{ network = { description = "Immae's network"; enableRollback = true; }; # Full backup: # The star after /var/lib/* avoids deleting all folders in case of problem # rsync -e "ssh -i /root/.ssh/id_charon_vpn" -aAXvz --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu: eldiron = { config, pkgs, mylibs, myconfig, ... }: with mylibs; let mypkgs = pkgs.callPackage ./packages.nix { inherit checkEnv fetchedGit fetchedGithub; }; in { _module.args = { mylibs = import ../libs.nix; myconfig = { ips = { main = "176.9.151.89"; production = "176.9.151.154"; integration = "176.9.151.155"; }; }; }; imports = [ ./modules/certificates.nix ./modules/gitolite.nix ./modules/gitweb ./modules/databases.nix ./modules/websites ./modules/websites/phpfpm ]; services.myGitolite.enable = true; services.myGitweb.enable = true; services.myDatabases.enable = true; services.myWebsites.production.enable = true; services.myWebsites.integration.enable = true; networking = { firewall = { enable = true; allowedTCPPorts = [ 22 9418 ]; }; }; deployment = { targetEnv = "hetzner"; hetzner = { #robotUser = "defined in HETZNER_ROBOT_USER"; #robotPass = "defined in HETZNER_ROBOT_PASS"; mainIPv4 = myconfig.ips.main; partitions = '' clearpart --all --initlabel --drives=sda,sdb part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb part raid.1 --grow --ondisk=sda part raid.2 --grow --ondisk=sdb raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2 ''; }; }; environment.systemPackages = let # FIXME: move it to nextcloud occ = pkgs.writeScriptBin "nextcloud-occ" '' #! ${pkgs.stdenv.shell} cd ${mypkgs.nextcloud.webRoot} NEXTCLOUD_CONFIG_DIR="${mypkgs.nextcloud.webRoot}/config" \ exec \ ${pkgs.php}/bin/php \ -c ${pkgs.php}/etc/php.ini \ occ $* ''; in [ pkgs.telnet pkgs.htop pkgs.vim occ ]; security.acme.certs."eldiron".extraDomains = { "db-1.immae.eu" = null; "tools.immae.eu" = null; "cloud.immae.eu" = null; "dav.immae.eu" = null; }; services.openssh.extraConfig = '' AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys AuthorizedKeysCommandUser nobody ''; services.ympd = mypkgs.ympd.config // { enable = false; }; services.myPhpfpm = { phpPackage = pkgs.php; phpOptions = '' session.save_path = "/var/lib/php/sessions" session.gc_maxlifetime = 60*60*24*15 session.cache_expire = 60*24*30 ''; extraConfig = '' log_level = notice ''; poolPhpConfigs = { nextcloud = mypkgs.nextcloud.phpFpm.phpConfig; }; poolConfigs = { adminer = mypkgs.adminer.phpFpm.pool; nextcloud = mypkgs.nextcloud.phpFpm.pool; mantisbt = mypkgs.mantisbt.phpFpm.pool; ttrss = mypkgs.ttrss.phpFpm.pool; roundcubemail = mypkgs.roundcubemail.phpFpm.pool; davical = mypkgs.davical.phpFpm.pool; }; }; system.activationScripts = { nextcloud = mypkgs.nextcloud.activationScript; ttrss = mypkgs.ttrss.activationScript; roundcubemail = mypkgs.roundcubemail.activationScript; httpd = '' install -d -m 0755 /var/lib/acme/acme-challenge install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical ''; }; environment.etc."ssh/ldap_authorized_keys" = let ldap_authorized_keys = assert checkEnv "NIXOPS_SSHD_LDAP_PASSWORD"; wrap { name = "ldap_authorized_keys"; file = ./ldap_authorized_keys.sh; vars = { LDAP_PASS = builtins.getEnv "NIXOPS_SSHD_LDAP_PASSWORD"; GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell"; ECHO = "${pkgs.coreutils}/bin/echo"; }; paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ]; }; in { enable = true; mode = "0755"; user = "root"; source = ldap_authorized_keys; }; systemd.services.tt-rss = { description = "Tiny Tiny RSS feeds update daemon"; serviceConfig = { User = "wwwrun"; ExecStart = "${pkgs.php}/bin/php ${mypkgs.ttrss.webRoot}/update.php --daemon"; StandardOutput = "syslog"; StandardError = "syslog"; PermissionsStartOnly = true; }; wantedBy = [ "multi-user.target" ]; requires = ["postgresql.service"]; after = ["network.target" "postgresql.service"]; }; }; }