1 { pkgs, lib, config, name, nodes, ... }:
4 deployment.secrets."secret_vars.yml" = {
5 source = builtins.toString ../../nixops/secrets/vars.yml;
6 destination = config.secrets.secretsVars;
12 networking.extraHosts = builtins.concatStringsSep "\n"
13 (lib.mapAttrsToList (n: v: "${lib.head v.config.hostEnv.ips.main.ip4} ${n}") nodes);
15 users.extraUsers.root.openssh.authorizedKeys.keys = [ config.myEnv.sshd.rootKeys.nix_repository ];
16 secrets.deleteSecretsVars = true;
18 ../../nixops/public_keys/Immae.pub
20 secrets.secretsVars = "/run/keys/vars.yml";
22 services.openssh.enable = true;
24 nixpkgs.overlays = builtins.attrValues (import ../../overlays) ++ [
26 postgresql = self.postgresql_pam;
27 mariadb = self.mariadb_pam;
28 }) # don’t put them as generic overlay because of home-manager
30 nixpkgs.config.permittedInsecurePackages = [
34 services.journald.extraConfig = ''
35 #Should be "warning" but disabled for now, it prevents anything from being stored
41 builtins.listToAttrs (map (x: lib.attrsets.nameValuePair x.name ({
43 home = "/home/${x.name}";
46 # Enable in latest unstable homeMode = "755";
47 } // x)) (config.hostEnv.users pkgs))
50 nagios-cli = pkgs.writeScriptBin "nagios-cli" ''
51 #!${pkgs.stdenv.shell}
52 sudo -u naemon ${pkgs.nagios-cli}/bin/nagios-cli -c ${./monitoring/nagios-cli.cfg}
67 # pkgs.mitmproxy # failing
84 users.mutableUsers = lib.mkDefault false;
86 environment.etc.cnagios.source = "${pkgs.cnagios}/share/doc/cnagios";
87 environment.systemPackages = [
93 (lib.optional (builtins.length (config.hostEnv.users pkgs) > 0) pkgs.home-manager);
95 systemd.targets.maintenance = {
96 description = "Maintenance target with only sshd";
97 after = [ "network-online.target" "sshd.service" ];
98 requires = [ "network-online.target" "sshd.service" ];
99 unitConfig.AllowIsolate = "yes";