1 { config, pkgs, resources, name, lib, flakes, ... }:
5 targetHost = lib.head config.hostEnv.ips.main.ip4;
7 # ssh-keyscan backup-2 | nix-shell -p ssh-to-age --run ssh-to-age
8 secrets.ageKeys = [ "age1kk3nr27qu42j28mcfdag5lhq0zu2pky7gfanvne8l4z2ctevjpgskmw0sr" ];
10 "rsync_backup/identity" = {
14 text = config.myEnv.rsync_backup.ssh_key.private;
16 "rsync_backup/identity.pub" = {
20 text = config.myEnv.rsync_backup.ssh_key.public;
23 boot.kernelPackages = pkgs.linuxPackages_latest;
24 myEnv = import ../../../nixops/secrets/environment.nix;
26 imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ] ++ builtins.attrValues (import ../.. flakes);
31 device = "UUID=b9425333-f567-435d-94d8-b26c22d93426";
33 "/" = { device = "/dev/sda1"; fsType = "ext4"; };
37 firewall.enable = true;
38 interfaces."ens3".ipv4.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
39 (n: ips: map (ip: { address = ip; prefixLength = 32; }) (ips.ip4 or []))
40 (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips));
41 interfaces."ens3".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
42 (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
44 defaultGateway6 = { address = "fe80::1"; interface = "ens3"; };
47 boot.loader.grub.device = "nodev";
49 myServices.certificates.enable = true;
50 security.acme.certs."${name}" = {
51 group = config.services.nginx.group;
55 recommendedOptimisation = true;
56 recommendedGzipSettings = true;
57 recommendedProxySettings = true;
59 networking.firewall.allowedTCPPorts = [ 80 443 ];
62 mailto = "cron@immae.eu";
66 myServices.chatonsProperties.hostings.rsync-backup = {
67 file.datetime = "2022-08-27T16:00:00";
69 name = "Rsync backups";
70 description = "Remote initiated rsync backups";
71 website = "backup-2.v.immae.eu";
73 status.description = "OK";
74 registration.load = "OPEN";
75 install.type = "PACKAGE";
79 website = "https://rsync.samba.org/";
80 license.url = "https://rsync.samba.org/GPL.html";
81 license.name = "GNU General Public License version 3";
82 version = pkgs.rsync.version;
83 source.url = "https://github.com/WayneD/rsync";
87 services.rsyncBackup = {
88 mountpoint = "/backup2";
89 profiles = config.myEnv.rsync_backup.profiles;
90 ssh_key_public = config.secrets.fullPaths."rsync_backup/identity.pub";
91 ssh_key_private = config.secrets.fullPaths."rsync_backup/identity";
94 myServices.mailRelay.enable = true;
95 myServices.mailBackup.enable = true;
96 myServices.monitoring.enable = true;
97 myServices.databasesReplication = {
101 mainPackage = pkgs.postgresql;
105 connection = "postgresql://backup-2:${config.hostEnv.ldap.password}@eldiron.immae.eu";
106 package = pkgs.postgresql;
116 # mysql resolves "backup-2" host and checks the ip, but uses /etc/hosts which only contains ip4
117 host = lib.head config.myEnv.servers.eldiron.ips.main.ip4;
120 password = config.hostEnv.ldap.password;
122 dumpPassword = config.myEnv.databases.mysql.systemUsers.root;
141 url = "ldaps://${config.myEnv.ldap.host}:636";
142 dn = config.myEnv.ldap.replication_dn;
143 password = config.myEnv.ldap.replication_pw;
144 base = config.myEnv.ldap.base;
150 # This value determines the NixOS release with which your system is
151 # to be compatible, in order to avoid breaking some software such as
152 # database servers. You should change this only after NixOS release
153 # notes say you should.
154 # https://nixos.org/nixos/manual/release-notes.html
155 system.stateVersion = "20.03"; # Did you read the comment?