X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fsystem.nix;h=5f3d79e2850b727a88bcfba235e2a5f887cc8f7e;hb=5315b439af1f72c3282549508ae58d86d66e38ec;hp=b4080ecf971ed5cce33c4a0b6c1196e45f218a4e;hpb=9dd3eb0b58d4c38910ba9dd6d1cce5a41168421a;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/system.nix b/modules/private/system.nix
index b4080ec..5f3d79e 100644
--- a/modules/private/system.nix
+++ b/modules/private/system.nix
@@ -1,28 +1,37 @@
-{ pkgs, lib, config, name, ... }:
+{ pkgs, lib, config, name, nodes, ... }:
 {
   config = {
-    services.duplyBackup.profiles.system = {
-      rootDir = "/var/lib";
-      excludeFile = lib.mkAfter ''
-        + /var/lib/nixos
-        + /var/lib/udev
-        + /var/lib/udisks2
-        + /var/lib/systemd
-        + /var/lib/private/systemd
-        - /var/lib
-        '';
+    deployment.secrets."secret_vars.yml" = {
+      source = builtins.toString ../../nixops/secrets/vars.yml;
+      destination = config.secrets.secretsVars;
+      owner.user = "root";
+      owner.group = "root";
+      permissions = "0400";
     };
+
+    networking.extraHosts = builtins.concatStringsSep "\n"
+      (lib.mapAttrsToList (n: v: "${v.config.hostEnv.ips.main.ip4} ${n}") nodes);
+
+    users.extraUsers.root.openssh.authorizedKeys.keys = [ config.myEnv.sshd.rootKeys.nix_repository ];
+    secrets.deleteSecretsVars = true;
+    secrets.gpgKeys = [
+      ../../nixops/public_keys/Immae.pub
+    ];
+    secrets.secretsVars = "/run/keys/vars.yml";
+
+    services.openssh.enable = true;
+
     nixpkgs.overlays = builtins.attrValues (import ../../overlays) ++ [
-      (self: super: { postgresql = self.postgresql_pam; }) # don’t put it as generic overlay for home-manager
+      (self: super: {
+        postgresql = self.postgresql_pam;
+        mariadb = self.mariadb_pam;
+      }) # don’t put them as generic overlay because of home-manager
     ];
-    _module.args = {
-      pkgsNext = import <nixpkgsNext> {};
-      pkgsPrevious = import <nixpkgsPrevious> {};
-    };
 
     services.journald.extraConfig = ''
-      MaxLevelStore="warning"
-      MaxRetentionSec="1year"
+      #Should be "warning" but disabled for now, it prevents anything from being stored
+      MaxLevelStore=info
+      MaxRetentionSec=1year
       '';
 
     users.users =
@@ -51,7 +60,7 @@
             pkgs.tcpdump
             pkgs.tshark
             pkgs.tcpflow
-            pkgs.mitmproxy
+            # pkgs.mitmproxy # failing
             pkgs.nmap
             pkgs.p0f
             pkgs.socat
@@ -62,16 +71,28 @@
 
             pkgs.cnagios
             nagios-cli
+
+            pkgs.pv
+            pkgs.smartmontools
           ];
       };
 
-    users.mutableUsers = false;
+    users.mutableUsers = lib.mkDefault false;
 
     environment.etc.cnagios.source = "${pkgs.cnagios}/share/doc/cnagios";
     environment.systemPackages = [
       pkgs.git
       pkgs.vim
+      pkgs.rsync
+      pkgs.strace
     ] ++
     (lib.optional (builtins.length (config.hostEnv.users pkgs) > 0) pkgs.home-manager);
+
+    systemd.targets.maintenance = {
+      description = "Maintenance target with only sshd";
+      after = [ "network-online.target" "sshd.service" ];
+      requires = [ "network-online.target" "sshd.service" ];
+      unitConfig.AllowIsolate = "yes";
+    };
   };
 }