]>
Commit | Line | Data |
---|---|---|
f807d917 | 1 | { privateFiles }: |
7e214bf9 | 2 | { config, pkgs, lib, ... }: |
f807d917 | 3 | { |
34abd6af IB |
4 | deployment = { |
5 | targetUser = "root"; | |
6 | targetHost = config.hostEnv.ips.main.ip4; | |
7 | substituteOnDestination = true; | |
8 | }; | |
9 | boot = { | |
10 | kernelModules = [ "kvm-intel" ]; | |
11 | blacklistedKernelModules = [ "nvidiafb" ]; | |
12 | loader.timeout = 1; | |
13 | loader.grub.devices = [ "/dev/sda" "/dev/sdb" ]; | |
14 | kernel.sysctl = { | |
15 | # https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md | |
16 | "net.ipv4.tcp_sack" = 0; | |
17 | }; | |
18 | supportedFilesystems = [ "zfs" ]; | |
19 | kernelParams = ["zfs.zfs_arc_max=6442450944"]; | |
20 | kernelPackages = pkgs.linuxPackages_latest; | |
21 | initrd.availableKernelModules = [ "ahci" "sd_mod" ]; | |
22 | initrd.secrets = { | |
23 | "/boot/pass.key" = "/boot/pass.key"; | |
24 | }; | |
25 | }; | |
26 | services.udev.extraRules = '' | |
27 | ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="c8:60:00:56:a0:88", NAME="eth0" | |
28 | ''; | |
29 | nix.maxJobs = 8; | |
30 | powerManagement.cpuFreqGovernor = "powersave"; | |
ab8f306d | 31 | myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; }; |
f807d917 | 32 | |
7e214bf9 | 33 | fileSystems = { |
ef909e24 IB |
34 | # pools: |
35 | # zpool: ashift=12 | |
36 | # zfast: ashift=12 | |
37 | # zfs: | |
38 | # zpool/: acltype=posixacl ; xattr=sa ; atime=off ; mountpoint=legacy | |
39 | # zpool/root: encryption=on ; keyformat=passphrase ; keylocation=file:///boot/pass.key | |
40 | # zpool/root/var: atime=on | |
41 | # zfast/: acltype=posixacl ; xattr=sa ; atime=off ; mountpoint=legacy | |
42 | # zfast/root: encryption=on ; keyformat=passphrase ; keylocation=file:///boot/pass.key | |
43 | # zfast/root/etc: ø | |
44 | # zfast/root/nix: ø | |
45 | # zfast/root/tmp: async=disabled | |
46 | # zfast/root/var: atime=on | |
47 | # zfast/root/var/lib: ø | |
48 | # zfast/root/var/lib/mysql: logbias=throughput ; atime=off ; primarycache=metadata | |
49 | # zfast/root/var/lib/postgresql: recordsize=8K ; atime=off ; logbias=throughput | |
50 | # zfast/root/var/lib/postgresql/11.0: ø | |
51 | # zfast/root/var/lib/postgresql/11.0/pg_wal: ø | |
34abd6af | 52 | "/" = { fsType = "zfs"; device = "zpool/root"; }; |
7e214bf9 IB |
53 | "/boot" = { fsType = "ext4"; device = "/dev/disk/by-uuid/e6bb18fb-ff56-4b5f-ae9f-e60d40dc0622"; }; |
54 | "/etc" = { fsType = "zfs"; device = "zpool/root/etc"; }; | |
ef909e24 IB |
55 | "/nix" = { fsType = "zfs"; device = "zfast/root/nix"; }; |
56 | "/tmp" = { fsType = "zfs"; device = "zfast/root/tmp"; }; | |
7e214bf9 | 57 | "/var" = { fsType = "zfs"; device = "zpool/root/var"; }; |
ef909e24 IB |
58 | "/var/lib/mysql" = { fsType = "zfs"; device = "zfast/root/var/lib/mysql"; }; |
59 | "/var/lib/postgresql" = { fsType = "zfs"; device = "zfast/root/var/lib/postgresql"; }; | |
60 | "/var/lib/postgresql/11.0" = { fsType = "zfs"; device = "zfast/root/var/lib/postgresql/11.0"; }; | |
61 | "/var/lib/postgresql/11.0/pg_wal" = { fsType = "zfs"; device = "zfast/root/var/lib/postgresql/11.0/pg_wal"; }; | |
7e214bf9 | 62 | }; |
34abd6af IB |
63 | swapDevices = [ { label = "swap1"; } { label = "swap2"; } ]; |
64 | hardware.enableRedistributableFirmware = true; | |
7e214bf9 IB |
65 | |
66 | services.zfs = { | |
7e214bf9 | 67 | autoScrub = { |
05a3b252 | 68 | enable = false; |
7e214bf9 IB |
69 | }; |
70 | }; | |
f807d917 | 71 | networking = { |
31e11cdf | 72 | hostId = "8262ca33"; # generated with head -c4 /dev/urandom | od -A none -t x4 |
f807d917 | 73 | firewall.enable = true; |
05a3b252 | 74 | # FIXME: on next reboot, remove the /27 and the localCommands |
34abd6af IB |
75 | interfaces."eth0".ipv4.addresses = |
76 | pkgs.lib.attrsets.mapAttrsToList | |
77 | (n: ips: { address = ips.ip4; prefixLength = 32; }) | |
78 | (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips) | |
79 | ++ [ { address = config.hostEnv.ips.main.ip4; prefixLength = 27; } ]; | |
f807d917 IB |
80 | interfaces."eth0".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList |
81 | (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or [])) | |
619e4f46 | 82 | config.hostEnv.ips); |
34abd6af IB |
83 | defaultGateway = "176.9.151.65"; |
84 | localCommands = '' | |
85 | # FIXME: Those commands were added by nixops and may not be | |
86 | # actually needed | |
87 | ip -6 addr add '2a01:4f8:160:3445::/64' dev 'eth0' || true | |
88 | ip -4 route change '176.9.151.64/27' via '176.9.151.65' dev 'eth0' || true | |
89 | ip -6 route add default via 'fe80::1' dev eth0 || true | |
90 | ''; | |
91 | nameservers = [ | |
92 | "213.133.98.98" | |
93 | "213.133.99.99" | |
94 | "213.133.100.100" | |
95 | "2a01:4f8:0:a0a1::add:1010" | |
96 | "2a01:4f8:0:a102::add:9999" | |
97 | "2a01:4f8:0:a111::add:9898" | |
98 | ]; | |
f807d917 IB |
99 | }; |
100 | ||
101 | imports = builtins.attrValues (import ../..); | |
102 | ||
103 | myServices.buildbot.enable = true; | |
104 | myServices.databases.enable = true; | |
105 | myServices.gitolite.enable = true; | |
3bc32d9e | 106 | myServices.monitoring.enable = true; |
f807d917 IB |
107 | myServices.irc.enable = true; |
108 | myServices.pub.enable = true; | |
109 | myServices.tasks.enable = true; | |
8415083e IB |
110 | myServices.mpd.enable = true; |
111 | myServices.dns.enable = true; | |
112 | myServices.certificates.enable = true; | |
113 | myServices.websites.enable = true; | |
ef118cb3 | 114 | myServices.gemini.enable = true; |
8415083e | 115 | myServices.mail.enable = true; |
3f453c7d | 116 | myServices.ejabberd.enable = true; |
ea9c6fe8 | 117 | myServices.vpn.enable = true; |
f807d917 | 118 | services.pure-ftpd.enable = true; |
5b42284e | 119 | services.duplyBackup.enable = false; |
213c323a | 120 | services.duplyBackup.profiles.oldies.rootDir = "/var/lib/oldies"; |
f807d917 | 121 | |
e43fdf34 IB |
122 | services.netdata.enable = true; |
123 | services.netdata.config.global."memory mode" = "none"; | |
124 | services.netdata.config.health."enabled" = "no"; | |
125 | services.netdata.config.web.mode = "none"; | |
c081a03a IB |
126 | users.users."${config.services.netdata.user}".extraGroups = [ "keys" ]; |
127 | environment.etc."netdata/stream.conf".source = "/var/secrets/netdata-stream.conf"; | |
8bf83d7a | 128 | secrets.keys = [ |
c081a03a IB |
129 | { |
130 | dest = "netdata-stream.conf"; | |
131 | user = config.services.netdata.user; | |
132 | group = config.services.netdata.group; | |
133 | permissions = "0400"; | |
134 | text = '' | |
135 | [stream] | |
136 | enabled = yes | |
137 | destination = ${config.myEnv.monitoring.netdata_aggregator} | |
138 | api key = ${config.myEnv.monitoring.netdata_keys.eldiron} | |
139 | ''; | |
140 | } | |
8bf83d7a | 141 | { |
5dda316b | 142 | dest = "zrepl_backup/identity"; |
8bf83d7a IB |
143 | user = "root"; |
144 | group = "root"; | |
145 | permissions = "0400"; | |
5dda316b | 146 | text = config.myEnv.zrepl_backup.ssh_key.private; |
8bf83d7a IB |
147 | } |
148 | ]; | |
149 | programs.ssh.knownHosts.dilion = { | |
150 | hostNames = ["dilion.immae.eu"]; | |
151 | publicKey = let | |
152 | profile = config.myEnv.rsync_backup.profiles.dilion; | |
153 | in | |
154 | "${profile.host_key_type} ${profile.host_key}"; | |
155 | }; | |
156 | ||
f807d917 IB |
157 | services.cron = { |
158 | enable = true; | |
4227853a | 159 | mailto = "cron@immae.eu"; |
f807d917 IB |
160 | systemCronJobs = [ |
161 | '' | |
fb7611c1 IB |
162 | 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtpd -g "immae.eu.*Recipient address rejected" |
163 | # Need a way to blacklist properly | |
164 | # 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtpd -g "NOQUEUE:" | |
165 | 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtp -g "status=bounced" | |
f807d917 IB |
166 | '' |
167 | ]; | |
168 | }; | |
169 | ||
f831eb7e IB |
170 | fileSystems."/var/lib/pub/immae/devtools" = { |
171 | device = "/run/current-system/sw/bin/bindfs#/var/lib/ftp/devtools.immae.eu/"; | |
172 | fsType = "fuse"; | |
173 | options = [ "force-user=pub" "create-for-user=wwwrun" "create-for-group=wwwrun" ]; | |
174 | }; | |
740a6506 | 175 | environment.systemPackages = [ pkgs.bindfs ]; |
f831eb7e | 176 | |
5dda316b IB |
177 | services.zrepl = { |
178 | enable = true; | |
179 | config = let | |
180 | redis_dump = pkgs.writeScript "redis-dump" '' | |
181 | #! ${pkgs.stdenv.shell} | |
182 | ${pkgs.redis}/bin/redis-cli bgsave | |
183 | ''; | |
184 | in '' | |
185 | jobs: | |
186 | - type: push | |
187 | # must not change | |
188 | name: "backup-to-dilion" | |
189 | filesystems: | |
190 | "zpool/root": true | |
191 | "zpool/root/etc": true | |
192 | "zpool/root/var<": true | |
193 | connect: | |
194 | type: ssh+stdinserver | |
195 | host: dilion.immae.eu | |
196 | user: backup | |
197 | port: 22 | |
198 | identity_file: ${config.secrets.fullPaths."zrepl_backup/identity"} | |
199 | snapshotting: | |
200 | type: periodic | |
201 | prefix: zrepl_ | |
8b150321 IB |
202 | interval: 1h |
203 | #hooks: | |
204 | # - type: mysql-lock-tables | |
205 | # dsn: "${config.myEnv.zrepl_backup.mysql.user}:${config.myEnv.zrepl_backup.mysql.password}@tcp(localhost)/" | |
206 | # filesystems: | |
207 | # "zpool/root/var": true | |
208 | # - type: command | |
209 | # path: ${redis_dump} | |
210 | # err_is_fatal: false | |
211 | # filesystems: | |
212 | # "zpool/root/var": true | |
5dda316b IB |
213 | send: |
214 | encrypted: true | |
215 | pruning: | |
216 | keep_sender: | |
5dda316b IB |
217 | - type: regex |
218 | regex: "^manual_.*" | |
219 | - type: grid | |
8b150321 | 220 | grid: 24x1h | 7x1d | 4x7d | 6x30d |
5dda316b IB |
221 | regex: "^zrepl_.*" |
222 | keep_receiver: | |
223 | - type: regex | |
224 | regex: "^manual_.*" | |
225 | - type: grid | |
8b150321 | 226 | grid: 6x4h | 7x1d | 4x7d | 6x30d |
5dda316b IB |
227 | regex: "^zrepl_.*" |
228 | ''; | |
229 | }; | |
f807d917 IB |
230 | # This value determines the NixOS release with which your system is |
231 | # to be compatible, in order to avoid breaking some software such as | |
232 | # database servers. You should change this only after NixOS release | |
233 | # notes say you should. | |
61ebe69b | 234 | # https://nixos.org/nixos/manual/release-notes.html |
d43e0c61 | 235 | system.stateVersion = "20.03"; # Did you read the comment? |
f807d917 | 236 | } |