure for address rewriting mistakes or mail routing mistakes.
-#
-#soft_bounce = no
-
-# LOCAL PATHNAME INFORMATION
-#
-# The queue_directory specifies the location of the Postfix queue.
-# This is also the root directory of Postfix daemons that run chrooted.
-# See the files in examples/chroot-setup for setting up Postfix chroot
-# environments on different UNIX systems.
-#
-#queue_directory = /var/spool/postfix
-
-# The command_directory parameter specifies the location of all
-# postXXX commands.
-#
-command_directory = /usr/sbin
-
-# The daemon_directory parameter specifies the location of all Postfix
-# daemon programs (i.e. programs listed in the master.cf file). This
-# directory must be owned by root.
-#
-daemon_directory = /usr/lib/postfix/sbin
-
-# The data_directory parameter specifies the location of Postfix-writable
-# data files (caches, random numbers). This directory must be owned
-# by the mail_owner account (see below).
-#
-data_directory = /var/lib/postfix
-
-# QUEUE AND PROCESS OWNERSHIP
-#
-# The mail_owner parameter specifies the owner of the Postfix queue
-# and of most Postfix daemon processes. Specify the name of a user
-# account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS
-# AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM. In
-# particular, don't specify nobody or daemon. PLEASE USE A DEDICATED
-# USER.
-#
-mail_owner = postfix
-
-# The default_privs parameter specifies the default rights used by
-# the local delivery agent for delivery to external file or command.
-# These rights are used in the absence of a recipient user context.
-# DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER.
-#
-default_privs = nobody
-
-# INTERNET HOST AND DOMAIN NAMES
-#
-# The myhostname parameter specifies the internet hostname of this
-# mail system. The default is to use the fully-qualified domain name
-# from gethostname(). $myhostname is used as a default value for many
-# other configuration parameters.
-#
-#myhostname = host.domain.tld
-#myhostname = virtual.domain.tld
-myhostname = krull.vstill.cz
-
-# The mydomain parameter specifies the local internet domain name.
-# The default is to use $myhostname minus the first component.
-# $mydomain is used as a default value for many other configuration
-# parameters.
-#
-mydomain = vstill.cz
-
-# SENDING MAIL
-#
-# The myorigin parameter specifies the domain that locally-posted
-# mail appears to come from. The default is to append $myhostname,
-# which is fine for small sites. If you run a domain with multiple
-# machines, you should (1) change this to $mydomain and (2) set up
-# a domain-wide alias database that aliases each user to
-# user@that.users.mailhost.
-#
-# For the sake of consistency between sender and recipient addresses,
-# myorigin also specifies the default domain name that is appended
-# to recipient addresses that have no @domain part.
-#
-#myorigin = $myhostname
-myorigin = $mydomain
-masquerade_domains = $mydomain
-
-# RECEIVING MAIL
-
-# The inet_interfaces parameter specifies the network interface
-# addresses that this mail system receives mail on. By default,
-# the software claims all active interfaces on the machine. The
-# parameter also controls delivery of mail to user@[ip.address].
-#
-# See also the proxy_interfaces parameter, for network addresses that
-# are forwarded to us via a proxy or network address translator.
-#
-# Note: you need to stop/start Postfix when this parameter changes.
-#
-#inet_interfaces = all
-#inet_interfaces = $myhostname
-#inet_interfaces = $myhostname, localhost
-
-# The proxy_interfaces parameter specifies the network interface
-# addresses that this mail system receives mail on by way of a
-# proxy or network address translation unit. This setting extends
-# the address list specified with the inet_interfaces parameter.
-#
-# You must specify your proxy/NAT addresses when your system is a
-# backup MX host for other domains, otherwise mail delivery loops
-# will happen when the primary MX host is down.
-#
-#proxy_interfaces =
-#proxy_interfaces = 1.2.3.4
-
-# The mydestination parameter specifies the list of domains that this
-# machine considers itself the final destination for.
-#
-# These domains are routed to the delivery agent specified with the
-# local_transport parameter setting. By default, that is the UNIX
-# compatible delivery agent that lookups all recipients in /etc/passwd
-# and /etc/aliases or their equivalent.
-#
-# The default is $myhostname + localhost.$mydomain + localhost. On
-# a mail domain gateway, you should also include $mydomain.
-#
-# Do not specify the names of virtual domains - those domains are
-# specified elsewhere (see VIRTUAL_README).
-#
-# Do not specify the names of domains that this machine is backup MX
-# host for. Specify those names via the relay_domains settings for
-# the SMTP server, or use permit_mx_backup if you are lazy (see
-# STANDARD_CONFIGURATION_README).
-#
-# The local machine is always the final destination for mail addressed
-# to user@[the.net.work.address] of an interface that the mail system
-# receives mail on (see the inet_interfaces parameter).
-#
-# Specify a list of host or domain names, /file/name or type:table
-# patterns, separated by commas and/or whitespace. A /file/name
-# pattern is replaced by its contents; a type:table is matched when
-# a name matches a lookup key (the right-hand side is ignored).
-# Continue long lines by starting the next line with whitespace.
-#
-# See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS".
-#
-#mydestination = $myhostname, localhost.$mydomain, localhost
-#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
-#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
-# mail.$mydomain, www.$mydomain, ftp.$mydomain
-
-# REJECTING MAIL FOR UNKNOWN LOCAL USERS
-#
-# The local_recipient_maps parameter specifies optional lookup tables
-# with all names or addresses of users that are local with respect
-# to $mydestination, $inet_interfaces or $proxy_interfaces.
-#
-# If this parameter is defined, then the SMTP server will reject
-# mail for unknown local users. This parameter is defined by default.
-#
-# To turn off local recipient checking in the SMTP server, specify
-# local_recipient_maps = (i.e. empty).
-#
-# The default setting assumes that you use the default Postfix local
-# delivery agent for local delivery. You need to update the
-# local_recipient_maps setting if:
-#
-# - You define $mydestination domain recipients in files other than
-# /etc/passwd, /etc/aliases, or the $virtual_alias_maps files.
-# For example, you define $mydestination domain recipients in
-# the $virtual_mailbox_maps files.
-#
-# - You redefine the local delivery agent in master.cf.
-#
-# - You redefine the "local_transport" setting in main.cf.
-#
-# - You use the "luser_relay", "mailbox_transport", or "fallback_transport"
-# feature of the Postfix local delivery agent (see local(8)).
-#
-# Details are described in the LOCAL_RECIPIENT_README file.
-#
-# Beware: if the Postfix SMTP server runs chrooted, you probably have
-# to access the passwd file via the proxymap service, in order to
-# overcome chroot restrictions. The alternative, having a copy of
-# the system passwd file in the chroot jail is just not practical.
-#
-# The right-hand side of the lookup tables is conveniently ignored.
-# In the left-hand side, specify a bare username, an @domain.tld
-# wild-card, or specify a user@domain.tld address.
-#
-#local_recipient_maps = unix:passwd.byname $alias_maps
-#local_recipient_maps = proxy:unix:passwd.byname $alias_maps
-local_recipient_maps =
-
-# The unknown_local_recipient_reject_code specifies the SMTP server
-# response code when a recipient domain matches $mydestination or
-# ${proxy,inet}_interfaces, while $local_recipient_maps is non-empty
-# and the recipient address or address local-part is not found.
-#
-# The default setting is 550 (reject mail) but it is safer to start
-# with 450 (try again later) until you are certain that your
-# local_recipient_maps settings are OK.
-#
-unknown_local_recipient_reject_code = 550
-
-# TRUST AND RELAY CONTROL
-
-# The mynetworks parameter specifies the list of "trusted" SMTP
-# clients that have more privileges than "strangers".
-#
-# In particular, "trusted" SMTP clients are allowed to relay mail
-# through Postfix. See the smtpd_recipient_restrictions parameter
-# in postconf(5).
-#
-# You can specify the list of "trusted" network addresses by hand
-# or you can let Postfix do it for you (which is the default).
-#
-# By default (mynetworks_style = subnet), Postfix "trusts" SMTP
-# clients in the same IP subnetworks as the local machine.
-# On Linux, this does works correctly only with interfaces specified
-# with the "ifconfig" command.
-#
-# Specify "mynetworks_style = class" when Postfix should "trust" SMTP
-# clients in the same IP class A/B/C networks as the local machine.
-# Don't do this with a dialup site - it would cause Postfix to "trust"
-# your entire provider's network. Instead, specify an explicit
-# mynetworks list by hand, as described below.
-#
-# Specify "mynetworks_style = host" when Postfix should "trust"
-# only the local machine.
-#
-#mynetworks_style = class
-#mynetworks_style = subnet
-#mynetworks_style = host
-
-# Alternatively, you can specify the mynetworks list by hand, in
-# which case Postfix ignores the mynetworks_style setting.
-#
-# Specify an explicit list of network/netmask patterns, where the
-# mask specifies the number of bits in the network part of a host
-# address.
-#
-# You can also specify the absolute pathname of a pattern file instead
-# of listing the patterns here. Specify type:table for table-based lookups
-# (the value on the table right-hand side is not used).
-#
-#mynetworks = 168.100.189.0/28, 127.0.0.0/8
-#mynetworks = $config_directory/mynetworks
-#mynetworks = hash:/etc/postfix/network_table
-mynetworks = 192.168.5.0/24 192.168.6.0/24 192.168.2.0/24
-
-# The relay_domains parameter restricts what destinations this system will
-# relay mail to. See the smtpd_recipient_restrictions description in
-# postconf(5) for detailed information.
-#
-# By default, Postfix relays mail
-# - from "trusted" clients (IP address matches $mynetworks) to any destination,
-# - from "untrusted" clients to destinations that match $relay_domains or
-# subdomains thereof, except addresses with sender-specified routing.
-# The default relay_domains value is $mydestination.
-#
-# In addition to the above, the Postfix SMTP server by default accepts mail
-# that Postfix is final destination for:
-# - destinations that match $inet_interfaces or $proxy_interfaces,
-# - destinations that match $mydestination
-# - destinations that match $virtual_alias_domains,
-# - destinations that match $virtual_mailbox_domains.
-# These destinations do not need to be listed in $relay_domains.
-#
-# Specify a list of hosts or domains, /file/name patterns or type:name
-# lookup tables, separated by commas and/or whitespace. Continue
-# long lines by starting the next line with whitespace. A file name
-# is replaced by its contents; a type:name table is matched when a
-# (parent) domain appears as lookup key.
-#
-# NOTE: Postfix will not automatically forward mail for domains that
-# list this system as their primary or backup MX host. See the
-# permit_mx_backup restriction description in postconf(5).
-#
-#relay_domains = $mydestination
-
-# INTERNET OR INTRANET
-
-# The relayhost parameter specifies the default host to send mail to
-# when no entry is matched in the optional transport(5) table. When
-# no relayhost is given, mail is routed directly to the destination.
-#
-# On an intranet, specify the organizational domain name. If your
-# internal DNS uses no MX records, specify the name of the intranet
-# gateway host instead.
-#
-# In the case of SMTP, specify a domain, host, host:port, [host]:port,
-# [address] or [address]:port; the form [host] turns off MX lookups.
-#
-# If you're connected via UUCP, see also the default_transport parameter.
-#
-#relayhost = $mydomain
-#relayhost = [gateway.my.domain]
-#relayhost = [mailserver.isp.tld]
-#relayhost = uucphost
-#relayhost = [an.ip.add.ress]
-relayhost = smtp-210149.m49.wedos.net:465
-# 993
-# smtp_use_tls=yes
-smtp_tls_security_level = encrypt
-smtp_tls_wrappermode = yes
-smtp_sasl_auth_enable = yes
-smtp_sasl_password_maps = hash:/etc/postfix/relay_password
-smtp_sasl_security_options =
-
-# REJECTING UNKNOWN RELAY USERS
-#
-# The relay_recipient_maps parameter specifies optional lookup tables
-# with all addresses in the domains that match $relay_domains.
-#
-# If this parameter is defined, then the SMTP server will reject
-# mail for unknown relay users. This feature is off by default.
-#
-# The right-hand side of the lookup tables is conveniently ignored.
-# In the left-hand side, specify an @domain.tld wild-card, or specify
-# a user@domain.tld address.
-#
-#relay_recipient_maps = hash:/etc/postfix/relay_recipients
-
-# INPUT RATE CONTROL
-#
-# The in_flow_delay configuration parameter implements mail input
-# flow control. This feature is turned on by default, although it
-# still needs further development (it's disabled on SCO UNIX due
-# to an SCO bug).
-#
-# A Postfix process will pause for $in_flow_delay seconds before
-# accepting a new message, when the message arrival rate exceeds the
-# message delivery rate. With the default 100 SMTP server process
-# limit, this limits the mail inflow to 100 messages a second more
-# than the number of messages delivered per second.
-#
-# Specify 0 to disable the feature. Valid delays are 0..10.
-#
-#in_flow_delay = 1s
-
-# ADDRESS REWRITING
-#
-# The ADDRESS_REWRITING_README document gives information about
-# address masquerading or other forms of address rewriting including
-# username->Firstname.Lastname mapping.
-
-# ADDRESS REDIRECTION (VIRTUAL DOMAIN)
-#
-# The VIRTUAL_README document gives information about the many forms
-# of domain hosting that Postfix supports.
-
-# "USER HAS MOVED" BOUNCE MESSAGES
-#
-# See the discussion in the ADDRESS_REWRITING_README document.
-
-# TRANSPORT MAP
-#
-# See the discussion in the ADDRESS_REWRITING_README document.
-
-# ALIAS DATABASE
-#
-# The alias_maps parameter specifies the list of alias databases used
-# by the local delivery agent. The default list is system dependent.
-#
-# On systems with NIS, the default is to search the local alias
-# database, then the NIS alias database. See aliases(5) for syntax
-# details.
-#
-# If you change the alias database, run "postalias /etc/aliases" (or
-# wherever your system stores the mail alias file), or simply run
-# "newaliases" to build the necessary DBM or DB file.
-#
-# It will take a minute or so before changes become visible. Use
-# "postfix reload" to eliminate the delay.
-#
-#alias_maps = dbm:/etc/aliases
-#alias_maps = hash:/etc/aliases
-#alias_maps = hash:/etc/aliases, nis:mail.aliases
-#alias_maps = netinfo:/aliases
-alias_maps = hash:/etc/postfix/aliases
-
-# The alias_database parameter specifies the alias database(s) that
-# are built with "newaliases" or "sendmail -bi". This is a separate
-# configuration parameter, because alias_maps (see above) may specify
-# tables that are not necessarily all under control by Postfix.
-#
-#alias_database = dbm:/etc/aliases
-#alias_database = dbm:/etc/mail/aliases
-#alias_database = hash:/etc/aliases
-#alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases
-alias_database = $alias_maps
-
-# ADDRESS EXTENSIONS (e.g., user+foo)
-#
-# The recipient_delimiter parameter specifies the separator between
-# user names and address extensions (user+foo). See canonical(5),
-# local(8), relocated(5) and virtual(5) for the effects this has on
-# aliases, canonical, virtual, relocated and .forward file lookups.
-# Basically, the software tries user+foo and .forward+foo before
-# trying user and .forward.
-#
-#recipient_delimiter = +
-
-# DELIVERY TO MAILBOX
-#
-# The home_mailbox parameter specifies the optional pathname of a
-# mailbox file relative to a user's home directory. The default
-# mailbox file is /var/spool/mail/user or /var/mail/user. Specify
-# "Maildir/" for qmail-style delivery (the / is required).
-#
-#home_mailbox = Mailbox
-#home_mailbox = Maildir/
-
-# The mail_spool_directory parameter specifies the directory where
-# UNIX-style mailboxes are kept. The default setting depends on the
-# system type.
-#
-#mail_spool_directory = /var/mail
-mail_spool_directory = /var/spool/mail
-
-# The mailbox_command parameter specifies the optional external
-# command to use instead of mailbox delivery. The command is run as
-# the recipient with proper HOME, SHELL and LOGNAME environment settings.
-# Exception: delivery for root is done as $default_user.
-#
-# Other environment variables of interest: USER (recipient username),
-# EXTENSION (address extension), DOMAIN (domain part of address),
-# and LOCAL (the address localpart).
-#
-# Unlike other Postfix configuration parameters, the mailbox_command
-# parameter is not subjected to $parameter substitutions. This is to
-# make it easier to specify shell syntax (see example below).
-#
-# Avoid shell meta characters because they will force Postfix to run
-# an expensive shell process. Procmail alone is expensive enough.
-#
-# IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, YOU MUST SET UP AN
-# ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER.
-#
-#mailbox_command = /some/where/procmail
-#mailbox_command = /some/where/procmail -a "$EXTENSION"
-
-# The mailbox_transport specifies the optional transport in master.cf
-# to use after processing aliases and .forward files. This parameter
-# has precedence over the mailbox_command, fallback_transport and
-# luser_relay parameters.
-#
-# Specify a string of the form transport:nexthop, where transport is
-# the name of a mail delivery transport defined in master.cf. The
-# :nexthop part is optional. For more details see the sample transport
-# configuration file.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must update the "local_recipient_maps" setting in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-# Cyrus IMAP over LMTP. Specify ``lmtpunix cmd="lmtpd"
-# listen="/var/imap/socket/lmtp" prefork=0'' in cyrus.conf.
-#mailbox_transport = lmtp:unix:/var/imap/socket/lmtp
-#
-# Cyrus IMAP via command line. Uncomment the "cyrus...pipe" and
-# subsequent line in master.cf.
-#mailbox_transport = cyrus
-
-# The fallback_transport specifies the optional transport in master.cf
-# to use for recipients that are not found in the UNIX passwd database.
-# This parameter has precedence over the luser_relay parameter.
-#
-# Specify a string of the form transport:nexthop, where transport is
-# the name of a mail delivery transport defined in master.cf. The
-# :nexthop part is optional. For more details see the sample transport
-# configuration file.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must update the "local_recipient_maps" setting in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-#fallback_transport = lmtp:unix:/file/name
-#fallback_transport = cyrus
-#fallback_transport =
-
-# The luser_relay parameter specifies an optional destination address
-# for unknown recipients. By default, mail for unknown@$mydestination,
-# unknown@[$inet_interfaces] or unknown@[$proxy_interfaces] is returned
-# as undeliverable.
-#
-# The following expansions are done on luser_relay: $user (recipient
-# username), $shell (recipient shell), $home (recipient home directory),
-# $recipient (full recipient address), $extension (recipient address
-# extension), $domain (recipient domain), $local (entire recipient
-# localpart), $recipient_delimiter. Specify ${name?value} or
-# ${name:value} to expand value only when $name does (does not) exist.
-#
-# luser_relay works only for the default Postfix local delivery agent.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must specify "local_recipient_maps =" (i.e. empty) in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-#luser_relay = $user@other.host
-#luser_relay = $local@other.host
-#luser_relay = admin+$local
-
-# JUNK MAIL CONTROLS
-#
-# The controls listed here are only a very small subset. The file
-# SMTPD_ACCESS_README provides an overview.
-
-# The header_checks parameter specifies an optional table with patterns
-# that each logical message header is matched against, including
-# headers that span multiple physical lines.
-#
-# By default, these patterns also apply to MIME headers and to the
-# headers of attached messages. With older Postfix versions, MIME and
-# attached message headers were treated as body text.
-#
-# For details, see "man header_checks".
-#
-#header_checks = regexp:/etc/postfix/header_checks
-
-# FAST ETRN SERVICE
-#
-# Postfix maintains per-destination logfiles with information about
-# deferred mail, so that mail can be flushed quickly with the SMTP
-# "ETRN domain.tld" command, or by executing "sendmail -qRdomain.tld".
-# See the ETRN_README document for a detailed description.
-#
-# The fast_flush_domains parameter controls what destinations are
-# eligible for this service. By default, they are all domains that
-# this server is willing to relay mail to.
-#
-#fast_flush_domains = $relay_domains
-
-# SHOW SOFTWARE VERSION OR NOT
-#
-# The smtpd_banner parameter specifies the text that follows the 220
-# code in the SMTP server's greeting banner. Some people like to see
-# the mail version advertised. By default, Postfix shows no version.
-#
-# You MUST specify $myhostname at the start of the text. That is an
-# RFC requirement. Postfix itself does not care.
-#
-#smtpd_banner = $myhostname ESMTP $mail_name
-#smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
-
-# PARALLEL DELIVERY TO THE SAME DESTINATION
-#
-# How many parallel deliveries to the same user or domain? With local
-# delivery, it does not make sense to do massively parallel delivery
-# to the same user, because mailbox updates must happen sequentially,
-# and expensive pipelines in .forward files can cause disasters when
-# too many are run at the same time. With SMTP deliveries, 10
-# simultaneous connections to the same domain could be sufficient to
-# raise eyebrows.
-#
-# Each message delivery transport has its XXX_destination_concurrency_limit
-# parameter. The default is $default_destination_concurrency_limit for
-# most delivery transports. For the local delivery agent the default is 2.
-
-#local_destination_concurrency_limit = 2
-#default_destination_concurrency_limit = 20
-
-# DEBUGGING CONTROL
-#
-# The debug_peer_level parameter specifies the increment in verbose
-# logging level when an SMTP client or server host name or address
-# matches a pattern in the debug_peer_list parameter.
-#
-debug_peer_level = 2
-
-# The debug_peer_list parameter specifies an optional list of domain
-# or network patterns, /file/name patterns or type:name tables. When
-# an SMTP client or server host name or address matches a pattern,
-# increase the verbose logging level by the amount specified in the
-# debug_peer_level parameter.
-#
-#debug_peer_list = 127.0.0.1
-#debug_peer_list = some.domain
-
-# The debugger_command specifies the external command that is executed
-# when a Postfix daemon program is run with the -D option.
-#
-# Use "command .. & sleep 5" so that the debugger can attach before
-# the process marches on. If you use an X-based debugger, be sure to
-# set up your XAUTHORITY environment variable before starting Postfix.
-#
-debugger_command =
- PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
- ddd $daemon_directory/$process_name $process_id & sleep 5
-
-# If you can't use X, use this to capture the call stack when a
-# daemon crashes. The result is in a file in the configuration
-# directory, and is named after the process name and the process ID.
-#
-# debugger_command =
-# PATH=/bin:/usr/bin:/usr/local/bin; export PATH; (echo cont;
-# echo where) | gdb $daemon_directory/$process_name $process_id 2>&1
-# >$config_directory/$process_name.$process_id.log & sleep 5
-#
-# Another possibility is to run gdb under a detached screen session.
-# To attach to the screen session, su root and run "screen -r
-# <id_string>" where <id_string> uniquely matches one of the detached
-# sessions (from "screen -list").
-#
-# debugger_command =
-# PATH=/bin:/usr/bin:/sbin:/usr/sbin; export PATH; screen
-# -dmS $process_name gdb $daemon_directory/$process_name
-# $process_id & sleep 1
-
-# INSTALL-TIME CONFIGURATION INFORMATION
-#
-# The following parameters are used when installing a new Postfix version.
-#
-# sendmail_path: The full pathname of the Postfix sendmail command.
-# This is the Sendmail-compatible mail posting interface.
-#
-sendmail_path = /usr/sbin/sendmail
-
-# newaliases_path: The full pathname of the Postfix newaliases command.
-# This is the Sendmail-compatible command to build alias databases.
-#
-newaliases_path = /usr/bin/newaliases
-
-# mailq_path: The full pathname of the Postfix mailq command. This
-# is the Sendmail-compatible mail queue listing command.
-#
-mailq_path = /usr/bin/mailq
-
-# setgid_group: The group for mail submission and queue management
-# commands. This must be a group name with a numerical group ID that
-# is not shared with other accounts, not even with the Postfix account.
-#
-setgid_group = postdrop
-
-# html_directory: The location of the Postfix HTML documentation.
-#
-html_directory = no
-
-# manpage_directory: The location of the Postfix on-line manual pages.
-#
-manpage_directory = /usr/share/man
-
-# sample_directory: The location of the Postfix sample configuration files.
-# This parameter is obsolete as of Postfix 2.1.
-#
-# sample_directory =
-
-# readme_directory: The location of the Postfix README files.
-#
-readme_directory = /usr/share/doc/postfix
-inet_protocols = ipv4
diff --git a/ansible/files/hoogle.service b/ansible/files/hoogle.service
deleted file mode 100644
index 2ebd3080fd829087a9ac8308c02ed293eda6f831..0000000000000000000000000000000000000000
--- a/ansible/files/hoogle.service
+++ /dev/null
@@ -1,15 +0,0 @@
-# Managed by ansible
-# vim: ft=systemd
-[Unit]
-Description=Hoogle server
-Wants=network.target
-
-[Service]
-Type=service
-Restart=always
-User=haskell
-Group=haskell
-ExecStart=/home/haskell/.cabal/bin/hoogle server --scope='package:base' --haddock=/home/haskell/doc/libraries -p 8080 --host='127.0.0.1' -n --home='http://hoogle.fi.muni.cz'
-
-[Install]
-WantedBy=multi-user.target
diff --git a/ansible/files/merge-haddocs b/ansible/files/merge-haddocs
deleted file mode 100644
index 33d9d98d207442962e27be888bbe260794e95e73..0000000000000000000000000000000000000000
--- a/ansible/files/merge-haddocs
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-LIBDIR=$PWD/libraries
-VERSIONED_GHCS=$1
-PRIMARY_GHC_VERS=$2
-
-unversion() {
- echo $1 | sed 's/-[0-9.]*$//'
-}
-
-# versioned GHCs
-for i in "$VERSIONED_GHCS/*"; do
- SRCDIR=$i/libraries
- for F in $SRCDIR/*; do
- ln -sf $(readlink -f $F) $LIBDIR/$(basename $F)
- done
-done
-
-# shorthands for the primary (base → base-?.?.?.?)
-for F in $VERSIONED_GHCS/$PRIMARY_GHC_VERS/libraries/*; do
- if [[ -d $F ]]; then
- ln -sf $(basename $F) $LIBDIR/$(unversion $(basename $F))
- else
- ln -sf $(readlink -f $F) $LIBDIR/$(basename $F)
- fi
-done
-
-# pull cabalized packages in here too
-for CABALIZED in $(find ~/.cabal/store/ghc-$PRIMARY_GHC_VERS -path '**/share/doc/html'); do
- NICE_NAME=$(basename $(readlink -f $CABALIZED/../../..) | sed 's/-[0-9a-F]*$//')
- ln -sf $CABALIZED $LIBDIR/$NICE_NAME
- ln -sf $NICE_NAME $LIBDIR/$(unversion $NICE_NAME)
-done
diff --git a/ansible/files/nginx/fja b/ansible/files/nginx/fja
deleted file mode 100644
index 30f035e1a9134f00f36c36eb25dab64f66e57665..0000000000000000000000000000000000000000
--- a/ansible/files/nginx/fja
+++ /dev/null
@@ -1,31 +0,0 @@
-## Managed by ansible
-## vim: noexpandtab tabstop=4
-server {
- listen [::]:443 ssl default_server;
- listen 443 ssl default_server;
- ssl_certificate /etc/letsencrypt/live/haskell.fi.muni.cz/fullchain.pem;
- ssl_certificate_key /etc/letsencrypt/live/haskell.fi.muni.cz/privkey.pem;
- include /etc/letsencrypt/options-ssl-nginx.conf;
- ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
- server_name fja.fi.muni.cz;
-
- root /home/fja/eval/evalweb;
- location / { try_files $uri @main; }
- location @main {
- include uwsgi_params;
- uwsgi_pass unix:/run/uwsgi/fjaweb.socket;
- }
-
- location /admin {
- return 302 https://hesperia.fi.muni.cz/admin;
- }
-
- location /compare {
- return 302 https://fja.fi.muni.cz/reg/compare;
- }
-
- location /convert {
- return 302 https://fja.fi.muni.cz/reg/convert;
- }
-}
diff --git a/ansible/files/nginx/haskell b/ansible/files/nginx/haskell
deleted file mode 100644
index 0a24841ec6feef3580b71c307b0f6d5de791fa99..0000000000000000000000000000000000000000
--- a/ansible/files/nginx/haskell
+++ /dev/null
@@ -1,18 +0,0 @@
-## Managed by ansible
-## vim: noexpandtab tabstop=4
-server {
- listen [::]:443 ssl default_server;
- listen 443 ssl default_server;
- ssl_certificate /etc/letsencrypt/live/haskell.fi.muni.cz/fullchain.pem;
- ssl_certificate_key /etc/letsencrypt/live/haskell.fi.muni.cz/privkey.pem;
- include /etc/letsencrypt/options-ssl-nginx.conf;
- ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
- root /home/haskell/www;
-
- server_name haskell.fi.muni.cz hypsipyla.fi.muni.cz;
-
- location /doc {
- alias /home/haskell/doc/libraries;
- }
-}
diff --git a/ansible/files/nginx/hoogle b/ansible/files/nginx/hoogle
deleted file mode 100644
index ba5862528ed37de2ca31f65deff8737e3a424687..0000000000000000000000000000000000000000
--- a/ansible/files/nginx/hoogle
+++ /dev/null
@@ -1,33 +0,0 @@
-## Managed by ansible
-## vim: noexpandtab tabstop=4
-server {
- listen [::]:443 ssl;
- listen 443 ssl;
- ssl_certificate /etc/letsencrypt/live/haskell.fi.muni.cz/fullchain.pem;
- ssl_certificate_key /etc/letsencrypt/live/haskell.fi.muni.cz/privkey.pem;
- include /etc/letsencrypt/options-ssl-nginx.conf;
- ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
- # Note: You should disable gzip for SSL traffic.
- # See: https://bugs.debian.org/773332
- #
- # Read up on ssl_ciphers to ensure a secure configuration.
- # See: https://bugs.debian.org/765782
- #
- # Self signed certs generated by the ssl-cert package
- # Don't use them in a production server!
- #
- # include snippets/snakeoil.conf;
-
- root /var/empty;
-
- server_name hoogle.fi.muni.cz;
-
- location / {
- proxy_pass http://127.0.0.1:8080/;
-
- location ~ /haddock//*(.*) {
- return 302 $scheme://haskell.fi.muni.cz/doc/$1;
- }
- }
-}
diff --git a/ansible/files/nginx/http b/ansible/files/nginx/http
deleted file mode 100644
index e8dc9dd8e38aaf2ab3ac35a62a3fe4a5958407e7..0000000000000000000000000000000000000000
--- a/ansible/files/nginx/http
+++ /dev/null
@@ -1,9 +0,0 @@
-## Managed by ansible
-## vim: noexpandtab tabstop=4
-server {
- listen 80 default_server;
- listen [::]:80 default_server;
-
- return 301 https://$host$request_uri;
- server_name hypsipyla.fi.muni.cz;
-}
diff --git a/ansible/files/znc.service b/ansible/files/znc.service
deleted file mode 100644
index d38a822e3603e9d2acfdcf5f1eed89f854d455c5..0000000000000000000000000000000000000000
--- a/ansible/files/znc.service
+++ /dev/null
@@ -1,12 +0,0 @@
-[Unit]
-Description=ZNC, an advanced IRC bouncer
-After=network.target
-
-[Service]
-ExecStart=/usr/bin/znc -f
-User=znc
-RestartSec=2s
-Restart=on-failure
-
-[Install]
-WantedBy=multi-user.target
diff --git a/ansible/gate.vstill.cz.yml b/ansible/gate.vstill.cz.yml
deleted file mode 100644
index 5f1b48bfa1c813776bf2cd4e61f91a3ea69f98ca..0000000000000000000000000000000000000000
--- a/ansible/gate.vstill.cz.yml
+++ /dev/null
@@ -1,384 +0,0 @@
-- name: gate
- hosts: gate.vstill.cz
- vars:
- ansible_fqdn: gate.vstill.cz
- mail_relay: null
- pam_use_kerberos: False
- backports: False
- backports_git: False
- nftables_default_config: False
- upstream_syncthing: True
- openvpn_fi_start: False
- eth_internal:
- - eth0
- eth_external:
- - enx00e04c37e5aa
- - tun-fi
- - netbox6
- - tun0
- dhcpcd_extra: |
- debug
-
- # the metrics need to be set for the sake of routing/NAT
- interface eth0
- static ip_address=192.168.5.1/24
- static ip6_address=2a01:4240:5f52:b588::1/64
- metric 250
-
- # internet comes from here
- interface enx00e04c37e5aa
- metric 220
-
- interface tun-fi
- metric 600
-
- interface tun0
- metric 700
-
- interface netbox6
- metric 400
- net:
- ipv6_prefix: "2a01:4240:5f52:b588"
- fixed:
- # TP-Link Archer C7
- - name: tplink
- link: 50:C7:BF:F9:4E:77
- ipv4: 192.168.5.2
- # link: 50:C7:BF:F9:4E:78 # in router mode
-
- - name: x270wifi
- link: e4:70:b8:6b:dc:7b
- ipv4: 192.168.5.32
- - name: x270dock
- link: 34:d0:b8:c0:8b:7b
- ipv4: 192.168.5.33
- - name: x270
- link: 54:e1:ad:dc:a9:95
- ipv4: 192.168.5.34
-
- - name: t14
- link: 54:05:db:85:b5:43
- ipv4: 192.168.5.38
-
- - name: skund
- link: a8:a1:59:54:a9:af
- ipv4: 192.168.5.4
-
- - name: skund-old
- link: FC:AA:14:21:47:BF
- ipv4: 192.168.5.5
-
- - name: io
- link: dc:a6:32:f4:4b:5a
- ipv4: 192.168.5.6
-
- - name: x230
- link: 3C:97:0E:9E:B5:92
- ipv4: 192.168.5.35
-
- - name: x230w
- link: 6c:88:14:80:12:dc
- ipv4: 192.168.5.36
-
-
- - name: krull
- link: B8:27:EB:DC:7D:37
- ipv4: 192.168.5.3
-
- - name: pixma-mx925
- link: 60:12:8B:4D:AD:91
- ipv4: 192.168.5.16
-# nat:
-# ports:
-# - name: localhost
-# dst: 127.0.0.1
-# tcp:
-# - 22
-
- tasks:
- - fail:
- msg: possibly wrong server?
- when: ansible_distribution != 'Debian'
-
- - import_role:
- name: common_deb
-
- - import_role:
- name: vstill_deb
-
- - import_role:
- name: raspbian
-
- - name: IPv6 setup
- copy:
- src: dhcpcd-ipv6-netbox-hook
- dest: /lib/dhcpcd/dhcpcd-hooks/62-ipv6-netbox
- notify:
- - restart dhcpcd
-
- - name: "DHCPD: Install dhcp server"
- apt:
- pkg:
- - isc-dhcp-server
-
- - name: "DHCPD: block the original dhcpd service"
- systemd:
- enabled: true
- masked: true
- state: stopped
- name: isc-dhcp-server
-
- - name: "DHCPD: install new service files"
- copy:
- src: '{{item}}@.service'
- dest: '/etc/systemd/system/{{item}}@.service'
- loop:
- - dhcpd4
- - dhcpd6
- notify:
- - restart dhcpd
- register: dhcpd_service_updated
-
- - name: "DHCPD: user for the new services"
- user:
- name: dhcp
- home: /var/lib/dhcp
- shell: /usr/sbin/nologin
- system: true
- notify:
- - restart dhcpd
-
- - name: "DHCPD: allow write to leases dir"
- file:
- state: directory
- owner: dhcp
- group: dhcp
- path: /var/lib/dhcp/dhcp
- notify:
- - restart dhcpd
-
- - name: "DHCPD: create leases files"
- copy:
- content: ""
- force: no # do not create if exists
- owner: dhcp
- group: dhcp
- dest: '/var/lib/dhcp/{{item}}.leases'
- loop:
- - dhcpd
- - dhcpd6
- notify:
- - restart dhcpd
-
- - name: "DHCPD: Set config"
- template:
- src: '{{item}}.conf.j2'
- dest: '/etc/dhcp/{{item}}.conf'
- notify:
- - restart dhcpd
- loop:
- - dhcpd
- - dhcpd6
-
- - name: "DHCPD: (reload) enable dhcpd"
- service:
- daemon_reload: '{{dhcpd_service_updated.changed}}'
- enabled: '{{item.1 == "4"}}'
- name: 'dhcpd{{item.1}}@{{item.0}}'
- loop: '{{ eth_internal | product(["4", "6"]) | list }}'
-
- - name: "sysctl: enable IP forwarding"
- sysctl:
- name: '{{item}}'
- value: '1'
- sysctl_file: "/etc/sysctl.d/30-ipforward.conf"
- reload: yes
- loop:
- - net.ipv4.ip_forward
- - net.ipv6.conf.default.forwarding
- - net.ipv6.conf.all.forwarding
-
- - name: nftables set new config for validation
- template:
- src: nftables.conf.j2
- dest: /etc/nftables.new.conf
-
- - name: nftables validate config
- command: nft --check -f /etc/nftables.new.conf
- register: nftables_valid
-
- - name: nftables config
- template:
- src: nftables.conf.j2
- dest: /etc/nftables.conf
- notify:
- - restart nftables
- when: not nftables_valid.failed
-
- - name: "IPv6 Router Advertisement: install radvd"
- apt:
- pkg:
- - radvd
-
- - name: "IPv6 Router Advertisement: setup radvd"
- template:
- src: radvd.conf.j2
- dest: /etc/radvd.conf
- notify:
- - restart radvd
-
- - name: "IPv6 Router Advertisement: enable radvd"
- systemd:
- name: radvd
- enabled: true
- notify:
- - restart radvd
-
- - name: "DNS: install bind"
- apt:
- pkg:
- - bind9
- notify:
- - restart named
-
- - name: "DNS: setup config"
- template:
- src: 'bind/{{item}}.j2'
- dest: '/etc/bind/{{item}}'
- notify:
- - restart named
- loop:
- - 'named.conf.options'
- - 'named.conf.local'
- - 'p.vstill.cz.zone'
- - 'ip6.vstill.cz.zone'
-
- - name: Install ZNC
- apt:
- pkg:
- - znc
- - znc-dev
- - znc-backlog
-# - znc-push
-# default_release: buster-backports
-
- - name: ZNC user
- user:
- name: znc
- system: true
-
- - name: ZNC service
- copy:
- src: znc.service
- dest: /etc/systemd/system/znc.service
- notify:
- - enable znc
-
- - name: Web setup
- apt:
- pkg:
- - certbot
-
- - name: Dir for ZNC drop-in for certbot
- file:
- state: directory
- path: /etc/systemd/system/certbot.service.d
-
- - name: ZNC drop-in for certbot
- copy:
- dest: /etc/systemd/system/certbot.service.d/znc-setfacl.conf
- content: |
- [Service]
- ExecStart=/bin/bash -c '/usr/bin/setfacl -m u:znc:r-- /etc/letsencrypt/archive/msg.vstill.cz/privkey*.pem'
- register: certbot_znc
-
- - name: Reload systemd after installing ZNC drop-in
- systemd:
- daemon_reload: true
- when: certbot_znc.changed
-
- - name: Disk utils
- apt:
- pkg:
- - lvm2
- - cryptsetup-bin
-
- - name: Misc
- apt:
- pkg:
- - easy-rsa
- - gphoto2
- - gphotofs
-
- - name: "OpenVPN server user"
- user:
- name: openvpn
- home: /var/empty
- shell: /usr/sbin/nologin
- system: true
-
- - name: postfix
- apt:
- pkg:
- - postfix
- - libsasl2-modules
- notify: restart postfix
-
- - name: postfix config
- copy:
- src: gate/postfix/main.cf
- dest: /etc/postfix/main.cf
- notify:
- - restart postfix
-
- - name: Install NGINX
- apt:
- pkg:
- - nginx
- - python3-certbot-nginx
- - certbot
-
- - name: Extra utilities
- apt:
- pkg:
- - wakeonlan
-
- handlers:
- - name: restart dhcpd
- service:
- name: 'dhcpd{{item.1}}@{{item.0}}'
- state: restarted
- loop: '{{ eth_internal | product(["4"]) | list }}'
-
- - name: restart radvd
- service:
- name: radvd
- state: restarted
-
- - name: restart named
- service:
- name: bind9
- state: restarted
-
- - name: enable znc
- service:
- daemon_reload: True
- name: znc
- enabled: true
- notify:
- - restart znc
-
- - name: restart znc
- service:
- name: znc
- state: restarted
-
- - name: restart postfix
- systemd:
- name: postfix
- enabled: true
- state: restarted
- notify:
- - test mail
-
-# vim: shiftwidth=2 tabstop=2 softtabstop=2 expandtab
diff --git a/ansible/hesperia.yml b/ansible/hesperia.yml
deleted file mode 100644
index 702e301e37e21240c3b269c79d421c853be24c77..0000000000000000000000000000000000000000
--- a/ansible/hesperia.yml
+++ /dev/null
@@ -1,241 +0,0 @@
-- name: hesperia
- hosts: hesperia.fi.muni.cz
- vars:
- postgres_server: true
- dhcpcd: false
- postfix: true
- backports: false
- nftables:
- nfs: false
- snmp: true
- pds_local: false
- snmpd:
- load: "7 6.5 6"
- disks:
- - path: /
- free: 1574400
- - path: /tmp
- free: 1048576
- expr_test_ids:
- - name: ib015
- id: 1000
-# - name: ib102
-# id: 1003
-# - name: ib002
-# id: 1004
- - name: ib113
- id: 1005
-# - name: pv264
-# id: 1006
- - name: ib111
- id: 1007
- - name: ib016
- id: 1008
- - name: ib005
- id: 1009
- - name: pb006
- id: 1015
- rc_with_homes:
- - ib015
- - ib016
- - pb006
-
- tasks:
- - import_role:
- name: common_deb
-
- - name: "Setup fstab"
- mount:
- path: '{{item.path}}'
- src: '{{item.src}}'
- fstype: '{{item.fstype}}'
- opts: '{{item.opts|default("defaults")}}'
- dump: "0"
- passno: '{{item.passno|default("0")}}'
- state: '{{item.state|default("mounted")}}'
- with_items:
- - path: "/"
- src: /dev/hsexprtest-vg/root
- fstype: ext4
- opts: errors=remount-ro
- passno: 1
-
- - path: "/boot"
- src: "UUID=e25766ad-2d27-4109-86f6-723091bd15f2"
- fstype: ext2
- passno: 2
-
- - path: none
- src: /dev/hsexprtest-vg/swap
- fstype: swap
- state: present
-
- - path: /tmp
- src: /dev/hsexprtest-vg/tmp
- fstype: ext4
- opts: defaults,relatime
-
-
- - name: exprTest groups
- group:
- name: '{{item.name}}'
- gid: '{{item.id}}'
- loop: "{{expr_test_ids}}"
-
- - name: exprTest users
- user:
- name: '{{"" if item.1 else "rc-"}}{{item.0.name}}'
- uid: '{{item.0.id if item.1 else 10000 + item.0.id - 1000}}'
- home: '{{"/home/" + item.0.name if item.1 else ("/srv/exprtest/rc-" + item.0.name if item.0.name in rc_with_homes else "/var/empty")}}'
- group: '{{item.0.name if item.1 else "runcheck"}}'
- shell: /bin/bash
- loop: "{{expr_test_ids | product([True, False]) | list}}"
-
- - import_role:
- name: postgres_deb
-
- - name: "MS repository"
- apt_repository:
- repo: deb [arch=amd64,arm64,armhf] https://packages.microsoft.com/debian/11/prod bullseye main
- filename: microsoft-prod
- state: present
-
- - name: install .NET Core
- apt:
- update_cache: yes
- pkg:
- - dotnet-sdk-3.1
-
- - name: install Mono mcs
- apt:
- pkg:
- - mono-mcs
-
- - name: Create /srv
- file:
- path: /srv
- state: directory
- mode: '0755'
-
- - name: exprtest dependencies
- apt:
- pkg:
- - python3-aiohttp
- - python3-aiohttp-jinja2
- - python3-asyncpg
-
- - name: fja checking dependencies
- apt:
- pkg:
- - antlr4
- - python3-antlr4
- - libipc-run-perl
- state: present
-
- - name: extra fjaweb dependencies
- pip:
- name:
- - Flask-Markdown
- executable: pip3
- state: absent
-
- - name: disable fjaweb
- systemd:
- name: 'fjaweb.{{item}}'
- enabled: false
- state: stopped
- loop:
- - socket
- - service
-
- - name: Misc eval dependencies
- apt:
- pkg:
- - python3-sympy
-
- - name: Create postgreSQL role for hsExprTest
- postgresql_user:
- login_unix_socket: "/var/run/postgresql/"
- name: checker
-
- - name: Create postgreSQL DB for hsExprTest
- postgresql_db:
- login_unix_socket: "/var/run/postgresql/"
- name: exprtest
- owner: checker
-
- - name: Install SNMP
- apt:
- pkg:
- - snmp
-
- - name: Setup SNMP
- template:
- src: snmpd.conf.j2
- dest: /etc/snmp/snmpd.conf
- register: snmp_setup
-
- - name: Restart SNMP
- service:
- name: snmpd
- state: '{{"restarted" if snmp_setup.changed else "started"}}'
- masked: false
- enabled: true
-
- - name: Setup GHC
- import_role:
- name: ghc_udeb
- vars:
- versions:
- # the latest has higher priority
- - ghc: 9.0.1
- - ghc: 9.2.1
- cabal: 3.6.2.0
-
- - name: hsExprTest
- import_role:
- name: hsExprTest
- vars:
- pkgs: [QuickCheck, lens, HUnit, graph-wrapper]
- ghc_version: 9.2.1
- configs:
- - user: rc-ib015
- - user: rc-ib016
- extra_pkgs: [mtl, exceptions, base-unicode-symbols, HUnit]
-
- - name: Auxiliary course helpers
- block:
- - name: Auxiliary course group
- group:
- name: '{{item}}'
- system: true
- loop:
- - ib015-adm
- - fja-adm
-
- - name: Auxiliary course user
- user:
- name: '{{item}}'
- home: '/home/{{item}}'
- create_home: true
- move_home: true
- system: true
- group: '{{item}}'
- loop:
- - ib015-adm
- - fja-adm
-
- - name: FCGI handlers
- systemd:
- name: 'fcgiwrap@{{item}}.socket'
- state: started
- enabled: true
- loop:
- - ib015-adm
- - fja-adm
- - www-data
-
- - name: Extra utilities for course
- apt:
- pkg:
- - python3-tabulate
diff --git a/ansible/hosts b/ansible/hosts
index 77b4679ec9a5ac1c567d173a77cc79bd5bda8069..3d4bed1aec6d28cd61a6068bd09e270989782185 100644
--- a/ansible/hosts
+++ b/ansible/hosts
@@ -21,27 +21,4 @@ pontos[05:08].fi.muni.cz
admin_email=paradise-supp+machines@fi.muni.cz
postfix=true
-[eval]
-eval-pv264.fi.muni.cz
-eval-haskell.fi.muni.cz
-hesperia.fi.muni.cz
-hypsipyla.fi.muni.cz
-
-[eval:vars]
-admin_email=still+admin-eval@fi.muni.cz
-postfix=true
-
-[vstill]
-skund.p.vstill.cz
-t14.p.vstill.cz
-# ansible_connection=local
-gate.vstill.cz
-# ansible_host=192.168.5.1
-io.p.vstill.cz
-bk2.v.vstill.cz ansible_host=192.168.6.14 ansible_ssh_extra_args=-oProxyJump=xstill@gate.vstill.cz
-
-[all:vars]
-admin_name=VladimÃr Å till
-admin_email=admin@vstill.eu
-
# vim: ft=dosini
diff --git a/ansible/roles/vstill_deb/defaults/main.yml b/ansible/roles/vstill_deb/defaults/main.yml
deleted file mode 100644
index 022910e2d99d08b517068e0118e4a33ac89c6390..0000000000000000000000000000000000000000
--- a/ansible/roles/vstill_deb/defaults/main.yml
+++ /dev/null
@@ -1,3 +0,0 @@
-upstream_syncthing: True
-openvpn_fi_start: False
-debian: "{{ansible_distribution == 'Debian'}}"
diff --git a/ansible/roles/vstill_deb/files/fi-split.ovpn b/ansible/roles/vstill_deb/files/fi-split.ovpn
deleted file mode 100644
index c43c72240ed4ebb043dceaafed7a2ae39d440608..0000000000000000000000000000000000000000
--- a/ansible/roles/vstill_deb/files/fi-split.ovpn
+++ /dev/null
@@ -1,91 +0,0 @@
-# FI MU ovpn; routes=fi_only; os_sw=; generated on 2020-10-15 19:57:06
-# VPN configuration generator: https://fadmin.fi.muni.cz/noauth/vpn.mpl
-tls-client
-dev tun-fi
-remote vpn.fi.muni.cz 1194 udp
-auth-user-pass
-verify-x509-name vpn.fi.muni.cz name
-pull
-allow-pull-fqdn
-verb 3
-nobind
-cipher AES-256-CBC
-auth-nocache
-
-push-peer-info
-setenv UV_OVPN "routes=fi_only; os_sw=; generated on 2020-10-15 19:57:06"
-
-# we won't route everything through VPN
-route-nopull
-route remote_host 255.255.255.255 net_gateway
-# set up DNS and DOMAIN manually
-dhcp-option DNS 147.251.48.14
-dhcp-option DNS 147.251.48.41
-dhcp-option DNS 2001:718:801:230::e
-dhcp-option DNS 2001:718:801:230::29
-dhcp-option DOMAIN fi.muni.cz
-
-# route only accesses to FI networks
-route 147.251.42.0 255.255.254.0 vpn_gateway
-route 147.251.44.0 255.255.252.0 vpn_gateway
-route 147.251.48.0 255.255.252.0 vpn_gateway
-route 147.251.52.0 255.255.254.0 vpn_gateway
-route 147.251.58.0 255.255.255.0 vpn_gateway
-route 147.251.106.192 255.255.255.224 vpn_gateway
-route 172.16.0.0 255.240.0.0 vpn_gateway
-route-ipv6 2001:718:801:200::/56
-
-<ca>
------BEGIN CERTIFICATE-----
-MIIFWTCCA0GgAwIBAgIJAPiXjPuisWzNMA0GCSqGSIb3DQEBCwUAMCIxIDAeBgNV
-BAMMF1ZQTiBGSSBNVU5JIEVhc3ktUlNBIENBMB4XDTIwMDMyMDAxMzMyNloXDTQw
-MTAwMTAxMzMyNlowIjEgMB4GA1UEAwwXVlBOIEZJIE1VTkkgRWFzeS1SU0EgQ0Ew
-ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDmc0rpVZNIabiPXs+3EGOD
-pXqztZDHv5cIVCwy1u4P+KChK1jaXFGgunk/zqEhmFc6O9nv95oaAzGml/mwFowM
-SHMB4gCLaKr5WDAVc5vsFhRHdbc0fQFfBdLV78qUSR0Xco7zLYdSIckoho2yDreJ
-wFl1GUPJ+EYmBX4GKV4rCJH5/2a+54loFL/onHchrQz2jlJUsDRb80tehyyaxYfj
-gNnasps96lfmPAH9WnyMP8z/S6Y/1bH4sm1xPqrGrtEE+ipyrtMdOZjNXxqNJ4jG
-JHL8bqJAKoRnrRYEbAaF8tiU7/KfOOXFBwhatjYEDwlQKo4BGsS0S3RjK0l/9wRT
-ndIM0NjaQYcRw9aBc/t43bVuDBkTmoWuuQInpAzyLdradiRQrZtIW+SBIugAuudI
-7cN06oi78sEzjpDGj+95FyvLga3iBtOFkfpqsHLWIypScRCjviCbQByneXbksl/b
-5bxRect4DPW37TZNouTg1ot6mGk1bYZdvK6TxyAMyiN0U6MEbQONT9ladk3mojaY
-FN4mP97njbankjbXyzEycnMdGtNW2EHDqKadobv2ym7Mb5dnUM3Q3SACKqrJQjtl
-iHknlM2eArJmqRWimKwMS1/XqibJL+yOYTuzHXExG/82p7CdqtEHHQSN6ahaIcQy
-1zgElZuYlTZaaY5ujVd5nQIDAQABo4GRMIGOMB0GA1UdDgQWBBRv2F+hIasPnTFi
-cb5T4CXJDBxy2DBSBgNVHSMESzBJgBRv2F+hIasPnTFicb5T4CXJDBxy2KEmpCQw
-IjEgMB4GA1UEAwwXVlBOIEZJIE1VTkkgRWFzeS1SU0EgQ0GCCQD4l4z7orFszTAM
-BgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAls65
-ceFa/rLc/n+S64ah522lrZyxbw/A5RzI54kHOMq2fBjWhLFpIk6htgVOKjy7BQdb
-fjuY0+16GqEUpzdkg2ZdOK5ZwArPXGnOrxAIJyUnvawN5K88VNCLHhRqLOrwnp6X
-NFdnEwJuNOj9V3t+8DUk3SJLQs9sRz3mg59qvFmluuxtABKQOSR2eVzYinH7QfWT
-tWnAsfC2k3owDL1aOPo0UFrZktKT43h27bn57Yzq825s8qvHMoZaS/oR+Blb80yz
-yDQ+oWzrEKF1gA1+/Wmuc4vUUUJSlgpZfF21ga/EamFz4ewL753qjyt316WIQsYK
-VKg+YFGqBh56burI+Em6oBkRI6n/NJHf8sKvA7ZSkpeAX1tFuYUMEHsqlxdUqyFr
-DYdCS0ck4XkyHrVNFmHPOvUCdknv9sqQcu+6NbIjvvelrQGe7wt8Yza/p41emcFN
-Dqii5k0prOCaiCzQMYvfpO0e4p5oq+QLPkBzyXxg8lxkpvnRj5zAQzhqOmB9tswP
-hBlHgETwzXsZQ+YYEF6eGktyCWDsiBQsjinc1X6pXY3wE671ZFgD0LWMnkNch/zh
-1nXX3o2qUKVpuXYeq5gQ4fEGky3ynVIwuPTfl1U3ZUcrTPkVyzUk46PITPZT4UJk
-c/O6srPEkfVb6fb7cobUm6TWjBfPQespXj5N/8Y=
------END CERTIFICATE-----
-</ca>
-
-<tls-crypt>
------BEGIN OpenVPN Static key V1-----
-23916f7ec5f2f5c7994243767a737913
-166879e48152712bb5be12207afab123
-fcd603844caa8b80113164cf53306ce6
-13a314629a656128af6b8778206499ee
-8e9e65999e62c120eb38697020fe9421
-54c36ec7c885eec6bf4289804a9e0265
-53c5131057a81da58e1a43c327f0567d
-9cce2218f4e5ebf155f712bdd1650cb2
-126358aa878d2b8b77097cdb9ee070b6
-43cf62dda5ce346a35e8fc182e33f36b
-a1417cdd28687a91b508ebfe815b5ab1
-915d71f31b10e9a1fed657d4e1f6523a
-68771a95965b4f59edd95b70c259bab4
-61f62721212e8b944df9c1942b2bcd8e
-b05a24304d3b3c9716c07df224d64926
-0a5c2f4d0fedb9b31e6ab04bb26c12f5
------END OpenVPN Static key V1-----
-</tls-crypt>
diff --git a/ansible/roles/vstill_deb/tasks/main.yml b/ansible/roles/vstill_deb/tasks/main.yml
deleted file mode 100644
index 5ea6dde4245e9449a8ada51bf24ac89f1a426bd6..0000000000000000000000000000000000000000
--- a/ansible/roles/vstill_deb/tasks/main.yml
+++ /dev/null
@@ -1,164 +0,0 @@
-- name: add user xstill
- user:
- name: xstill
- uid: 22572
- group: users
- groups:
- - "{{'sudo' if debian else 'wheel'}}"
- - systemd-journal
- append: yes
- shell: /bin/bash
- create_home: yes
-
-- name: SSH config dir (xstill)
- file:
- state: directory
- path: /home/xstill/.ssh
- owner: xstill
- group: users
- mode: 0700
-
-- name: SSH authorized_keys (xstill)
- lineinfile:
- create: yes
- path: /home/xstill/.ssh/authorized_keys
- owner: xstill
- group: users
- regexp: '{{item.regexp}}'
- line: '{{item.line}}'
- state: '{{item.state|default("present")}}'
- insertafter: EOF
- with_items:
-# - regexp: 'xstill@mail\.muni\.cz$'
-# line: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFXnRpFOZQo3E6hK3adOfpRLegp/jwaHqKR+ReiSvl3cPaUhOCVzzP/BGxl115nH+23stXMdy4kUH8j9kzpYTJV0ADqVBz+1lyXD9JIHLQvKVexnvf6Wb26fMmLoOq2Z8PDvYYxMzpZ0L9qKJ6UcdGQyj1rGBGr4otHLC4I8FD/L7Yt4FtRNlMUz4Dj3nGGoz8fdu5iUqtgLZ4Kn25LtoeGY0oIFvUE0zwEtuaUYRbxrTtUsPyJ3pDPjFEKb40TB3dTLhp1Mnujvst40oigIJK6moOJRfQIANDtvJ1P1+XXHs26qoCE5ina5pBCe/Bl5QaPSDaXPgWP7dJAQUDYlh/ xstill@mail.muni.cz"
-# - regexp: 'xstill@pythia01$'
-# line: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/QqdQyYX/5OYO4jgEtmdiG6LKtS2YuJMp+/usxdWMi8XJPSBiPoxmAuMG/39bA3RWo7Pva9tG6Gei2pbDjceQjFuK10cq4eNtxvDBnXbshsgdTf+04O8G6JeNxtaX9K30qIhzJ+em8hHqU5xCCpn4bhFCD8pfWUyqxz+n8QsworlhONQfxy4mZ7R4Joj4T0keE5UrW+fROEPmf8x62hcEQLkhEUNUklkTCtMyBK0OaV1Wc2XT6/21dywTe6JZovgRiA0h8B/l1i7RgT+LscYsSBAVvXdr4qsFJoCqG8iLBQZnAwzvXnisneHyNCbIYb4iaYZtZHxgYTkHYH3dc4Hw9fVzZmhbP3oGfg0PGs95xNYCANFOHWBad3TIEBn5WuPyUgusOu61QvC2ZwKBhI5SszL0kWBogVmNWnh7n999YD3l8vKSpSnSGucu7mqsdU0DNP4uN2Vcz5JcdtCwpLgBMaGYaszj3QTh1v5QFRnyA250DahF8l7x+2wf02XHvWGa2LwOhKeX7QjLdE6XazFX7rFQ4pGqS/fS5Dn7tvJWaC6LX0JdxkmutxEk/8iuGRBrqU8Ape65PsL0NYrKaEVZXWr8SBFab1l5aJ3jcyFb+01VteDNilEj5O1aA1napT8OT4Km5d5jjnaSODYx/2mVA+BpbMhD7kOIbqxT01E+aQ== xstill@pythia01"
- # - regexp: 'xstill@x270$'
-# line: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/xGJUD1gA4fEFr90x0+QjqRT8HjHkSb4qNpmlBiJLuYtLll0laiNMTAZZynqC9O/g9w9aWEo659q0J4y58qOo5hi2ek16XoZWCSe+nkQiwdkGzOSH0eyCpsyyMfITDk6NnlJKi240k0WPu63eXkaXfshcwXhEleqP84OTXV/oc6OF2eJeyqe4G8gpuwRpbPGazjVFhtSbrWPvpU2WbAB8X9VuTTQGuFum5OPtYN2qXEtVbvy1BvjK1J9tNtEiVcXt3BMJTjEBhuKMMEo29LQgO+S8/GbEskZpygNyi7lEbewWVCW1fdsRzdUF+alwlEgDNCbgDo9iefaE8taiNKk0CM3cNPJNTD+WKhvzhwH3ldYjT1O5HMcQRBRAHF8JpLsHnj8iuDSSElvktdoz2cxOZo0PZVJo9rh2EikIE/0MGjTM/txkWGbD+HrvE/IGxoe6QGxx4uBqfZQ1PpOSFqR80juuJFDXi/MZp08ndQAaH2LafhGhAMCITp/R655I9bqKFTvzftHHQdnNvQr1wLDKcxm+H0DeqYCH0vA1YpetE7rGtZXrSqtyqlpsLh6rxbaKUkqj2hzm3XzE+z3o4Bv5oRbmyDqR+i00pyd80LF1LD5cBvo+0/d3q2KlYOMM1MmJSZ13RjhbGZ4pc9Q2wJH51THWfFMSAknLdbPLR87yKQ== xstill@x270"
-# - regexp: 'xstill@t14.p.vstill.cz'
-# line: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDFz70Qud3kVM2rgeItW6A5deQhUME6pBUcVMvXWVz4zVqXOybqVB13p1RqlYwDf5IV/Tcc7Mb72ik4U3727659yLaNgR1cSMIBOEAPUSYqc1sjc/fO2N6XX1H48jROCFpfvc3BjIIm6vgSE4ZgOlQj8b4VmSNMkM9ThIlaaFRg7p/N9lyAXDqKvHrAZVV3NaSpIuoLdt3Zxiek/qK30lBJ2kEHQ4rP1RB+H+NTd5H39willDVVsV5BtLBr2wFLJ0qZaPaRw/5w5H+DQC2WFYninOkER5cwgnWqU4/AshVyr9IyKqo3lheWn7sq6CY+CCnXJ0IddP2HJSPeI0so6bX+Y4U9GOpyfJMyK/3tw/mnvBCQJ/AqvCri2iwBPZqDkVqvibCuuK/HSR3a8DIlTBfuqPK5RWluuapFKsRwueZtJkqxQNdpxpN5/CU4ZSVpj6wowYJK/g6AsvIAOeA+UxzgaI8TZjCDSe3stL0Dawaz5hS90Pg/hHVv8pNBolZzll8= xstill@t14.p.vstill.cz'
- - regexp: 'ger\vstill@vstill-mobl$'
- line: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMrVWKX+q/lTiKvI39eSfxY32kx/z1PH0myevFxWDcOd ger\vstill@vstill-mobl'
-
-- name: Add apt-key for Syncthing
- apt_key:
- data: |
- -----BEGIN PGP PUBLIC KEY BLOCK-----
- Version: GnuPG v1
-
- mQENBFShFd8BCADHQq9byO6uehb51iieKKi2KEwudhkbV74r8ZsGp0Q3asmv6cPl
- EFLKXCs9vm9f0Qn58up44ikd/782Gu7CQoFBM/DGj1SGXpWRj7fd6nnErA5JUiUz
- hpYN/Py0XWSApZE0xXUhBnd1UM1ymnWjGxu6HYb2ZIayr3jisZmUOVIwHJToqjIK
- grjt9afTlvDOfBN5GBeLYetByvza3JGt9kwn9z1ryhssyVHur+uXvJq7CuXJzImU
- E4QW9fwjeOHFFBQevYMVHhnlVgXGQ/fNmYW+MeXG4GE8viyRuv0asRwMjp+1zpP1
- EvAM/Z8Y9Udv1DvSTjonET3G9fOyNfU3HNcvABEBAAG0NFN5bmN0aGluZyBSZWxl
- YXNlIE1hbmFnZW1lbnQgPHJlbGVhc2VAc3luY3RoaW5nLm5ldD6JATgEEwECACIF
- AlShFd8CGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJENJubtAAZUo+XrsI
- AKk9Usgg6R/6/tfohdTjV9gpeMn+BpvP5boTAEWdTDF0azg06aAt0engrVkbwG70
- Nf9KKbDcSDZUJs1kZVq1TJvo3JnR+Dw0a9AcEvY+zDRcGuHmIjdei5QtaMsVB+8b
- zR0muX1YRw0MhncHg4bvEzWdrWRHZr71trVKTm2v/xW2Bd1KJmzUv/D2DjML3NL7
- SkbZMHmqTWE9jNoSajlxdIsZRM0QbzREEkC95/INaZvK1n8jY1fobY5qAx2knzp6
- SLx8TamN8RcACAhkV43NnFCdb3hhE6W22xK7BFwDSvoUvm+xi9NJWLg6UWPVSAPt
- 6Eb/RdtUlXx05awR6HzN/dSJAhwEEAECAAYFAlShFe0ACgkQSfWuwLzlJMdzHw/9
- EIDBnOTJdCzQ7GTUZjUQbdw2l3amgIvJiIFVwj3vzNIVLAOcCAej3jBiZpUw9B/2
- Omz3Y3qMeb4U0QP5EpBPCNmkViZ/Hvg9R5axWobnvsXTyxTMBJqL7IJ4W4PrKoeI
- W3ijNtj5b5k4+DpMKtmZ7I1u2x5CSek6vzDxRxaqpLIJFpdUGRBKfeVxmb2QQbIq
- QmDBZGEaK5ICfFegNGYZdyVqg7F/tr3mMOOWnuO1aFhqHQOjtZmG4TfpjrdrLZ2M
- 4qbRf0MD6dkOnthGvZXtY6Bx7grXqmtkT598+YRm3YK49KvCiAOpi9nCxPl3JJ0V
- z9MaWx2Y8ODzN/sOYos6PxnPdlP3xVSCOyxdegjqbo9IQweg3EcuVzkyhFWdIOix
- A5qh28E1Wun+wI1R0E9vfSFXXvVJeSQ/Whk+fGDKEkJxip/IoCo141DNKj/wJ3xS
- s03vTqtTwN/uPdIsCbWRSqG6mL1AOgi66NfFiT6Wu5ru/F+6p0XPJD5AL3mF4hyF
- hAtA/oKAYGs6FWHo+6bm5BBuklSQMJbCt8/T4LE/QWFKtJLMenOICArwBwqSo8WX
- NjyLjnRdQpMTUuKG36JSyMWdLmMq4FBSICjkOKOR/4RCmIR+hL4m4lfjc/FEyMe0
- jKAx8Nu4wzpoqUHygsljwEjmfzDdJ7S2MRG00EHzu7e5AQ0EVKEV3wEIALMoAN+6
- C5hgi70ICFl60YnHx/C8CkeW7+KVoog/iXLLTX8o6JYODLBn0kW8OxrRLCbNKNev
- lJYR1czjcpmdO+k8vyXOt0qj95kak+nrjzlxJ/YJh2f5JAgqkkkwZBc4qrzcc8Ek
- Y/rH9Z/JovOi55g0f8X2uQLRqQPq5a41Jgo94H3KjM42dhkNwSKBucesTLn3BOdQ
- gERjzqy4NCF06R3GaGM9Nt2fQ3uwmAsyxBU9YtHsyxK0zLSKQD79oe3e8S4DVZ7x
- 3KhxdP7uEypNpsR86IS9v4Y3UGhLbbmL2VQSOkr5bK6to/PHzfMo+WrLToR57Tl7
- w4ZtV0a+uJAyhAUAEQEAAYkBHwQYAQIACQUCVKEV3wIbDAAKCRDSbm7QAGVKPlSH
- CAC/oflzvJvTKY5JlYAI694Fqtzqg4Z36ymUq43G2jqI+/HYcRM+Lnj52+rwpY6C
- QU4shli/cwVJRLzkC+8pB6dzIqX1eKqD2RYmEDLeixibY9TwnPOKtMytW6dTRIxa
- 7+H6tO+n+9tT5JWIqKoP4kWFUBHKT7RBI3ubFxwaGwV1IGpItvukOa4XbDAWR3Ya
- TL+fbNhHegwae/3xX+T4+Ik40UnFtrJiHkbu3RmEzO38n5xJY+hG/lHQrsErQAUa
- kEEm5vqw/veVl3L88VnOWHhD3GxvPvtuN/RTxmwhlQ9rte/G6U/R0HDYFqrHDAns
- LlHRAP8U8Ozk3ll45SR12Zf2
- =rVev
- -----END PGP PUBLIC KEY BLOCK-----
- when: debian and upstream_syncthing
-
-- name: Syncthing apt source
- apt_repository:
- repo: deb https://apt.syncthing.net/ syncthing stable
- filename: syncthing
- state: present
- when: debian and upstream_syncthing
-
-- name: install syncthing from upstream (Debian)
- apt:
- pkg:
- - syncthing
- default_release: syncthing
- state: latest
- when: debian and upstream_syncthing
-
-- name: install syncthing (Archlinux)
- pacman:
- pkg:
- - syncthing
- when: not debian
-
-- name: install syncthing from distro repos (Debian)
- apt:
- pkg:
- - syncthing
- when: debian and not upstream_syncthing
-
-- name: enable syncthing for xstill
- systemd:
- enabled: yes
- name: syncthing@xstill
- state: started
-
-- name: Notify watches
- sysctl:
- # up to 256 MB kernel memory on 32bit sys, 512MB on 64bit
- # this is the default on Archlinux (2021)
- name: 'fs.inotify.max_user_watches'
- value: '524288'
- sysctl_file: "/etc/sysctl.d/31-notify-watches.conf"
-
-- name: install openvpn (Debian)
- apt:
- pkg:
- - openvpn
- when: debian
-
-
-- name: install openvpn (Archlinux)
- pacman:
- pkg:
- - openvpn
- when: not debian
-
-
-- name: install FI-split openvpn config
- copy:
- src: fi-split.ovpn
- dest: /etc/openvpn/client/fi-split.conf
-
-- name: point FI-split openvpn to password (which should be created manually)
- lineinfile:
- path: /etc/openvpn/client/fi-split.conf
- line: "auth-user-pass /etc/openvpn/auth/fi-split.secret"
- regex: "^auth-user-pass "
- insertafter: "^auth-nocache"
-
-- name: start openvpn FI-split
- systemd:
- enabled: yes
- state: started
- name: openvpn-client@fi-split
- when: openvpn_fi_start
-
-# vim: shiftwidth=2 tabstop=2 softtabstop=2 ft=yaml.ansible
diff --git a/ansible/t14.p.vstill.cz.yml b/ansible/t14.p.vstill.cz.yml
deleted file mode 100644
index 7b0b21d5ebd52695f4cbe92cbcdc3ea796d75496..0000000000000000000000000000000000000000
--- a/ansible/t14.p.vstill.cz.yml
+++ /dev/null
@@ -1,462 +0,0 @@
-- name: t14
- hosts: t14.p.vstill.cz
- vars:
- postgres_server_root: /var/lib/postgres
-
- tasks:
- - fail:
- msg: possibly wrong server?
- when: ansible_distribution != 'Archlinux'
-
- - import_role:
- name: vstill_deb
-
- - name: Enable sudo for wheel
- lineinfile:
- regex: "#? %wheel ALL=\\(ALL\\) ALL"
- line: "%wheel ALL=(ALL) ALL"
- path: /etc/sudoers
-
- - name: Enable time sync
- systemd:
- service: systemd-timesyncd
- enabled: true
- state: started
-
- - name: Enable sysrq
- sysctl:
- name: 'kernel.sysrq'
- value: '1'
- sysctl_file: "/etc/sysctl.d/30-sysrq.conf"
-
- - name: install basic tools
- pacman:
- pkg:
- - vim
- - strace
- - grub
- - efibootmgr
- - dmidecode
- - linux
- - linux-headers
- - smartmontools
- - dhcpcd
- - wpa_supplicant
- - acpi
- - screen
- - base
- - base-devel
- - gdb
- - cgdb
- - valgrind
- - w3m
- - elinks
- - bind
- - moreutils
- - cmake
- - ninja
- - clang
- - wol
- - git
- - git-lfs
- - subversion
- - bash-completion
- - ansible
- - rsync
- - gnupg
- - pinentry
- - inotify-tools
- - zip
- - unzip
- - bmake
- - perl-libwww
- - elfutils
- - patch
- - patchelf
- - man
- - man-pages
- - tree
- - bat
- - grc
- - fd
- - pv
- - wget
- - curl
- - mtr
- - sshfs
- - time
- - graphviz
- - imagemagick
- - pacman-contrib
- - usbutils
- - ethtool
- - lshw
- - bwm-ng
- - llvm
- - parallel
-
- - name: install nftables
- pacman:
- pkg:
- - nftables
- notify:
- - restart nftables
-
- - template:
- src: roles/common_deb/templates/nftables.conf.j2
- dest: /etc/nftables.conf
- notify:
- - restart nftables
-
- - name: enable dhcpcd
- systemd:
- name: dhcpcd
- enabled: true
- state: started
-
- - name: enable wpa_supplicant
- systemd:
- name: wpa_supplicant@wlp3s0
- enabled: true
- state: started
-
- - name: Install LaTeX
- pacman:
- pkg:
- - texlive-most
- - texlive-lang
- - texlive-langextra
- - biber
-
- - name: Install X & stuff
- pacman:
- pkg:
- - xorg-server
- - xorg-apps
-# - xf86-video-amdgpu
- - xmonad
- - xmonad-contrib
- - xmobar
- - xorg-xinit
- - xorg-xmessage
- - xorg-xlsfonts
- - xdg-utils
- - gnu-free-fonts
- - noto-fonts
- - ttf-bitstream-vera
- - ttf-caladea
- - ttf-carlito
- - ttf-croscore
- - ttf-dejavu
- - ttf-droid
- - ttf-liberation
- - ttf-ubuntu-font-family
- - xorg-fonts
- - xorg-fonts-100dpi
- - xorg-fonts-75dpi
- - xorg-fonts-alias-100dpi
- - xorg-fonts-alias-75dpi
- - xorg-fonts-alias-misc
- - xorg-fonts-misc
- - xclip
- - i3lock
- - firefox
- - chromium
- - thunderbird
- - rxvt-unicode
- - mousepad
- - pavucontrol
- - arandr
- - xcape
- - redshift
- - alsa-utils
- - pulseaudio
- - pulseaudio-alsa
- - pulseaudio-bluetooth
- - tk
- - nmap
- - inetutils
- - evince
- - pdfpc
- - thunar
- - gvfs
- - gvfs-smb
- - thunar-archive-plugin
- - xarchiver
- - viewnior
- - tumbler
- - libreoffice-fresh
- - libreoffice-fresh-en-gb
- - libreoffice-fresh-cs
- - libreoffice-fresh-sk
- - xf86-input-wacom
- - discord
- - meld
- - openbsd-netcat
- - socat
- - traceroute
- notify:
- - font caches
-
-
- - name: Install bluetooth
- pacman:
- pkg:
- - bluez-utils
- notify:
- - enable bluetooth
-
- - name: Xorg font config
- copy:
- content: |
- # Let X.Org know about the custom font directories
- Section "Files"
- FontPath "/usr/share/fonts/100dpi"
- FontPath "/usr/share/fonts/75dpi"
- FontPath "/usr/share/fonts/cantarell"
- FontPath "/usr/share/fonts/cyrillic"
- FontPath "/usr/share/fonts/encodings"
- FontPath "/usr/share/fonts/misc"
- FontPath "/usr/share/fonts/truetype"
- FontPath "/usr/share/fonts/TTF"
- FontPath "/usr/share/fonts/util"
- EndSection
- dest: /etc/X11/xorg.conf.d/all-the-fonts.conf
- notify:
- - font caches
-
- - name: Haskell
- pacman:
- pkg:
- - ghc
- - ghc-static
- - darcs
- - cabal-install
-# - haskell-quickcheck
-# - haskell-hunit
-# - haskell-hakyll
-# - haskell-base-unicode-symbols
-# - haskell-regex-pcre
-# - haskell-hint
-# - haskell-ieee754
- - hlint
-
- - name: Misc tools
- pacman:
- pkg:
- - mypy
- - flake8
- - python-pip
- - python-pygments
- - python-dateutil
- - python-flake8-blind-except
- - python-hypothesis
- - python-hunter
- - python-aiohttp
- - python-tzlocal
- - python-antlr4
- - python-pytest
- - python-flask
- - python-flask-wtf
- - python-wtforms
- - python-aiofiles
- - python-systemd
- - python-asyncpg
- - python-psycopg2
- - python-tabulate
- - antlr4
- - inkscape
- - gimp
- - darktable
- - audacity
- - irssi
- - postgresql-libs
- - dotnet-runtime
- - dotnet-sdk
- - code
- - tigervnc
- - pacgraph
- - tidy
- - cloc
- - z3
- - openldap
- - clusterssh
- - ocaml
- - obs-studio
- - kdenlive
- - vlc
- - r
- - sysbench
- - p7zip
- - archiso
- - boost
- - nodejs-lts-fermium # v14.X
- - npm
-
- - name: Flake8 linters
- pip:
- name:
- - flake8-mutable
- - flake8-annotations
- - flake8-comprehensions
- - flake8-executable
- - flake8-fixme
- - flake8-use-fstring
- - flake8-builtins
-
- - name: Python libs (mostly for exprtest)
- pip:
- name:
- - pylibacl
- - aiohttp_mako
- - aiohttp_jinja2
- - Flask-Markdown
- - pandoc-include
-# state: latest
-
- - name: R packages
- command: Rscript --vanilla -e "install.packages('{{item}}', repos=c('http://www.freestatistics.org/cran/'))"
- loop:
- - ggplot2
- - dplyr
- - svglite
-
-
- - name: setup kerberos
- copy:
- src: roles/common_deb/files/krb5.conf
- dest: /etc/krb5.conf
-
- - name: Install flatpak
- pacman:
- pkg:
- - flatpak
- notify:
- - flatpak flathub
-
- - name: Install misc flatpaks
- community.general.flatpak:
- state: present
- name: '{{item}}'
- loop:
- - com.spotify.Client
- - com.microsoft.Teams
- - us.zoom.Zoom
-# - com.discordapp.Discord
-
- - name: Systemd power management
- replace:
- path: /etc/systemd/logind.conf
- regexp: '^#?(HandleLidSwitch[^=]*)=.*$'
- replace: '\1=ignore'
- notify:
- - logind reload
-
- - name: Printing & scanning
- pacman:
- pkg:
- - cups
- - gutenprint
- - sane
- - xsane
-
- - name: CUPS service
- systemd:
- name: cups.socket
- enabled: True
- state: started
-
- - name: Disable beeper
- copy:
- content: "blacklist pcspkr"
- dest: /etc/modprobe.d/nobeep.conf
-
- - name: Install PostgreSQL
- pacman:
- pkg:
- - postgresql
-
- - name: Check if Postgres is created
- stat:
- path: '{{postgres_server_root}}/data/PG_VERSION'
- register: postgres_server_created
-
- - block:
- - name: 'Create {{postgres_server_root}}'
- file:
- path: '{{postgres_server_root}}'
- state: directory
- owner: postgres
- group: postgres
- mode: '0755'
-
- - name: Init postgres
- command:
- cmd: 'initdb --locale=en_US.UTF-8 -E UTF8 -D {{postgres_server_root}}/data'
- chdir: '{{postgres_server_root}}'
- become: True
- become_user: postgres
- when: not postgres_server_created.stat.exists
-
- - name: Postgres enabled
- systemd:
- name: postgresql
- enabled: true
- state: started
-
- - name: Create postgreSQL role for xstill
- postgresql_user:
- login_unix_socket: "/var/run/postgresql/"
- name: xstill
-
- - name: Create postgreSQL DB for hsExprTest
- postgresql_db:
- login_unix_socket: "/var/run/postgresql/"
- name: exprtest
- owner: xstill
-
- - name: Photos
- pacman:
- pkg:
- - gphoto2
- - gvfs-gphoto2
-
- - name: Containers
- pacman:
- pkg: podman
-
- handlers:
- - name: font caches
- command: '{{item}}'
- loop:
- - fc-cache
- - mkfontscale
- - mkfontdir
-
- - name: enable bluetooth
- systemd:
- name: bluetooth
- enabled: true
- state: started
-
- - name: flatpak flathub
- command: '{{item}}'
- loop:
- - flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
- - flatpak update
-
- - name: restart nftables
- systemd:
- name: nftables
- enabled: true
- state: restarted
-
- - name: restart wpa_supplicant
- systemd:
- name: wpa_supplicant@wlp3s0
- state: restarted
-
- - name: logind reload
- command: systemctl kill -s HUP systemd-logind
-
-# vim: shiftwidth=2 tabstop=2 softtabstop=2 ft=yaml.ansible