]>
Commit | Line | Data |
---|---|---|
7e214bf9 | 1 | { config, pkgs, lib, ... }: |
f807d917 | 2 | { |
34abd6af IB |
3 | deployment = { |
4 | targetUser = "root"; | |
05becbbb | 5 | targetHost = lib.head config.hostEnv.ips.main.ip4; |
34abd6af | 6 | }; |
282c67a1 IB |
7 | # ssh-keyscan eldiron | nix-shell -p ssh-to-age --run ssh-to-age |
8 | secrets.ageKeys = [ "age1dxr5lhvtnjssfaqpnf6qx80h8gfwkxg3tdf35m6n9wljmk7wadfs3kmahj" ]; | |
34abd6af IB |
9 | boot = { |
10 | kernelModules = [ "kvm-intel" ]; | |
11 | blacklistedKernelModules = [ "nvidiafb" ]; | |
12 | loader.timeout = 1; | |
13 | loader.grub.devices = [ "/dev/sda" "/dev/sdb" ]; | |
14 | kernel.sysctl = { | |
15 | # https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md | |
16 | "net.ipv4.tcp_sack" = 0; | |
17 | }; | |
18 | supportedFilesystems = [ "zfs" ]; | |
19 | kernelParams = ["zfs.zfs_arc_max=6442450944"]; | |
e34b3079 | 20 | kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages; |
34abd6af IB |
21 | initrd.availableKernelModules = [ "ahci" "sd_mod" ]; |
22 | initrd.secrets = { | |
23 | "/boot/pass.key" = "/boot/pass.key"; | |
24 | }; | |
25 | }; | |
26 | services.udev.extraRules = '' | |
27 | ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="c8:60:00:56:a0:88", NAME="eth0" | |
28 | ''; | |
e34b3079 | 29 | nix.settings.max-jobs = 8; |
34abd6af | 30 | powerManagement.cpuFreqGovernor = "powersave"; |
282c67a1 | 31 | myEnv = import ../../../nixops/secrets/environment.nix; |
f807d917 | 32 | |
7e214bf9 | 33 | fileSystems = { |
ef909e24 IB |
34 | # pools: |
35 | # zpool: ashift=12 | |
36 | # zfast: ashift=12 | |
37 | # zfs: | |
38 | # zpool/: acltype=posixacl ; xattr=sa ; atime=off ; mountpoint=legacy | |
39 | # zpool/root: encryption=on ; keyformat=passphrase ; keylocation=file:///boot/pass.key | |
40 | # zpool/root/var: atime=on | |
41 | # zfast/: acltype=posixacl ; xattr=sa ; atime=off ; mountpoint=legacy | |
42 | # zfast/root: encryption=on ; keyformat=passphrase ; keylocation=file:///boot/pass.key | |
43 | # zfast/root/etc: ø | |
44 | # zfast/root/nix: ø | |
45 | # zfast/root/tmp: async=disabled | |
46 | # zfast/root/var: atime=on | |
47 | # zfast/root/var/lib: ø | |
48 | # zfast/root/var/lib/mysql: logbias=throughput ; atime=off ; primarycache=metadata | |
49 | # zfast/root/var/lib/postgresql: recordsize=8K ; atime=off ; logbias=throughput | |
50 | # zfast/root/var/lib/postgresql/11.0: ø | |
51 | # zfast/root/var/lib/postgresql/11.0/pg_wal: ø | |
34abd6af | 52 | "/" = { fsType = "zfs"; device = "zpool/root"; }; |
7e214bf9 IB |
53 | "/boot" = { fsType = "ext4"; device = "/dev/disk/by-uuid/e6bb18fb-ff56-4b5f-ae9f-e60d40dc0622"; }; |
54 | "/etc" = { fsType = "zfs"; device = "zpool/root/etc"; }; | |
ef909e24 IB |
55 | "/nix" = { fsType = "zfs"; device = "zfast/root/nix"; }; |
56 | "/tmp" = { fsType = "zfs"; device = "zfast/root/tmp"; }; | |
7e214bf9 | 57 | "/var" = { fsType = "zfs"; device = "zpool/root/var"; }; |
ef909e24 IB |
58 | "/var/lib/mysql" = { fsType = "zfs"; device = "zfast/root/var/lib/mysql"; }; |
59 | "/var/lib/postgresql" = { fsType = "zfs"; device = "zfast/root/var/lib/postgresql"; }; | |
60 | "/var/lib/postgresql/11.0" = { fsType = "zfs"; device = "zfast/root/var/lib/postgresql/11.0"; }; | |
61 | "/var/lib/postgresql/11.0/pg_wal" = { fsType = "zfs"; device = "zfast/root/var/lib/postgresql/11.0/pg_wal"; }; | |
7e214bf9 | 62 | }; |
34abd6af IB |
63 | swapDevices = [ { label = "swap1"; } { label = "swap2"; } ]; |
64 | hardware.enableRedistributableFirmware = true; | |
7e214bf9 IB |
65 | |
66 | services.zfs = { | |
7e214bf9 | 67 | autoScrub = { |
05a3b252 | 68 | enable = false; |
7e214bf9 IB |
69 | }; |
70 | }; | |
f807d917 | 71 | networking = { |
31e11cdf | 72 | hostId = "8262ca33"; # generated with head -c4 /dev/urandom | od -A none -t x4 |
f807d917 | 73 | firewall.enable = true; |
17069bb6 | 74 | firewall.allowedTCPPorts = [ config.myEnv.ports.zrepl_flony ]; |
05a3b252 | 75 | # FIXME: on next reboot, remove the /27 and the localCommands |
05becbbb IB |
76 | interfaces."eth0".ipv4.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList |
77 | (n: ips: map (ip: { address = ip; prefixLength = 32; }) (ips.ip4 or [])) | |
78 | (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips)) | |
79 | ++ [ { address = lib.head config.hostEnv.ips.main.ip4; prefixLength = 27; } ]; | |
f807d917 IB |
80 | interfaces."eth0".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList |
81 | (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or [])) | |
619e4f46 | 82 | config.hostEnv.ips); |
34abd6af IB |
83 | defaultGateway = "176.9.151.65"; |
84 | localCommands = '' | |
85 | # FIXME: Those commands were added by nixops and may not be | |
86 | # actually needed | |
87 | ip -6 addr add '2a01:4f8:160:3445::/64' dev 'eth0' || true | |
88 | ip -4 route change '176.9.151.64/27' via '176.9.151.65' dev 'eth0' || true | |
89 | ip -6 route add default via 'fe80::1' dev eth0 || true | |
90 | ''; | |
91 | nameservers = [ | |
92 | "213.133.98.98" | |
93 | "213.133.99.99" | |
94 | "213.133.100.100" | |
95 | "2a01:4f8:0:a0a1::add:1010" | |
96 | "2a01:4f8:0:a102::add:9999" | |
97 | "2a01:4f8:0:a111::add:9898" | |
98 | ]; | |
f807d917 IB |
99 | }; |
100 | ||
101 | imports = builtins.attrValues (import ../..); | |
102 | ||
103 | myServices.buildbot.enable = true; | |
104 | myServices.databases.enable = true; | |
105 | myServices.gitolite.enable = true; | |
3bc32d9e | 106 | myServices.monitoring.enable = true; |
f807d917 IB |
107 | myServices.irc.enable = true; |
108 | myServices.pub.enable = true; | |
109 | myServices.tasks.enable = true; | |
8415083e IB |
110 | myServices.mpd.enable = true; |
111 | myServices.dns.enable = true; | |
112 | myServices.certificates.enable = true; | |
113 | myServices.websites.enable = true; | |
ef118cb3 | 114 | myServices.gemini.enable = true; |
8415083e | 115 | myServices.mail.enable = true; |
3f453c7d | 116 | myServices.ejabberd.enable = true; |
ea9c6fe8 | 117 | myServices.vpn.enable = true; |
fcbdf67a | 118 | myServices.ftp.enable = true; |
f807d917 | 119 | |
e43fdf34 IB |
120 | services.netdata.enable = true; |
121 | services.netdata.config.global."memory mode" = "none"; | |
122 | services.netdata.config.health."enabled" = "no"; | |
123 | services.netdata.config.web.mode = "none"; | |
c081a03a | 124 | users.users."${config.services.netdata.user}".extraGroups = [ "keys" ]; |
120bcf4d | 125 | services.netdata.configDir."stream.conf" = config.secrets.fullPaths."netdata-stream.conf"; |
4c4652aa IB |
126 | secrets.keys = { |
127 | "netdata-stream.conf" = { | |
c081a03a IB |
128 | user = config.services.netdata.user; |
129 | group = config.services.netdata.group; | |
130 | permissions = "0400"; | |
131 | text = '' | |
132 | [stream] | |
133 | enabled = yes | |
134 | destination = ${config.myEnv.monitoring.netdata_aggregator} | |
135 | api key = ${config.myEnv.monitoring.netdata_keys.eldiron} | |
136 | ''; | |
4c4652aa IB |
137 | }; |
138 | "zrepl_backup/identity" = { | |
8bf83d7a IB |
139 | user = "root"; |
140 | group = "root"; | |
141 | permissions = "0400"; | |
5dda316b | 142 | text = config.myEnv.zrepl_backup.ssh_key.private; |
4c4652aa IB |
143 | }; |
144 | }; | |
8bf83d7a | 145 | programs.ssh.knownHosts.dilion = { |
e34b3079 | 146 | extraHostNames = ["dilion.immae.eu"]; |
8bf83d7a IB |
147 | publicKey = let |
148 | profile = config.myEnv.rsync_backup.profiles.dilion; | |
149 | in | |
150 | "${profile.host_key_type} ${profile.host_key}"; | |
151 | }; | |
152 | ||
f807d917 IB |
153 | services.cron = { |
154 | enable = true; | |
4227853a | 155 | mailto = "cron@immae.eu"; |
f807d917 IB |
156 | systemCronJobs = [ |
157 | '' | |
fb7611c1 IB |
158 | 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtpd -g "immae.eu.*Recipient address rejected" |
159 | # Need a way to blacklist properly | |
160 | # 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtpd -g "NOQUEUE:" | |
161 | 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtp -g "status=bounced" | |
f807d917 IB |
162 | '' |
163 | ]; | |
164 | }; | |
165 | ||
740a6506 | 166 | environment.systemPackages = [ pkgs.bindfs ]; |
f831eb7e | 167 | |
e34b3079 | 168 | immaeServices.zrepl = { |
5dda316b IB |
169 | enable = true; |
170 | config = let | |
171 | redis_dump = pkgs.writeScript "redis-dump" '' | |
172 | #! ${pkgs.stdenv.shell} | |
173 | ${pkgs.redis}/bin/redis-cli bgsave | |
174 | ''; | |
175 | in '' | |
176 | jobs: | |
177 | - type: push | |
178 | # must not change | |
179 | name: "backup-to-dilion" | |
180 | filesystems: | |
181 | "zpool/root": true | |
182 | "zpool/root/etc": true | |
183 | "zpool/root/var<": true | |
184 | connect: | |
17069bb6 IB |
185 | address: dilion.immae.eu:19000 |
186 | type: tls | |
187 | server_cn: dilion | |
188 | ca: ${config.secrets.fullPaths."zrepl/certificates/dilion.crt"} | |
189 | cert: ${config.secrets.fullPaths."zrepl/certificates/eldiron.crt"} | |
190 | key: ${config.secrets.fullPaths."zrepl/eldiron.key"} | |
5dda316b IB |
191 | snapshotting: |
192 | type: periodic | |
193 | prefix: zrepl_ | |
8b150321 IB |
194 | interval: 1h |
195 | #hooks: | |
196 | # - type: mysql-lock-tables | |
197 | # dsn: "${config.myEnv.zrepl_backup.mysql.user}:${config.myEnv.zrepl_backup.mysql.password}@tcp(localhost)/" | |
198 | # filesystems: | |
199 | # "zpool/root/var": true | |
200 | # - type: command | |
201 | # path: ${redis_dump} | |
202 | # err_is_fatal: false | |
203 | # filesystems: | |
204 | # "zpool/root/var": true | |
5dda316b IB |
205 | send: |
206 | encrypted: true | |
207 | pruning: | |
208 | keep_sender: | |
5dda316b IB |
209 | - type: regex |
210 | regex: "^manual_.*" | |
211 | - type: grid | |
8b150321 | 212 | grid: 24x1h | 7x1d | 4x7d | 6x30d |
5dda316b IB |
213 | regex: "^zrepl_.*" |
214 | keep_receiver: | |
215 | - type: regex | |
216 | regex: "^manual_.*" | |
217 | - type: grid | |
8b150321 | 218 | grid: 6x4h | 7x1d | 4x7d | 6x30d |
5dda316b | 219 | regex: "^zrepl_.*" |
17069bb6 IB |
220 | - type: source |
221 | # must not change | |
222 | name: "backup-to-wd-zpool" | |
223 | serve: | |
224 | type: tls | |
225 | listen: :${builtins.toString config.myEnv.ports.zrepl_flony} | |
226 | ca: ${config.secrets.fullPaths."zrepl/certificates/flony.crt"} | |
227 | cert: ${config.secrets.fullPaths."zrepl/certificates/eldiron.crt"} | |
228 | key: ${config.secrets.fullPaths."zrepl/eldiron.key"} | |
229 | client_cns: | |
230 | - flony | |
231 | filesystems: | |
232 | "zpool/root": true | |
233 | "zpool/root/etc": true | |
234 | "zpool/root/var<": true | |
235 | "zfast/root/var<": true | |
236 | send: | |
237 | encrypted: true | |
238 | snapshotting: | |
239 | type: manual | |
5dda316b IB |
240 | ''; |
241 | }; | |
f807d917 IB |
242 | # This value determines the NixOS release with which your system is |
243 | # to be compatible, in order to avoid breaking some software such as | |
244 | # database servers. You should change this only after NixOS release | |
245 | # notes say you should. | |
61ebe69b | 246 | # https://nixos.org/nixos/manual/release-notes.html |
d43e0c61 | 247 | system.stateVersion = "20.03"; # Did you read the comment? |
f807d917 | 248 | } |