X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fsystem%2Feldiron.nix;h=e1186f526b6276e9d0f471a2e9bec95a5ac18095;hb=3f453c7d8f79dcf2fba94287ec286d55eceb99d1;hp=48cba0c42fea533327cd38cfffbcd124d03e7b39;hpb=61ebe69b4b2d88bf627f53141288600f7562c750;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/system/eldiron.nix b/modules/private/system/eldiron.nix
index 48cba0c..e1186f5 100644
--- a/modules/private/system/eldiron.nix
+++ b/modules/private/system/eldiron.nix
@@ -1,36 +1,49 @@
 { privateFiles }:
-{ config, pkgs, myconfig, ... }:
+{ config, pkgs, ... }:
 {
   boot.kernelPackages = pkgs.linuxPackages_latest;
-  _module.args.privateFiles = privateFiles;
+  myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; };
+  hostEnv.FQDN = "eldiron.immae.eu";
 
   networking = {
     firewall.enable = true;
     # 176.9.151.89 declared in nixops -> infra / tools
     interfaces."eth0".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList
       (n: ips: { address = ips.ip4; prefixLength = 32; })
-      (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") myconfig.env.servers.eldiron.ips);
+      (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.myEnv.servers.eldiron.ips);
     interfaces."eth0".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
       (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
-      myconfig.env.servers.eldiron.ips);
+      config.myEnv.servers.eldiron.ips);
   };
 
   imports = builtins.attrValues (import ../..);
 
+  boot.kernel.sysctl = {
+    # https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md
+    "net.ipv4.tcp_sack" = 0;
+  };
   myServices.buildbot.enable = true;
   myServices.databases.enable = true;
   myServices.gitolite.enable = true;
+  myServices.monitoring.enable = true;
   myServices.irc.enable = true;
   myServices.pub.enable = true;
   myServices.tasks.enable = true;
+  myServices.mpd.enable = true;
+  myServices.dns.enable = true;
+  myServices.certificates.enable = true;
+  myServices.websites.enable = true;
+  myServices.mail.enable = true;
+  myServices.ejabberd.enable = true;
   services.pure-ftpd.enable = true;
+  services.duplyBackup.enable = true;
 
   deployment = {
     targetEnv = "hetzner";
     hetzner = {
-      robotUser = myconfig.env.hetzner.user;
-      robotPass = myconfig.env.hetzner.pass;
-      mainIPv4 = myconfig.env.servers.eldiron.ips.main.ip4;
+      robotUser = config.myEnv.hetzner.user;
+      robotPass = config.myEnv.hetzner.pass;
+      mainIPv4 = config.myEnv.servers.eldiron.ips.main.ip4;
       partitions = ''
         clearpart --all --initlabel --drives=sda,sdb
 
@@ -47,6 +60,7 @@
 
   services.cron = {
     enable = true;
+    mailto = "cron@immae.eu";
     systemCronJobs = [
       ''
         # The star after /var/lib/* avoids deleting all folders in case of problem