X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fsystem%2Feldiron.nix;h=4b332d32bc6d5396f320d9b44dd10595a6331782;hb=d43e0c61af84940447dbcdd1deac848328dde46d;hp=d79cf166dc5e889170988a8f5e1639b1201a5fb7;hpb=9f2025235d888eb4a7822024a5fad2e288388814;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/system/eldiron.nix b/modules/private/system/eldiron.nix
index d79cf16..4b332d3 100644
--- a/modules/private/system/eldiron.nix
+++ b/modules/private/system/eldiron.nix
@@ -1,19 +1,18 @@
 { privateFiles }:
-{ config, pkgs, myconfig, ... }:
+{ config, pkgs, ... }:
 {
   boot.kernelPackages = pkgs.linuxPackages_latest;
-  _module.args.privateFiles = privateFiles;
-  _module.args.hostFQDN = "eldiron.immae.eu";
+  myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; };
 
   networking = {
     firewall.enable = true;
     # 176.9.151.89 declared in nixops -> infra / tools
     interfaces."eth0".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList
       (n: ips: { address = ips.ip4; prefixLength = 32; })
-      (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") myconfig.env.servers.eldiron.ips);
+      (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips);
     interfaces."eth0".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
       (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
-      myconfig.env.servers.eldiron.ips);
+      config.hostEnv.ips);
   };
 
   imports = builtins.attrValues (import ../..);
@@ -34,15 +33,35 @@
   myServices.certificates.enable = true;
   myServices.websites.enable = true;
   myServices.mail.enable = true;
+  myServices.ejabberd.enable = true;
+  myServices.vpn.enable = true;
   services.pure-ftpd.enable = true;
   services.duplyBackup.enable = true;
+  services.duplyBackup.profiles.oldies.rootDir = "/var/lib/oldies";
+
+  secrets.keys = [
+    {
+      dest = "rsync_backup/identity";
+      user = "root";
+      group = "root";
+      permissions = "0400";
+      text = config.myEnv.rsync_backup.ssh_key.private;
+    }
+  ];
+  programs.ssh.knownHosts.dilion = {
+    hostNames = ["dilion.immae.eu"];
+    publicKey = let
+      profile = config.myEnv.rsync_backup.profiles.dilion;
+    in
+      "${profile.host_key_type} ${profile.host_key}";
+  };
 
   deployment = {
     targetEnv = "hetzner";
     hetzner = {
-      robotUser = myconfig.env.hetzner.user;
-      robotPass = myconfig.env.hetzner.pass;
-      mainIPv4 = myconfig.env.servers.eldiron.ips.main.ip4;
+      robotUser = config.myEnv.hetzner.user;
+      robotPass = config.myEnv.hetzner.pass;
+      mainIPv4 = config.hostEnv.ips.main.ip4;
       partitions = ''
         clearpart --all --initlabel --drives=sda,sdb
 
@@ -59,10 +78,12 @@
 
   services.cron = {
     enable = true;
+    mailto = "cron@immae.eu";
     systemCronJobs = [
       ''
         # The star after /var/lib/* avoids deleting all folders in case of problem
-        0 3,9,15,21 * * * root rsync -e "ssh -i /root/.ssh/id_charon_vpn" -aAXvz --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu: > /dev/null
+        0 3,9,15,21 * * * root rsync -e "ssh -i /var/secrets/rsync_backup/identity" --new-compress -aAXv --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* backup@dilion.immae.eu: > /dev/null
+        0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -g "immae.eu.*Recipient address rejected"
       ''
     ];
   };
@@ -72,5 +93,5 @@
   # database servers. You should change this only after NixOS release
   # notes say you should.
   # https://nixos.org/nixos/manual/release-notes.html
-  system.stateVersion = "19.03"; # Did you read the comment?
+  system.stateVersion = "20.03"; # Did you read the comment?
 }