enableRollback = true;
};
- eldiron = { config, pkgs, ... }:
- with import ../libs.nix;
+ eldiron = { config, pkgs, mylibs, ... }:
+ with mylibs;
let
mypkgs = pkgs.callPackage ./packages.nix {
inherit checkEnv fetchedGit fetchedGitPrivate fetchedGithub;
};
in
{
+ _module.args = {
+ mylibs = import ../libs.nix;
+ };
+
+ imports = [
+ ./modules/gitolite.nix
+ ./modules/gitweb.nix
+ ./modules/databases.nix
+ ];
+ services.myGitolite.enable = true;
+ services.myGitweb.enable = true;
+ services.myDatabases.enable = true;
+
nixpkgs.config.packageOverrides = oldpkgs: rec {
- gitolite = oldpkgs.gitolite.overrideAttrs(old: rec {
- name = "gitolite-${version}";
- version = "3.6.10";
- src = pkgs.fetchFromGitHub {
- owner = "sitaramc";
- repo = "gitolite";
- rev = "v${version}";
- sha256 = "0p2697mn6rwm03ndlv7q137zczai82n41aplq1g006ii7f12xy8h";
- };
- });
- gitweb = oldpkgs.gitweb.overrideAttrs(old: {
- installPhase = old.installPhase + ''
- cp -r ${./packages/gitweb} $out/gitweb-theme;
- '';
- });
- postgresql = postgresql111;
- postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
- passthru = old.passthru // { psqlSchema = "11.0"; };
- name = "postgresql-11.1";
- src = pkgs.fetchurl {
- url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
- sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
- };
- });
- mariadb = mariadbPAM;
- mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec {
- cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
- buildInputs = old.buildInputs ++ [ pkgs.pam ];
- });
goaccess = oldpkgs.goaccess.overrideAttrs(old: rec {
name = "goaccess-${version}";
version = "1.3";
networking = {
firewall = {
enable = true;
- allowedTCPPorts = [ 22 80 443 3306 5432 9418 ];
+ allowedTCPPorts = [ 22 80 443 9418 ];
};
};
allowKeysForGroup = true;
extraDomains = {
"db-1.immae.eu" = null;
- "git.immae.eu" = null;
"tools.immae.eu" = null;
"connexionswing.immae.eu" = null;
"sandetludo.immae.eu" = null;
AuthorizedKeysCommandUser nobody
'';
- users.users.wwwrun.extraGroups = [ "gitolite" ];
-
- users.users.gitolite.packages = let
- python-packages = python-packages: with python-packages; [
- simplejson
- urllib3
- ];
- in
- [
- (pkgs.python3.withPackages python-packages)
- ];
- # FIXME: after initial install, need to
- # (1) copy rc file (adjust gitolite_ldap_groups.sh)
- # (2) (mark old readonly and) sync repos except gitolite-admin
- # rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/
- # chown -R gitolite:gitolite /var/lib/gitolite
- # (3) push force the gitolite-admin to new location (from external point)
- # Don't use an existing key, it will take precedence over
- # gitolite-admin
- # (4) su -u gitolite gitolite setup
- services.gitolite = {
- enable = true;
- # FIXME: key from ./ssh
- adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu";
- };
-
services.ympd = mypkgs.ympd.config // { enable = false; };
services.phpfpm = {
mkdir -p /run/redis
chown redis /run/redis
'';
- gitolite =
- assert checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
- let
- gitolite_ldap_groups = wrap {
- name = "gitolite_ldap_groups.sh";
- file = ./packages/gitolite_ldap_groups.sh;
- vars = {
- LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
- };
- paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
- };
- in {
- deps = [ "users" ];
- text = ''
- if [ -d /var/lib/gitolite ]; then
- ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh
- chmod g+rx /var/lib/gitolite
- fi
- if [ -f /var/lib/gitolite/projects.list ]; then
- chmod g+r /var/lib/gitolite/projects.list
- fi
- '';
- };
# FIXME: initial sync
goaccess = ''
mkdir -p /var/lib/goaccess
];
};
- security.pam.services = let
- pam_ldap = pkgs.pam_ldap;
- pam_ldap_mysql = assert checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
- pkgs.writeText "mysql.conf" ''
- host ldap.immae.eu
- base dc=immae,dc=eu
- binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
- bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
- pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
- '';
- in [
- {
- name = "mysql";
- text = ''
- # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
- auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
- account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
- '';
- }
- ];
-
- # FIXME: backup
- # Nextcloud: 14
- services.redis = rec {
- enable = true;
- bind = "127.0.0.1";
- unixSocket = "/run/redis/redis.sock";
- extraConfig = ''
- unixsocketperm 777
- maxclients 1024
- '';
- };
-
- # FIXME: initial sync
- # FIXME: backup
- # FIXME: restart after pam
- # FIXME: pam access doesn’t work (because of php module)
- # FIXME: ssl
- services.mysql = rec {
- enable = true;
- package = pkgs.mariadb;
- };
-
- # FIXME: initial sync
- # FIXME: backup
- # FIXME: ssl
- services.postgresql = rec {
- enable = true;
- package = pkgs.postgresql;
- enableTCPIP = true;
- extraConfig = ''
- max_connections = 100
- wal_level = logical
- shared_buffers = 128MB
- max_wal_size = 1GB
- min_wal_size = 80MB
- log_timezone = 'Europe/Paris'
- datestyle = 'iso, mdy'
- timezone = 'Europe/Paris'
- lc_messages = 'en_US.UTF-8'
- lc_monetary = 'en_US.UTF-8'
- lc_numeric = 'en_US.UTF-8'
- lc_time = 'en_US.UTF-8'
- default_text_search_config = 'pg_catalog.english'
- # ssl = on
- # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
- # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
- '';
- authentication = ''
- local all postgres ident
- local all all md5
- host all all samehost md5
- host all all 178.33.252.96/32 md5
- host all all 188.165.209.148/32 md5
- #host all all all pam
- '';
- };
-
services.cron = {
enable = true;
systemCronJobs = let
projects / perso / Immae / Config / Nix.git / blobdiff