]>
Commit | Line | Data |
---|---|---|
6c95e93c | 1 | { config, pkgs, name, lib, ... }: |
8a304ef4 | 2 | { |
34abd6af IB |
3 | deployment = { |
4 | targetUser = "root"; | |
05becbbb | 5 | targetHost = lib.head config.hostEnv.ips.main.ip4; |
34abd6af IB |
6 | substituteOnDestination = true; |
7 | }; | |
282c67a1 IB |
8 | # ssh-keyscan dilion | nix-shell -p ssh-to-age --run ssh-to-age |
9 | secrets.ageKeys = [ "age1x49n6qa0arkdpq8530s7umgm0gqkq90exv4jep97q30rfnzknpaqate06a" ]; | |
34abd6af IB |
10 | nixpkgs.system = lib.mkOverride 900 "x86_64-linux"; |
11 | boot = { | |
12 | loader = { | |
13 | grub = { | |
14 | version = 2; | |
15 | devices = [ "/dev/sda" "/dev/sdb" "/dev/sdc" "/dev/sdd" ]; | |
16 | }; | |
17 | timeout = 1; | |
18 | }; | |
19 | blacklistedKernelModules = [ "nvidiafb" ]; | |
20 | supportedFilesystems = [ "zfs" ]; | |
e34b3079 | 21 | kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages; |
34abd6af IB |
22 | kernelModules = [ "kvm-intel" ]; |
23 | initrd.availableKernelModules = [ "ahci" "sd_mod" ]; | |
24 | initrd.secrets = { | |
25 | "/boot/pass.key" = "/boot/pass.key"; | |
26 | }; | |
27 | kernel.sysctl."vm.nr_hugepages" = 256; # for xmr-stak | |
6ee77836 IB |
28 | # available in nixos-20.09 |
29 | #zfs.requestEncryptionCredentials = [ "zpool/root" ]; | |
34abd6af | 30 | }; |
34abd6af IB |
31 | powerManagement.cpuFreqGovernor = "powersave"; |
32 | hardware.enableRedistributableFirmware = true; | |
33 | ||
282c67a1 | 34 | myEnv = import ../../../nixops/secrets/environment.nix; |
8a304ef4 | 35 | |
34abd6af | 36 | swapDevices = [ { label = "swap"; } ]; |
740a6506 | 37 | fileSystems = { |
34abd6af | 38 | "/" = { fsType = "zfs"; device = "zpool/root"; }; |
740a6506 IB |
39 | "/boot" = { fsType = "ext4"; device = "/dev/disk/by-uuid/fd1c511e-2bc0-49d5-b8bb-95e7e8c8c816"; }; |
40 | "/etc" = { fsType = "zfs"; device = "zpool/root/etc"; }; | |
41 | "/home" = { fsType = "zfs"; device = "zpool/root/home"; }; | |
42 | "/home/immae" = { fsType = "zfs"; device = "zpool/root/home/immae"; }; | |
43 | "/tmp" = { fsType = "zfs"; device = "zpool/root/tmp"; }; | |
44 | "/var" = { fsType = "zfs"; device = "zpool/root/var"; }; | |
34abd6af IB |
45 | "/data" = { fsType = "ext4"; label = "data"; }; |
46 | "/nix" = { fsType = "ext4"; label = "nix"; }; | |
740a6506 | 47 | }; |
34abd6af IB |
48 | |
49 | services.udev.extraRules = '' | |
50 | ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="10:bf:48:7f:e6:3b", NAME="eth0" | |
51 | ''; | |
740a6506 | 52 | |
8a304ef4 | 53 | networking = { |
31e11cdf | 54 | hostId = "27c3048d"; # generated with head -c4 /dev/urandom | od -A none -t x4 |
8a304ef4 | 55 | firewall.enable = false; |
34abd6af | 56 | interfaces."eth0".ipv4.addresses = |
05becbbb IB |
57 | [ { address = lib.head config.hostEnv.ips.main.ip4; prefixLength = 27; } ] |
58 | ++ pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList | |
59 | (n: ips: map (ip: { address = ip; prefixLength = 32; }) (ips.ip4 or [])) | |
60 | (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips)); | |
34abd6af IB |
61 | interfaces."eth0".ipv6.addresses = |
62 | [ { address = "2a01:4f8:141:53e7::"; prefixLength = 64; } ] | |
63 | ++ pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList | |
64 | (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or [])) | |
65 | config.hostEnv.ips); | |
66 | defaultGateway = { address = "176.9.10.225"; interface = "eth0"; }; | |
67 | defaultGateway6 = { address = "fe80::1"; interface = "eth0"; }; | |
68 | nameservers = [ | |
69 | "213.133.98.98" | |
70 | "213.133.99.99" | |
71 | "213.133.100.100" | |
72 | "2a01:4f8:0:a0a1::add:1010" | |
73 | "2a01:4f8:0:a102::add:9999" | |
74 | "2a01:4f8:0:a111::add:9898" | |
75 | ]; | |
8a304ef4 IB |
76 | }; |
77 | ||
78 | myServices.ssh.modules = [ config.myServices.ssh.predefinedModules.regular ]; | |
200690c9 | 79 | imports = builtins.attrValues (import ../..) ++ [ ./dilion/vms.nix ]; |
8a304ef4 | 80 | |
6c95e93c | 81 | system.nssModules = [ pkgs.libvirt ]; |
2053ddac | 82 | system.nssDatabases.hosts = lib.mkForce [ "files" "libvirt_guest" "mymachines" "dns" "myhostname" ]; |
8a304ef4 IB |
83 | programs.zsh.enable = true; |
84 | ||
200690c9 IB |
85 | users.users.libvirt = { |
86 | hashedPassword = "!"; | |
87 | shell = pkgs.bashInteractive; | |
88 | isSystemUser = true; | |
89 | group = "libvirtd"; | |
e34b3079 | 90 | packages = [ pkgs.libressl.nc ]; |
282c67a1 IB |
91 | openssh.authorizedKeys.keys = [ |
92 | config.myEnv.buildbot.ssh_key.public | |
93 | config.myEnv.sshd.rootKeys.ismael_flony | |
200690c9 | 94 | ]; |
200690c9 IB |
95 | }; |
96 | ||
e34b3079 | 97 | users.groups.backup = {}; |
8bf83d7a | 98 | users.users.backup = { |
8bf83d7a IB |
99 | hashedPassword = "!"; |
100 | isSystemUser = true; | |
5dda316b | 101 | extraGroups = [ "keys" ]; |
e34b3079 | 102 | group = "backup"; |
8bf83d7a IB |
103 | shell = pkgs.bashInteractive; |
104 | openssh.authorizedKeys.keys = let | |
5dda316b | 105 | zreplConfig = config.secrets.fullPaths."zrepl/zrepl.yml"; |
8bf83d7a | 106 | in |
5dda316b | 107 | ["command=\"${pkgs.zrepl}/bin/zrepl stdinserver --config ${zreplConfig} eldiron\",restrict ${config.myEnv.zrepl_backup.ssh_key.public}"]; |
8bf83d7a | 108 | }; |
50c100ba | 109 | security.sudo.extraRules = pkgs.lib.mkAfter [ |
50c100ba IB |
110 | { |
111 | commands = [ | |
112 | { command = "/home/immae/.nix-profile/root_scripts/*"; options = [ "NOPASSWD" ]; } | |
113 | ]; | |
114 | users = [ "immae" ]; | |
115 | runAs = "root"; | |
116 | } | |
8bf83d7a IB |
117 | ]; |
118 | ||
6c95e93c IB |
119 | system.activationScripts.libvirtd_exports = '' |
120 | install -m 0755 -o root -g root -d /var/lib/caldance | |
121 | ''; | |
f2bc9fcc | 122 | virtualisation.docker.enable = true; |
740a6506 | 123 | virtualisation.docker.storageDriver = "zfs"; |
7067c25c | 124 | virtualisation.libvirtd.enable = true; |
e34b3079 IB |
125 | systemd.services.libvirtd.path = lib.mkAfter [ config.boot.zfs.package ]; |
126 | users.groups.immae = {}; | |
127 | users.extraUsers.immae.extraGroups = [ "immae" "libvirtd" "docker" ]; | |
7067c25c IB |
128 | systemd.services.libvirtd.postStart = '' |
129 | install -m 0770 -g libvirtd -d /var/lib/libvirt/images | |
130 | ''; | |
6c95e93c IB |
131 | systemd.services.socat-caldance = { |
132 | description = "Forward ssh port to caldance"; | |
133 | wantedBy = [ "multi-user.target" ]; | |
134 | after = [ "network.target" ]; | |
135 | ||
136 | serviceConfig = { | |
200690c9 | 137 | ExecStart = "${pkgs.socat}/bin/socat TCP-LISTEN:8022,fork TCP:caldance:22"; |
6c95e93c IB |
138 | }; |
139 | }; | |
7067c25c | 140 | |
8a304ef4 IB |
141 | time.timeZone = "Europe/Paris"; |
142 | nix = { | |
e34b3079 IB |
143 | settings = { |
144 | sandbox = "relaxed"; | |
145 | max-jobs = 8; | |
146 | substituters = [ "https://hydra.iohk.io" "https://cache.nixos.org" ]; | |
147 | trusted-public-keys = [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ]; | |
148 | }; | |
8a304ef4 IB |
149 | extraOptions = '' |
150 | keep-outputs = true | |
151 | keep-derivations = true | |
969d8daf | 152 | allow-unsafe-native-code-during-evaluation = true |
bb9bc238 | 153 | experimental-features = nix-command flakes |
8a304ef4 IB |
154 | #Assumed in NUR |
155 | allow-import-from-derivation = true | |
156 | ''; | |
157 | }; | |
158 | ||
50c100ba IB |
159 | security.pki.certificateFiles = [ |
160 | (pkgs.fetchurl { | |
161 | url = "http://downloads.e.eriomem.net/eriomemca.pem"; | |
162 | sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh"; | |
163 | }) | |
164 | ]; | |
165 | ||
8a304ef4 IB |
166 | # This is equivalent to setting environment.sessionVariables.NIX_PATH |
167 | nix.nixPath = [ | |
38ac9a57 IB |
168 | "home-manager=${pkgs.sources.home-manager.url}" |
169 | "nixpkgs=${pkgs.sources.nixpkgs-home-manager.url}" | |
8a304ef4 IB |
170 | ]; |
171 | ||
6ee77836 | 172 | myServices.monitoring.enable = true; |
ba941296 | 173 | myServices.certificates.enable = true; |
83e79a89 | 174 | security.acme.certs."${name}-immae" = config.myServices.certificates.certConfig // { |
e34b3079 | 175 | group = "immae"; |
83e79a89 IB |
176 | domain = "dilion.immae.eu"; |
177 | }; | |
ba941296 | 178 | security.acme.certs."${name}" = { |
ba941296 | 179 | group = config.services.nginx.group; |
e34b3079 IB |
180 | extraDomainNames = [ |
181 | "dilion.immae.dev" | |
182 | "caldance.cs.immae.dev" | |
183 | "zulip.carpentier.earth" | |
184 | "zulip.tof.carpentier.earth" | |
185 | "zulip.dine.carpentier.earth" | |
186 | "zulip.quentin.carpentier.earth" | |
187 | "zulip.agnes.carpentier.earth" | |
27da4e10 | 188 | |
e34b3079 | 189 | "ofn.nc.immae.dev" |
cca9aa2e | 190 | |
e34b3079 IB |
191 | "bookstack.cc.immae.dev" |
192 | ]; | |
ba941296 IB |
193 | }; |
194 | services.nginx = { | |
195 | enable = true; | |
196 | recommendedOptimisation = true; | |
197 | recommendedGzipSettings = true; | |
198 | recommendedProxySettings = true; | |
6c95e93c | 199 | upstreams = { |
200690c9 | 200 | caldance.servers."caldance:3031" = {}; |
6c95e93c | 201 | }; |
ba941296 | 202 | virtualHosts = { |
7c5e6fe8 | 203 | "dilion.immae.dev" = { |
63500b22 IB |
204 | acmeRoot = config.myServices.certificates.webroot; |
205 | useACMEHost = name; | |
206 | forceSSL = true; | |
207 | root = "/home/immae/www"; | |
208 | }; | |
7c5e6fe8 | 209 | "caldance.cs.immae.dev" = { |
6c95e93c IB |
210 | acmeRoot = config.myServices.certificates.webroot; |
211 | useACMEHost = name; | |
212 | forceSSL = true; | |
213 | locations."/".extraConfig = '' | |
214 | uwsgi_pass caldance; | |
215 | ''; | |
216 | locations."/static/".alias = "/var/lib/caldance/caldance/app/www/static/"; | |
217 | locations."/media/".alias = "/var/lib/caldance/caldance/media/"; | |
218 | extraConfig = '' | |
219 | auth_basic "Authentification requise"; | |
220 | auth_basic_user_file ${pkgs.writeText "htpasswd" config.myEnv.websites.caldance.integration.password}; | |
221 | ''; | |
222 | }; | |
cca9aa2e IB |
223 | "bookstack.cc.immae.dev" = { |
224 | acmeRoot = config.myServices.certificates.webroot; | |
225 | useACMEHost = name; | |
226 | forceSSL = true; | |
227 | locations."/".proxyPass = "http://localhost:4003"; | |
228 | }; | |
27da4e10 IB |
229 | "ofn.nc.immae.dev" = { |
230 | acmeRoot = config.myServices.certificates.webroot; | |
231 | useACMEHost = name; | |
232 | forceSSL = true; | |
233 | locations."/".proxyPass = "http://localhost:3000"; | |
234 | }; | |
55b6d76b IB |
235 | "zulip.carpentier.earth" = { |
236 | acmeRoot = config.myServices.certificates.webroot; | |
237 | useACMEHost = name; | |
238 | forceSSL = true; | |
239 | locations."/".proxyPass = "http://localhost:4002"; | |
240 | }; | |
241 | "zulip.tof.carpentier.earth" = { | |
242 | acmeRoot = config.myServices.certificates.webroot; | |
243 | useACMEHost = name; | |
244 | forceSSL = true; | |
245 | locations."/".proxyPass = "http://localhost:4002"; | |
246 | }; | |
247 | "zulip.dine.carpentier.earth" = { | |
248 | acmeRoot = config.myServices.certificates.webroot; | |
249 | useACMEHost = name; | |
250 | forceSSL = true; | |
251 | locations."/".proxyPass = "http://localhost:4002"; | |
252 | }; | |
253 | "zulip.quentin.carpentier.earth" = { | |
254 | acmeRoot = config.myServices.certificates.webroot; | |
255 | useACMEHost = name; | |
256 | forceSSL = true; | |
257 | locations."/".proxyPass = "http://localhost:4002"; | |
258 | }; | |
259 | "zulip.agnes.carpentier.earth" = { | |
260 | acmeRoot = config.myServices.certificates.webroot; | |
261 | useACMEHost = name; | |
262 | forceSSL = true; | |
263 | locations."/".proxyPass = "http://localhost:4002"; | |
264 | }; | |
ba941296 IB |
265 | }; |
266 | }; | |
267 | ||
5dda316b IB |
268 | systemd.services.zrepl.serviceConfig.RuntimeDirectory = lib.mkForce "zrepl zrepl/stdinserver"; |
269 | systemd.services.zrepl.serviceConfig.User = "backup"; | |
17069bb6 | 270 | # pour eldiron: |
5dda316b | 271 | # zfs allow backup create,mount,receive,destroy,rename,snapshot,hold,bookmark,release zpool/backup |
17069bb6 IB |
272 | # pour flony: |
273 | # zfs allow backup hold,release,bookmark,snapshot,send zpool | |
e34b3079 | 274 | immaeServices.zrepl = { |
5dda316b IB |
275 | enable = true; |
276 | config = '' | |
277 | global: | |
278 | control: | |
279 | sockpath: /run/zrepl/control | |
280 | serve: | |
281 | stdinserver: | |
282 | sockdir: /run/zrepl/stdinserver | |
283 | jobs: | |
284 | - type: sink | |
285 | # must not change | |
286 | name: "backup-from-eldiron" | |
287 | root_fs: "zpool/backup" | |
288 | serve: | |
17069bb6 IB |
289 | type: tls |
290 | listen: :19000 | |
291 | ca: ${config.secrets.fullPaths."zrepl/certificates/eldiron.crt"} | |
292 | cert: ${config.secrets.fullPaths."zrepl/certificates/dilion.crt"} | |
293 | key: ${config.secrets.fullPaths."zrepl/dilion.key"} | |
294 | client_cns: | |
5dda316b | 295 | - eldiron |
17069bb6 IB |
296 | - type: source |
297 | # must not change | |
298 | name: "backup-to-wd-zpool" | |
299 | # not encrypted! | |
300 | serve: | |
301 | type: tls | |
302 | listen: :19001 | |
303 | ca: ${config.secrets.fullPaths."zrepl/certificates/flony.crt"} | |
304 | cert: ${config.secrets.fullPaths."zrepl/certificates/dilion.crt"} | |
305 | key: ${config.secrets.fullPaths."zrepl/dilion.key"} | |
306 | client_cns: | |
307 | - flony | |
308 | filesystems: | |
17069bb6 IB |
309 | "zpool/libvirt<": true |
310 | "zpool/root<": true | |
311 | snapshotting: | |
312 | type: manual | |
e34b3079 IB |
313 | - type: source |
314 | # must not change | |
315 | name: "backup-to-wd-zpool-docker" | |
316 | # not encrypted! | |
317 | serve: | |
318 | type: tls | |
319 | listen: :19002 | |
320 | ca: ${config.secrets.fullPaths."zrepl/certificates/flony.crt"} | |
321 | cert: ${config.secrets.fullPaths."zrepl/certificates/dilion.crt"} | |
322 | key: ${config.secrets.fullPaths."zrepl/dilion.key"} | |
323 | client_cns: | |
324 | - flony | |
325 | filesystems: | |
326 | "zpool/docker<": true | |
327 | snapshotting: | |
328 | type: manual | |
5dda316b IB |
329 | ''; |
330 | }; | |
8a304ef4 IB |
331 | # This value determines the NixOS release with which your system is |
332 | # to be compatible, in order to avoid breaking some software such as | |
333 | # database servers. You should change this only after NixOS release | |
334 | # notes say you should. | |
335 | # https://nixos.org/nixos/manual/release-notes.html | |
d43e0c61 | 336 | system.stateVersion = "20.03"; # Did you read the comment? |
8a304ef4 IB |
337 | } |
338 |