From 4d4f13f4a8e7df6480da895d80d487c891441745 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Isma=C3=ABl=20Bouya?= Date: Wed, 9 Jan 2019 23:35:11 +0100 Subject: [PATCH] Move some elements to separate modules --- virtual/eldiron.nix | 176 ++---------------- virtual/modules/databases.nix | 133 +++++++++++++ virtual/modules/gitolite.nix | 73 ++++++++ .../gitolite}/gitolite_ldap_groups.sh | 0 virtual/modules/gitweb.nix | 21 +++ .../gitweb/theme}/git-favicon.png | Bin .../gitweb/theme}/git-logo.png | Bin .../gitweb/theme}/gitweb.css | 0 .../gitweb => modules/gitweb/theme}/gitweb.js | 0 9 files changed, 243 insertions(+), 160 deletions(-) create mode 100644 virtual/modules/databases.nix create mode 100644 virtual/modules/gitolite.nix rename virtual/{packages => modules/gitolite}/gitolite_ldap_groups.sh (100%) create mode 100644 virtual/modules/gitweb.nix rename virtual/{packages/gitweb => modules/gitweb/theme}/git-favicon.png (100%) rename virtual/{packages/gitweb => modules/gitweb/theme}/git-logo.png (100%) rename virtual/{packages/gitweb => modules/gitweb/theme}/gitweb.css (100%) rename virtual/{packages/gitweb => modules/gitweb/theme}/gitweb.js (100%) diff --git a/virtual/eldiron.nix b/virtual/eldiron.nix index 7dbca92..acd2cbd 100644 --- a/virtual/eldiron.nix +++ b/virtual/eldiron.nix @@ -4,44 +4,28 @@ enableRollback = true; }; - eldiron = { config, pkgs, ... }: - with import ../libs.nix; + eldiron = { config, pkgs, mylibs, ... }: + with mylibs; let mypkgs = pkgs.callPackage ./packages.nix { inherit checkEnv fetchedGit fetchedGitPrivate fetchedGithub; }; in { + _module.args = { + mylibs = import ../libs.nix; + }; + + imports = [ + ./modules/gitolite.nix + ./modules/gitweb.nix + ./modules/databases.nix + ]; + services.myGitolite.enable = true; + services.myGitweb.enable = true; + services.myDatabases.enable = true; + nixpkgs.config.packageOverrides = oldpkgs: rec { - gitolite = oldpkgs.gitolite.overrideAttrs(old: rec { - name = "gitolite-${version}"; - version = "3.6.10"; - src = pkgs.fetchFromGitHub { - owner = "sitaramc"; - repo = "gitolite"; - rev = "v${version}"; - sha256 = "0p2697mn6rwm03ndlv7q137zczai82n41aplq1g006ii7f12xy8h"; - }; - }); - gitweb = oldpkgs.gitweb.overrideAttrs(old: { - installPhase = old.installPhase + '' - cp -r ${./packages/gitweb} $out/gitweb-theme; - ''; - }); - postgresql = postgresql111; - postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec { - passthru = old.passthru // { psqlSchema = "11.0"; }; - name = "postgresql-11.1"; - src = pkgs.fetchurl { - url = "mirror://postgresql/source/v11.1/${name}.tar.bz2"; - sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch"; - }; - }); - mariadb = mariadbPAM; - mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec { - cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ]; - buildInputs = old.buildInputs ++ [ pkgs.pam ]; - }); goaccess = oldpkgs.goaccess.overrideAttrs(old: rec { name = "goaccess-${version}"; version = "1.3"; @@ -57,7 +41,7 @@ networking = { firewall = { enable = true; - allowedTCPPorts = [ 22 80 443 3306 5432 9418 ]; + allowedTCPPorts = [ 22 80 443 9418 ]; }; }; @@ -116,7 +100,6 @@ allowKeysForGroup = true; extraDomains = { "db-1.immae.eu" = null; - "git.immae.eu" = null; "tools.immae.eu" = null; "connexionswing.immae.eu" = null; "sandetludo.immae.eu" = null; @@ -197,32 +180,6 @@ AuthorizedKeysCommandUser nobody ''; - users.users.wwwrun.extraGroups = [ "gitolite" ]; - - users.users.gitolite.packages = let - python-packages = python-packages: with python-packages; [ - simplejson - urllib3 - ]; - in - [ - (pkgs.python3.withPackages python-packages) - ]; - # FIXME: after initial install, need to - # (1) copy rc file (adjust gitolite_ldap_groups.sh) - # (2) (mark old readonly and) sync repos except gitolite-admin - # rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/ - # chown -R gitolite:gitolite /var/lib/gitolite - # (3) push force the gitolite-admin to new location (from external point) - # Don't use an existing key, it will take precedence over - # gitolite-admin - # (4) su -u gitolite gitolite setup - services.gitolite = { - enable = true; - # FIXME: key from ./ssh - adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu"; - }; - services.ympd = mypkgs.ympd.config // { enable = false; }; services.phpfpm = { @@ -288,29 +245,6 @@ mkdir -p /run/redis chown redis /run/redis ''; - gitolite = - assert checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD"; - let - gitolite_ldap_groups = wrap { - name = "gitolite_ldap_groups.sh"; - file = ./packages/gitolite_ldap_groups.sh; - vars = { - LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD"; - }; - paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ]; - }; - in { - deps = [ "users" ]; - text = '' - if [ -d /var/lib/gitolite ]; then - ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh - chmod g+rx /var/lib/gitolite - fi - if [ -f /var/lib/gitolite/projects.list ]; then - chmod g+r /var/lib/gitolite/projects.list - fi - ''; - }; # FIXME: initial sync goaccess = '' mkdir -p /var/lib/goaccess @@ -590,84 +524,6 @@ ]; }; - security.pam.services = let - pam_ldap = pkgs.pam_ldap; - pam_ldap_mysql = assert checkEnv "NIXOPS_MYSQL_PAM_PASSWORD"; - pkgs.writeText "mysql.conf" '' - host ldap.immae.eu - base dc=immae,dc=eu - binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu - bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"} - pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu - ''; - in [ - { - name = "mysql"; - text = '' - # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/ - auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql} - account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql} - ''; - } - ]; - - # FIXME: backup - # Nextcloud: 14 - services.redis = rec { - enable = true; - bind = "127.0.0.1"; - unixSocket = "/run/redis/redis.sock"; - extraConfig = '' - unixsocketperm 777 - maxclients 1024 - ''; - }; - - # FIXME: initial sync - # FIXME: backup - # FIXME: restart after pam - # FIXME: pam access doesn’t work (because of php module) - # FIXME: ssl - services.mysql = rec { - enable = true; - package = pkgs.mariadb; - }; - - # FIXME: initial sync - # FIXME: backup - # FIXME: ssl - services.postgresql = rec { - enable = true; - package = pkgs.postgresql; - enableTCPIP = true; - extraConfig = '' - max_connections = 100 - wal_level = logical - shared_buffers = 128MB - max_wal_size = 1GB - min_wal_size = 80MB - log_timezone = 'Europe/Paris' - datestyle = 'iso, mdy' - timezone = 'Europe/Paris' - lc_messages = 'en_US.UTF-8' - lc_monetary = 'en_US.UTF-8' - lc_numeric = 'en_US.UTF-8' - lc_time = 'en_US.UTF-8' - default_text_search_config = 'pg_catalog.english' - # ssl = on - # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem' - # ssl_key_file = '/var/lib/acme/eldiron/key.pem' - ''; - authentication = '' - local all postgres ident - local all all md5 - host all all samehost md5 - host all all 178.33.252.96/32 md5 - host all all 188.165.209.148/32 md5 - #host all all all pam - ''; - }; - services.cron = { enable = true; systemCronJobs = let diff --git a/virtual/modules/databases.nix b/virtual/modules/databases.nix new file mode 100644 index 0000000..25bd645 --- /dev/null +++ b/virtual/modules/databases.nix @@ -0,0 +1,133 @@ +{ lib, pkgs, config, mylibs, ... }: +let + cfg = config.services.myDatabases; +in { + options.services.myDatabases = { + enable = lib.mkEnableOption "my databases service"; + postgresql = { + enable = lib.mkOption { + default = cfg.enable; + example = true; + description = "Whether to enable postgresql database"; + type = lib.types.bool; + }; + }; + + mariadb = { + enable = lib.mkOption { + default = cfg.enable; + example = true; + description = "Whether to enable mariadb database"; + type = lib.types.bool; + }; + }; + + redis = { + enable = lib.mkOption { + default = cfg.enable; + example = true; + description = "Whether to enable redis database"; + type = lib.types.bool; + }; + }; + }; + + config = lib.mkIf cfg.enable { + nixpkgs.config.packageOverrides = oldpkgs: rec { + postgresql = postgresql111; + postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec { + passthru = old.passthru // { psqlSchema = "11.0"; }; + name = "postgresql-11.1"; + src = pkgs.fetchurl { + url = "mirror://postgresql/source/v11.1/${name}.tar.bz2"; + sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch"; + }; + }); + mariadb = mariadbPAM; + mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec { + cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ]; + buildInputs = old.buildInputs ++ [ pkgs.pam ]; + }); + }; + + networking.firewall.allowedTCPPorts = [ 3306 5432 ]; + + # FIXME: initial sync + # FIXME: backup + # FIXME: restart after pam + # FIXME: pam access doesn’t work (because of php module) + # FIXME: ssl + services.mysql = rec { + enable = cfg.mariadb.enable; + package = pkgs.mariadb; + }; + + # FIXME: initial sync + # FIXME: backup + # FIXME: ssl + services.postgresql = rec { + enable = cfg.postgresql.enable; + package = pkgs.postgresql; + enableTCPIP = true; + extraConfig = '' + max_connections = 100 + wal_level = logical + shared_buffers = 128MB + max_wal_size = 1GB + min_wal_size = 80MB + log_timezone = 'Europe/Paris' + datestyle = 'iso, mdy' + timezone = 'Europe/Paris' + lc_messages = 'en_US.UTF-8' + lc_monetary = 'en_US.UTF-8' + lc_numeric = 'en_US.UTF-8' + lc_time = 'en_US.UTF-8' + default_text_search_config = 'pg_catalog.english' + # ssl = on + # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem' + # ssl_key_file = '/var/lib/acme/eldiron/key.pem' + ''; + authentication = '' + local all postgres ident + local all all md5 + host all all samehost md5 + host all all 178.33.252.96/32 md5 + host all all 188.165.209.148/32 md5 + #host all all all pam + ''; + }; + + security.pam.services = let + pam_ldap = pkgs.pam_ldap; + pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD"; + pkgs.writeText "mysql.conf" '' + host ldap.immae.eu + base dc=immae,dc=eu + binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu + bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"} + pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu + ''; + in [ + { + name = "mysql"; + text = '' + # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/ + auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql} + account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql} + ''; + } + ]; + + # FIXME: backup + # Nextcloud: 14 + services.redis = rec { + enable = config.services.myDatabases.redis.enable; + bind = "127.0.0.1"; + unixSocket = "/run/redis/redis.sock"; + extraConfig = '' + unixsocketperm 777 + maxclients 1024 + ''; + }; + }; +} diff --git a/virtual/modules/gitolite.nix b/virtual/modules/gitolite.nix new file mode 100644 index 0000000..85c7be1 --- /dev/null +++ b/virtual/modules/gitolite.nix @@ -0,0 +1,73 @@ +{ lib, pkgs, config, mylibs, ... }: +let + cfg = config.services.myGitolite; +in { + options.services.myGitolite = { + enable = lib.mkEnableOption "my gitolite service"; + }; + + config = lib.mkIf cfg.enable { + nixpkgs.config.packageOverrides = oldpkgs: rec { + gitolite = oldpkgs.gitolite.overrideAttrs(old: rec { + name = "gitolite-${version}"; + version = "3.6.10"; + src = pkgs.fetchFromGitHub { + owner = "sitaramc"; + repo = "gitolite"; + rev = "v${version}"; + sha256 = "0p2697mn6rwm03ndlv7q137zczai82n41aplq1g006ii7f12xy8h"; + }; + }); + }; + + system.activationScripts.gitolite = + assert mylibs.checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD"; + let + gitolite_ldap_groups = mylibs.wrap { + name = "gitolite_ldap_groups.sh"; + file = ./gitolite/gitolite_ldap_groups.sh; + vars = { + LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD"; + }; + paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ]; + }; + in { + deps = [ "users" ]; + text = '' + if [ -d /var/lib/gitolite ]; then + ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh + chmod g+rx /var/lib/gitolite + fi + if [ -f /var/lib/gitolite/projects.list ]; then + chmod g+r /var/lib/gitolite/projects.list + fi + ''; + }; + + users.users.wwwrun.extraGroups = [ "gitolite" ]; + + users.users.gitolite.packages = let + python-packages = python-packages: with python-packages; [ + simplejson + urllib3 + ]; + in + [ + (pkgs.python3.withPackages python-packages) + ]; + # FIXME: after initial install, need to + # (1) copy rc file (adjust gitolite_ldap_groups.sh) + # (2) (mark old readonly and) sync repos except gitolite-admin + # rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/ + # chown -R gitolite:gitolite /var/lib/gitolite + # (3) push force the gitolite-admin to new location (from external point) + # Don't use an existing key, it will take precedence over + # gitolite-admin + # (4) su -u gitolite gitolite setup + services.gitolite = { + enable = true; + # FIXME: key from ./ssh + adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu"; + }; + }; +} diff --git a/virtual/packages/gitolite_ldap_groups.sh b/virtual/modules/gitolite/gitolite_ldap_groups.sh similarity index 100% rename from virtual/packages/gitolite_ldap_groups.sh rename to virtual/modules/gitolite/gitolite_ldap_groups.sh diff --git a/virtual/modules/gitweb.nix b/virtual/modules/gitweb.nix new file mode 100644 index 0000000..f3ef1bd --- /dev/null +++ b/virtual/modules/gitweb.nix @@ -0,0 +1,21 @@ +{ lib, pkgs, config, mylibs, ... }: +let + cfg = config.services.myGitweb; +in { + options.services.myGitweb = { + enable = lib.mkEnableOption "my gitweb service"; + }; + + config = lib.mkIf cfg.enable { + security.acme.certs."eldiron".extraDomains."git.immae.eu" = null; + + nixpkgs.config.packageOverrides = oldpkgs: rec { + gitweb = oldpkgs.gitweb.overrideAttrs(old: { + installPhase = old.installPhase + '' + cp -r ${./gitweb/theme} $out/gitweb-theme; + ''; + }); + }; + + }; +} diff --git a/virtual/packages/gitweb/git-favicon.png b/virtual/modules/gitweb/theme/git-favicon.png similarity index 100% rename from virtual/packages/gitweb/git-favicon.png rename to virtual/modules/gitweb/theme/git-favicon.png diff --git a/virtual/packages/gitweb/git-logo.png b/virtual/modules/gitweb/theme/git-logo.png similarity index 100% rename from virtual/packages/gitweb/git-logo.png rename to virtual/modules/gitweb/theme/git-logo.png diff --git a/virtual/packages/gitweb/gitweb.css b/virtual/modules/gitweb/theme/gitweb.css similarity index 100% rename from virtual/packages/gitweb/gitweb.css rename to virtual/modules/gitweb/theme/gitweb.css diff --git a/virtual/packages/gitweb/gitweb.js b/virtual/modules/gitweb/theme/gitweb.js similarity index 100% rename from virtual/packages/gitweb/gitweb.js rename to virtual/modules/gitweb/theme/gitweb.js -- 2.41.0