1 { config, pkgs, lib, ... }:
3 serverSpecificConfig = config.myEnv.serverSpecific.quatresaisons;
4 yarnModules = pkgs.yarn2nix-moretea.mkYarnModules rec {
8 packageJSON = "${pkgs.sources.webapps-landing}/package.json";
9 yarnLock = "${pkgs.sources.webapps-landing}/yarn.lock";
10 yarnNix = ../websites/tools/tools/landing/yarn-packages.nix;
12 toLanding = landingConfig: pkgs.stdenv.mkDerivation rec {
15 src = pkgs.sources.webapps-landing;
17 buildInputs = [ yarnModules pkgs.yarn2nix-moretea.yarn ];
19 ln -s ${yarnModules}/node_modules .
26 cp -f ${landingConfig} $out/config.yml
27 ln -s service-worker.js $out/worker.js
30 normalUsers = serverSpecificConfig.users;
31 userquotas = pkgs.writeScriptBin "user_quotas" ''
35 if [ `whoami` != "root" ]; then
38 list="${builtins.concatStringsSep " " (lib.mapAttrsToList (n: v: builtins.toString v.uid) normalUsers)}"
43 home=$((du -sbx /home/$user 2>/dev/null | cut -d" " -f1) || echo 0)
44 nextcloud=$((du -sbx /home/var_lib/nextcloud/data/$user 2>/dev/null | cut -d" " -f1) || echo 0)
45 echo "Home: $(numfmt --to=iec "$home")"
46 echo "Nextcloud: $(numfmt --to=iec "$nextcloud")"
47 echo "Raw: $(($home + $nextcloud))"
51 group=$(id -ng "$user")
52 size=$(get_size "$group")
53 total=$(echo "$size" | grep ^Raw | cut -d" " -f2)
54 decomp=" $group: $(numfmt --to=iec "$total")"
55 decomp="$decomp;$(echo "$size" | grep -v ^Raw | sed -e "s/^/ /")"
57 sponsored=$(getent group $group | cut -d':' -f4)
59 for subuser in $sponsored; do
60 size=$(get_size "$subuser")
61 totalsub=$(echo "$size" | grep ^Raw | cut -d" " -f2)
62 total=$(($total + $totalsub))
63 decomp="$decomp; $subuser: $(numfmt --to=iec "$totalsub")"
64 decomp="$decomp;$(echo "$size" | grep -v ^Raw | sed -e "s/^/ /")"
66 echo "$group: $(numfmt --to=iec "$total")"
67 echo "$decomp" | tr ";" "\n"
70 sponsoredUser = pkgs.writeScriptBin "sponsored_user" ''
74 [ -z "''${SUDO_USER+x}" ] && echo "Must be run with sudo" && exit 1
76 mygroup=$(id -ng $SUDO_USER)
78 sponsored=$(getent group $mygroup | cut -d':' -f4)
80 echo "Sponsored users: ''${sponsored:-<none>}"
83 touch /var/log/sponsored_users
84 chmod go-rwx /var/log/sponsored_users
85 echo "`date` $mygroup $1" | LANG=C cat -v | tr '\012' ' ' | sed 's:$:\x0a:' >> /var/log/sponsored_users
90 useradd -m -G users,$mygroup -g $mygroup -p '!' "$1"
91 touch /var/lib/nixos/sponsored_users
92 chmod go-rwx /var/lib/nixos/sponsored_users
93 echo "$mygroup $1 $2" >> /var/lib/nixos/sponsored_users
94 (${pkgs.openldap}/bin/ldapadd -c -D cn=root,dc=salle-s,dc=org \
95 -y ${config.secrets.fullPaths."ldap/sync_password"} 2>/dev/null >/dev/null || true) <<EOF
96 dn: uid=$1,uid=$mygroup,ou=users,dc=salle-s,dc=org
97 objectClass: inetOrgPerson
99 description:: $(echo -n "$2" | base64)
103 while ! passwd "$1"; do
104 echo "please give an initial password"
110 for u in $sponsored; do
111 if [ "$u" = "$1" ]; then
114 sed -i -e "/^$mygroup $1/d" /var/lib/nixos/sponsored_users
115 ${pkgs.openldap}/bin/ldapdelete -D cn=root,dc=salle-s,dc=org \
116 -y ${config.secrets.fullPaths."ldap/sync_password"} \
117 "uid=$1,uid=$mygroup,ou=users,dc=salle-s,dc=org"
123 echo "User does not exist or does not belong to you";
129 for u in $sponsored; do
130 if [ "$u" = "$1" ]; then
131 log "resets password for $1"
137 echo "User does not exist or does not belong to you";
141 reset_ldap_password () {
142 if [ "$1" = "$mygroup" ]; then
143 log "resets web password"
144 ${pkgs.openldap}/bin/ldappasswd -D cn=root,dc=salle-s,dc=org \
145 -y ${config.secrets.fullPaths."ldap/sync_password"} \
146 -S "uid=$mygroup,ou=users,dc=salle-s,dc=org"
149 for u in $sponsored; do
150 if [ "$u" = "$1" ]; then
151 log "resets web password of $1"
152 ${pkgs.openldap}/bin/ldappasswd -D cn=root,dc=salle-s,dc=org \
153 -y ${config.secrets.fullPaths."ldap/sync_password"} \
154 -S "uid=$1,uid=$mygroup,ou=users,dc=salle-s,dc=org"
159 echo "User does not exist or does not belong to you";
165 echo "sponsored_users create username realname"
166 echo " create a new sub-user attached to your account"
167 echo "sponsored_users (delete|reset_password) username"
168 echo " delete a sub-user attached to your account or reset his password"
169 echo "sponsored_users reset_ldap_password username"
170 echo " reset the web password of a sub-user or yourself"
173 [ -z "''${1+x}" -o -z "''${2+x}" ] && { show_help ; exit 0; }
181 [ -z "''${1+x}" ] && { show_help ; echo "Conformément à la charte https://4c.salle-s.org/charte veuillez préciser le nom réel du futur utilisateur du compte $username, juste pour root." ; exit 1; }
182 create_user "$username" "$*";
185 delete_user "$username";
188 reset_password "$username";
191 reset_ldap_password "$username";
202 targetHost = lib.head config.hostEnv.ips.main.ip4;
204 # ssh-keyscan quatresaison | nix-shell -p ssh-to-age --run ssh-to-age
205 secrets.ageKeys = [ "age1yz8u6xvh2fltvyp96ep8crce3qx4tuceyhun6pwddfe0uvcrkarscxl7e7" ];
207 programs.ssh.package = pkgs.openssh.overrideAttrs(old: {
208 PATH_PASSWD_PROG = "/run/wrappers/bin/passwd";
209 buildFlags = [ "SSH_KEYSIGN=/run/wrappers/bin/ssh-keysign" ];
212 imports = builtins.attrValues (import ../..) ++
213 [ ./quatresaisons/nextcloud.nix ./quatresaisons/databases.nix ];
215 myEnv = import ../../../nixops/secrets/environment.nix;
218 "/" = { device = "/dev/disk/by-uuid/865931b4-c5cc-439f-8e42-8072c7a30634"; fsType = "ext4"; };
219 "/home" = { device = "/dev/disk/by-uuid/76020bc4-5b88-464c-8952-9a59072c597f"; fsType = "ext4"; neededForBoot = true; };
220 "/boot" = { device = "/dev/disk/by-uuid/0fb8421a-61e5-4ed5-a795-4dd3a9b2152a"; fsType = "ext4"; };
221 "/var/lib" = { device = "/home/var_lib"; fsType = "none"; options = [ "defaults,bind" ]; };
223 powerManagement.cpuFreqGovernor = "powersave";
224 hardware.enableRedistributableFirmware = true;
226 boot.initrd.availableKernelModules = [ "ahci" "megaraid_sas" "sd_mod" ];
227 boot.initrd.kernelModules = [ "dm-snapshot" ];
228 boot.kernelModules = [ "kvm-intel" ];
230 boot.loader.grub.enable = true;
231 boot.loader.grub.version = 2;
232 boot.loader.grub.device = "/dev/sda";
234 networking.firewall.enable = false;
235 networking.firewall.allowedTCPPorts = [ 80 443 ];
236 networking.useDHCP = false;
237 networking.interfaces.eth0.useDHCP = true;
238 networking.interfaces.eth0.ipv6.addresses = [
239 { address = pkgs.lib.head config.hostEnv.ips.main.ip6; prefixLength = 64; }
241 networking.defaultGateway6 = { address = "fe80::1"; interface = "eth0"; };
242 services.udev.extraRules = ''
243 ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="c8:60:00:8b:2f:f0", NAME="eth0"
245 security.pam.services.chage.text = ''
246 auth sufficient pam_rootok.so
247 auth required pam_unix.so
248 account required pam_unix.so
249 session required pam_unix.so
250 password required pam_permit.so
252 security.pam.services.sshd.makeHomeDir = true;
253 security.pam.services.passwd_default = {};
254 security.pam.services.passwd.text = ''
255 password required pam_cracklib.so enforce_for_root difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
256 '' + config.security.pam.services.passwd_default.text;
258 system.activationScripts.ldapSync = {
259 deps = [ "secrets" "users" ];
262 com = "-D cn=root,dc=salle-s,dc=org -y ${config.secrets.fullPaths."ldap/sync_password"}";
265 ${pkgs.openldap}/bin/ldapadd -c ${com} -f ${config.secrets.fullPaths."ldap/ldaptree.ldif"} 2>/dev/null >/dev/null || true
267 # Remove obsolete users
268 ${pkgs.openldap}/bin/ldapsearch -LLL ${com} -s one -b "ou=users,dc=salle-s,dc=org" "uid" |\
269 grep "^uid" | ${pkgs.gnused}/bin/sed -e "s/uid: //" | while read ldapuser; do
271 for user in ${builtins.concatStringsSep " " (builtins.attrNames normalUsers)}; do
272 if [ "$user" = "$ldapuser" ]; then
276 ${pkgs.openldap}/bin/ldapdelete -r ${com} uid=$ldapuser,ou=users,dc=salle-s,dc=org
280 if [ -f /var/lib/nixos/sponsored_users ]; then
281 cat /var/lib/nixos/sponsored_users | while read mainUser subUser name; do
282 (${pkgs.openldap}/bin/ldapadd -c ${com} 2>/dev/null >/dev/null || true) <<EOF
283 dn: uid=$subUser,uid=$mainUser,ou=users,dc=salle-s,dc=org
284 objectClass: inetOrgPerson
286 description:: $(echo -n "$name" | base64)
296 "ldap/sync_password" = {
297 permissions = "0400";
298 text = serverSpecificConfig.ldap_sync_password;
300 "ldap/ldaptree.ldif" = {
301 permissions = "0400";
302 text = serverSpecificConfig.ldap_service_users
303 + (builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: v: ''
304 dn: uid=${n},ou=users,dc=salle-s,dc=org
305 objectClass: inetOrgPerson
307 description: ${v._meta.name or n} ${v._meta.email}
314 myServices.monitoring.enable = true;
315 myServices.certificates.enable = true;
316 users.mutableUsers = true;
317 system.stateVersion = "21.03";
318 programs.zsh.enable = true;
321 Bienvenue sur quatresaisons.salle-s.org !
324 https://4c.salle-s.org/charte
325 * Gérer les utilisateurs unix additionnels :
326 sudo sponsored_user -h
328 * tableau de bord : https://4c.salle-s.org/
329 * nextcloud : https://nextcloud.4c.salle-s.org/
333 lib.mapAttrs (n: v: { gid = v.uid; }) normalUsers
334 // { wwwrun = { gid = config.ids.gids.wwwrun; }; };
339 extraGroups = [ "users" ];
343 lib.mapAttrs (n: v: defaultNormal n // (lib.filterAttrs (k: _: k != "_meta") v)) normalUsers
345 sponsored-separator = {
355 description = "Apache httpd user";
356 uid = config.ids.uids.wwwrun;
357 extraGroups = [ "keys" ];
361 system.activationScripts.usersPost = {
362 deps = [ "users" "groups" ];
363 text = builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: v: ''
364 if getent shadow "${n}" | grep -q '^${n}:${v.initialHashedPassword or "!"}:1'; then
366 [ '${v.initialHashedPassword or "!"}' = '!' ] && passwd -d "${n}"
370 security.sudo.extraRules = [
373 { command = "${sponsoredUser}/bin/sponsored_user"; options = [ "NOPASSWD" ]; }
374 { command = "/run/current-system/sw/bin/sponsored_user"; options = [ "NOPASSWD" ]; }
376 users = builtins.attrNames normalUsers;
381 environment.systemPackages = [
382 sponsoredUser userquotas
383 pkgs.git pkgs.vim pkgs.rsync pkgs.strace pkgs.home-manager
384 pkgs.inetutils pkgs.htop pkgs.iftop pkgs.bind.dnsutils pkgs.httpie
385 pkgs.iotop pkgs.whois pkgs.ngrep pkgs.tcpdump pkgs.wireshark-cli
386 pkgs.tcpflow pkgs.nmap pkgs.p0f pkgs.socat pkgs.lsof pkgs.psmisc
387 pkgs.openssl pkgs.wget pkgs.pv pkgs.smartmontools pkgs.youtube-dl
388 pkgs.unzip pkgs.octave pkgs.feh pkgs.xv pkgs.sshfs pkgs.gdb
389 pkgs.file pkgs.lynx pkgs.tmux pkgs.awesome pkgs.libreoffice
390 pkgs.evince pkgs.firefox pkgs.xcalib pkgs.python3 pkgs.python2
391 pkgs.xorg.xkbcomp pkgs.subversion pkgs.xclip pkgs.imagemagick
392 pkgs.bc pkgs.sox pkgs.zip pkgs.gnome3.gnome-screenshot
393 pkgs.datadog-process-agent
396 services.websites.env.production = {
398 adminAddr = "httpd@immae.eu";
400 modules = [ "http2" "deflate" "filter" ];
403 LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
404 Protocols h2 http/1.1
405 AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
408 let ips = config.hostEnv.ips.main;
409 in (ips.ip4 or []) ++ (ips.ip6 or []);
412 certName = "quatresaisons";
413 hosts = [ "quatresaisons.immae.eu" ];
414 root = pkgs.runCommand "empty" {} "mkdir $out && touch $out/index.html";
415 extraConfig = [ "DirectoryIndex index.html" ];
417 vhostConfs.salle-s = {
418 certName = "quatresaisons";
420 hosts = [ "salle-s.org" ];
421 root = toLanding ./quatresaisons/landing.yml;
424 <Directory ${toLanding ./quatresaisons/landing.yml}>
427 DirectoryIndex index.html
433 certName = "quatresaisons";
435 hosts = [ "4c.salle-s.org" "quatresaisons.salle-s.org" "quatre-saisons.salle-s.org" ];
436 root = toLanding ./quatresaisons/landing_4c.yml;
439 Alias /charte ${serverSpecificConfig.charte_path}
440 <Directory ${serverSpecificConfig.charte_path}>
443 DirectoryIndex index.html index.txt
446 <Directory ${toLanding ./quatresaisons/landing_4c.yml}>
449 DirectoryIndex index.html
455 system.activationScripts.httpd = ''
456 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php
457 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
462 session.save_path = "/var/lib/php/sessions"
465 session.gc_maxlifetime = 1296000
467 session.cache_expire = 43200
470 log_level = "notice";