X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=virtual%2Feldiron.nix;h=acd2cbd3a410e2cf678585a86456354167c3891e;hb=4d4f13f4a8e7df6480da895d80d487c891441745;hp=7dbca92de0e99376ec3bb55db959ccfb60acc79a;hpb=43b726ed3ba5e9a5ce91f7b39ffbe895d3ada18b;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/virtual/eldiron.nix b/virtual/eldiron.nix
index 7dbca92..acd2cbd 100644
--- a/virtual/eldiron.nix
+++ b/virtual/eldiron.nix
@@ -4,44 +4,28 @@
     enableRollback = true;
   };
 
-  eldiron = { config, pkgs, ... }:
-    with import ../libs.nix;
+  eldiron = { config, pkgs, mylibs, ... }:
+    with mylibs;
     let
         mypkgs = pkgs.callPackage ./packages.nix {
           inherit checkEnv fetchedGit fetchedGitPrivate fetchedGithub;
         };
     in
   {
+    _module.args = {
+      mylibs = import ../libs.nix;
+    };
+
+    imports = [
+      ./modules/gitolite.nix
+      ./modules/gitweb.nix
+      ./modules/databases.nix
+    ];
+    services.myGitolite.enable = true;
+    services.myGitweb.enable = true;
+    services.myDatabases.enable = true;
+
     nixpkgs.config.packageOverrides = oldpkgs: rec {
-      gitolite = oldpkgs.gitolite.overrideAttrs(old: rec {
-        name = "gitolite-${version}";
-        version = "3.6.10";
-        src = pkgs.fetchFromGitHub {
-          owner = "sitaramc";
-          repo = "gitolite";
-          rev = "v${version}";
-          sha256 = "0p2697mn6rwm03ndlv7q137zczai82n41aplq1g006ii7f12xy8h";
-        };
-      });
-      gitweb = oldpkgs.gitweb.overrideAttrs(old: {
-        installPhase = old.installPhase + ''
-          cp -r ${./packages/gitweb} $out/gitweb-theme;
-          '';
-      });
-      postgresql = postgresql111;
-      postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
-        passthru = old.passthru // { psqlSchema = "11.0"; };
-        name = "postgresql-11.1";
-        src = pkgs.fetchurl {
-          url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
-          sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
-        };
-      });
-      mariadb = mariadbPAM;
-      mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec {
-        cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
-        buildInputs = old.buildInputs ++ [ pkgs.pam ];
-      });
       goaccess = oldpkgs.goaccess.overrideAttrs(old: rec {
         name = "goaccess-${version}";
         version = "1.3";
@@ -57,7 +41,7 @@
     networking = {
       firewall = {
         enable = true;
-        allowedTCPPorts = [ 22 80 443 3306 5432 9418 ];
+        allowedTCPPorts = [ 22 80 443 9418 ];
       };
     };
 
@@ -116,7 +100,6 @@
         allowKeysForGroup = true;
         extraDomains = {
           "db-1.immae.eu" = null;
-          "git.immae.eu" = null;
           "tools.immae.eu" = null;
           "connexionswing.immae.eu" = null;
           "sandetludo.immae.eu" = null;
@@ -197,32 +180,6 @@
       AuthorizedKeysCommandUser nobody
       '';
 
-    users.users.wwwrun.extraGroups = [ "gitolite" ];
-
-    users.users.gitolite.packages = let
-      python-packages = python-packages: with python-packages; [
-        simplejson
-        urllib3
-      ];
-    in
-      [
-        (pkgs.python3.withPackages python-packages)
-      ];
-    # FIXME: after initial install, need to
-    # (1) copy rc file (adjust gitolite_ldap_groups.sh)
-    # (2) (mark old readonly and) sync repos except gitolite-admin
-    #     rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/
-    #     chown -R gitolite:gitolite /var/lib/gitolite
-    # (3) push force the gitolite-admin to new location (from external point)
-    #     Don't use an existing key, it will take precedence over
-    #     gitolite-admin
-    # (4) su -u gitolite gitolite setup
-    services.gitolite = {
-      enable = true;
-      # FIXME: key from ./ssh
-      adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu";
-    };
-
     services.ympd = mypkgs.ympd.config // { enable = false; };
 
     services.phpfpm = {
@@ -288,29 +245,6 @@
         mkdir -p /run/redis
         chown redis /run/redis
         '';
-      gitolite =
-        assert checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
-        let
-        gitolite_ldap_groups = wrap {
-          name = "gitolite_ldap_groups.sh";
-          file = ./packages/gitolite_ldap_groups.sh;
-          vars = {
-            LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
-          };
-          paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
-        };
-      in {
-        deps = [ "users" ];
-        text = ''
-          if [ -d /var/lib/gitolite ]; then
-            ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh
-            chmod g+rx /var/lib/gitolite
-          fi
-          if [ -f /var/lib/gitolite/projects.list ]; then
-            chmod g+r /var/lib/gitolite/projects.list
-          fi
-        '';
-      };
       # FIXME: initial sync
       goaccess = ''
         mkdir -p /var/lib/goaccess
@@ -590,84 +524,6 @@
       ];
     };
 
-    security.pam.services = let
-      pam_ldap = pkgs.pam_ldap;
-      pam_ldap_mysql = assert checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
-              pkgs.writeText "mysql.conf" ''
-        host ldap.immae.eu
-        base dc=immae,dc=eu
-        binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
-        bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
-        pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
-        '';
-    in [
-      {
-        name = "mysql";
-        text = ''
-          # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
-          auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
-          account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
-          '';
-      }
-    ];
-
-    # FIXME: backup
-    # Nextcloud: 14
-    services.redis = rec {
-      enable = true;
-      bind = "127.0.0.1";
-      unixSocket = "/run/redis/redis.sock";
-      extraConfig = ''
-        unixsocketperm 777
-        maxclients 1024
-        '';
-    };
-
-    # FIXME: initial sync
-    # FIXME: backup
-    # FIXME: restart after pam
-    # FIXME: pam access doesn’t work (because of php module)
-    # FIXME: ssl
-    services.mysql = rec {
-      enable = true;
-      package = pkgs.mariadb;
-    };
-
-    # FIXME: initial sync
-    # FIXME: backup
-    # FIXME: ssl
-    services.postgresql = rec {
-      enable = true;
-      package = pkgs.postgresql;
-      enableTCPIP = true;
-      extraConfig = ''
-        max_connections = 100
-        wal_level = logical
-        shared_buffers = 128MB
-        max_wal_size = 1GB
-        min_wal_size = 80MB
-        log_timezone = 'Europe/Paris'
-        datestyle = 'iso, mdy'
-        timezone = 'Europe/Paris'
-        lc_messages = 'en_US.UTF-8'
-        lc_monetary = 'en_US.UTF-8'
-        lc_numeric = 'en_US.UTF-8'
-        lc_time = 'en_US.UTF-8'
-        default_text_search_config = 'pg_catalog.english'
-        # ssl = on
-        # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
-        # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
-        '';
-      authentication = ''
-        local	all	postgres				ident
-        local	all	all					md5
-        host	all	all		samehost		md5
-        host	all	all		178.33.252.96/32	md5
-        host	all	all		188.165.209.148/32	md5
-        #host	all	all		all			pam
-      '';
-    };
-
     services.cron = {
       enable = true;
       systemCronJobs = let