]>
Commit | Line | Data |
---|---|---|
f807d917 | 1 | { privateFiles }: |
7e214bf9 | 2 | { config, pkgs, lib, ... }: |
f807d917 | 3 | { |
34abd6af IB |
4 | deployment = { |
5 | targetUser = "root"; | |
6 | targetHost = config.hostEnv.ips.main.ip4; | |
7 | substituteOnDestination = true; | |
8 | }; | |
9 | boot = { | |
10 | kernelModules = [ "kvm-intel" ]; | |
11 | blacklistedKernelModules = [ "nvidiafb" ]; | |
12 | loader.timeout = 1; | |
13 | loader.grub.devices = [ "/dev/sda" "/dev/sdb" ]; | |
14 | kernel.sysctl = { | |
15 | # https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md | |
16 | "net.ipv4.tcp_sack" = 0; | |
17 | }; | |
18 | supportedFilesystems = [ "zfs" ]; | |
19 | kernelParams = ["zfs.zfs_arc_max=6442450944"]; | |
20 | kernelPackages = pkgs.linuxPackages_latest; | |
21 | initrd.availableKernelModules = [ "ahci" "sd_mod" ]; | |
22 | initrd.secrets = { | |
23 | "/boot/pass.key" = "/boot/pass.key"; | |
24 | }; | |
25 | }; | |
26 | services.udev.extraRules = '' | |
27 | ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="c8:60:00:56:a0:88", NAME="eth0" | |
28 | ''; | |
29 | nix.maxJobs = 8; | |
30 | powerManagement.cpuFreqGovernor = "powersave"; | |
ab8f306d | 31 | myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; }; |
f807d917 | 32 | |
7e214bf9 | 33 | fileSystems = { |
ef909e24 IB |
34 | # pools: |
35 | # zpool: ashift=12 | |
36 | # zfast: ashift=12 | |
37 | # zfs: | |
38 | # zpool/: acltype=posixacl ; xattr=sa ; atime=off ; mountpoint=legacy | |
39 | # zpool/root: encryption=on ; keyformat=passphrase ; keylocation=file:///boot/pass.key | |
40 | # zpool/root/var: atime=on | |
41 | # zfast/: acltype=posixacl ; xattr=sa ; atime=off ; mountpoint=legacy | |
42 | # zfast/root: encryption=on ; keyformat=passphrase ; keylocation=file:///boot/pass.key | |
43 | # zfast/root/etc: ø | |
44 | # zfast/root/nix: ø | |
45 | # zfast/root/tmp: async=disabled | |
46 | # zfast/root/var: atime=on | |
47 | # zfast/root/var/lib: ø | |
48 | # zfast/root/var/lib/mysql: logbias=throughput ; atime=off ; primarycache=metadata | |
49 | # zfast/root/var/lib/postgresql: recordsize=8K ; atime=off ; logbias=throughput | |
50 | # zfast/root/var/lib/postgresql/11.0: ø | |
51 | # zfast/root/var/lib/postgresql/11.0/pg_wal: ø | |
34abd6af | 52 | "/" = { fsType = "zfs"; device = "zpool/root"; }; |
7e214bf9 IB |
53 | "/boot" = { fsType = "ext4"; device = "/dev/disk/by-uuid/e6bb18fb-ff56-4b5f-ae9f-e60d40dc0622"; }; |
54 | "/etc" = { fsType = "zfs"; device = "zpool/root/etc"; }; | |
ef909e24 IB |
55 | "/nix" = { fsType = "zfs"; device = "zfast/root/nix"; }; |
56 | "/tmp" = { fsType = "zfs"; device = "zfast/root/tmp"; }; | |
7e214bf9 | 57 | "/var" = { fsType = "zfs"; device = "zpool/root/var"; }; |
ef909e24 IB |
58 | "/var/lib/mysql" = { fsType = "zfs"; device = "zfast/root/var/lib/mysql"; }; |
59 | "/var/lib/postgresql" = { fsType = "zfs"; device = "zfast/root/var/lib/postgresql"; }; | |
60 | "/var/lib/postgresql/11.0" = { fsType = "zfs"; device = "zfast/root/var/lib/postgresql/11.0"; }; | |
61 | "/var/lib/postgresql/11.0/pg_wal" = { fsType = "zfs"; device = "zfast/root/var/lib/postgresql/11.0/pg_wal"; }; | |
7e214bf9 | 62 | }; |
34abd6af IB |
63 | swapDevices = [ { label = "swap1"; } { label = "swap2"; } ]; |
64 | hardware.enableRedistributableFirmware = true; | |
7e214bf9 IB |
65 | |
66 | services.zfs = { | |
7e214bf9 | 67 | autoScrub = { |
05a3b252 | 68 | enable = false; |
7e214bf9 IB |
69 | }; |
70 | }; | |
f807d917 | 71 | networking = { |
31e11cdf | 72 | hostId = "8262ca33"; # generated with head -c4 /dev/urandom | od -A none -t x4 |
f807d917 | 73 | firewall.enable = true; |
05a3b252 | 74 | # FIXME: on next reboot, remove the /27 and the localCommands |
34abd6af IB |
75 | interfaces."eth0".ipv4.addresses = |
76 | pkgs.lib.attrsets.mapAttrsToList | |
77 | (n: ips: { address = ips.ip4; prefixLength = 32; }) | |
78 | (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips) | |
79 | ++ [ { address = config.hostEnv.ips.main.ip4; prefixLength = 27; } ]; | |
f807d917 IB |
80 | interfaces."eth0".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList |
81 | (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or [])) | |
619e4f46 | 82 | config.hostEnv.ips); |
34abd6af IB |
83 | defaultGateway = "176.9.151.65"; |
84 | localCommands = '' | |
85 | # FIXME: Those commands were added by nixops and may not be | |
86 | # actually needed | |
87 | ip -6 addr add '2a01:4f8:160:3445::/64' dev 'eth0' || true | |
88 | ip -4 route change '176.9.151.64/27' via '176.9.151.65' dev 'eth0' || true | |
89 | ip -6 route add default via 'fe80::1' dev eth0 || true | |
90 | ''; | |
91 | nameservers = [ | |
92 | "213.133.98.98" | |
93 | "213.133.99.99" | |
94 | "213.133.100.100" | |
95 | "2a01:4f8:0:a0a1::add:1010" | |
96 | "2a01:4f8:0:a102::add:9999" | |
97 | "2a01:4f8:0:a111::add:9898" | |
98 | ]; | |
f807d917 IB |
99 | }; |
100 | ||
101 | imports = builtins.attrValues (import ../..); | |
102 | ||
103 | myServices.buildbot.enable = true; | |
104 | myServices.databases.enable = true; | |
105 | myServices.gitolite.enable = true; | |
3bc32d9e | 106 | myServices.monitoring.enable = true; |
f807d917 IB |
107 | myServices.irc.enable = true; |
108 | myServices.pub.enable = true; | |
109 | myServices.tasks.enable = true; | |
8415083e IB |
110 | myServices.mpd.enable = true; |
111 | myServices.dns.enable = true; | |
112 | myServices.certificates.enable = true; | |
113 | myServices.websites.enable = true; | |
114 | myServices.mail.enable = true; | |
3f453c7d | 115 | myServices.ejabberd.enable = true; |
ea9c6fe8 | 116 | myServices.vpn.enable = true; |
f807d917 | 117 | services.pure-ftpd.enable = true; |
5b42284e | 118 | services.duplyBackup.enable = false; |
213c323a | 119 | services.duplyBackup.profiles.oldies.rootDir = "/var/lib/oldies"; |
f807d917 | 120 | |
e43fdf34 IB |
121 | services.netdata.enable = true; |
122 | services.netdata.config.global."memory mode" = "none"; | |
123 | services.netdata.config.health."enabled" = "no"; | |
124 | services.netdata.config.web.mode = "none"; | |
125 | environment.etc."netdata/stream.conf".text = '' | |
126 | [stream] | |
127 | enabled = yes | |
128 | destination = ${config.myEnv.monitoring.netdata_aggregator} | |
129 | api key = ${config.myEnv.monitoring.netdata_keys.eldiron} | |
130 | ''; | |
8bf83d7a IB |
131 | secrets.keys = [ |
132 | { | |
5dda316b | 133 | dest = "zrepl_backup/identity"; |
8bf83d7a IB |
134 | user = "root"; |
135 | group = "root"; | |
136 | permissions = "0400"; | |
5dda316b | 137 | text = config.myEnv.zrepl_backup.ssh_key.private; |
8bf83d7a IB |
138 | } |
139 | ]; | |
140 | programs.ssh.knownHosts.dilion = { | |
141 | hostNames = ["dilion.immae.eu"]; | |
142 | publicKey = let | |
143 | profile = config.myEnv.rsync_backup.profiles.dilion; | |
144 | in | |
145 | "${profile.host_key_type} ${profile.host_key}"; | |
146 | }; | |
147 | ||
f807d917 IB |
148 | services.cron = { |
149 | enable = true; | |
4227853a | 150 | mailto = "cron@immae.eu"; |
f807d917 IB |
151 | systemCronJobs = [ |
152 | '' | |
fb7611c1 IB |
153 | 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtpd -g "immae.eu.*Recipient address rejected" |
154 | # Need a way to blacklist properly | |
155 | # 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtpd -g "NOQUEUE:" | |
156 | 0 0 * * * root journalctl -q --since="25 hours ago" -u postfix -t postfix/smtp -g "status=bounced" | |
f807d917 IB |
157 | '' |
158 | ]; | |
159 | }; | |
160 | ||
f831eb7e IB |
161 | fileSystems."/var/lib/pub/immae/devtools" = { |
162 | device = "/run/current-system/sw/bin/bindfs#/var/lib/ftp/devtools.immae.eu/"; | |
163 | fsType = "fuse"; | |
164 | options = [ "force-user=pub" "create-for-user=wwwrun" "create-for-group=wwwrun" ]; | |
165 | }; | |
740a6506 | 166 | environment.systemPackages = [ pkgs.bindfs ]; |
f831eb7e | 167 | |
5dda316b IB |
168 | services.zrepl = { |
169 | enable = true; | |
170 | config = let | |
171 | redis_dump = pkgs.writeScript "redis-dump" '' | |
172 | #! ${pkgs.stdenv.shell} | |
173 | ${pkgs.redis}/bin/redis-cli bgsave | |
174 | ''; | |
175 | in '' | |
176 | jobs: | |
177 | - type: push | |
178 | # must not change | |
179 | name: "backup-to-dilion" | |
180 | filesystems: | |
181 | "zpool/root": true | |
182 | "zpool/root/etc": true | |
183 | "zpool/root/var<": true | |
184 | connect: | |
185 | type: ssh+stdinserver | |
186 | host: dilion.immae.eu | |
187 | user: backup | |
188 | port: 22 | |
189 | identity_file: ${config.secrets.fullPaths."zrepl_backup/identity"} | |
190 | snapshotting: | |
191 | type: periodic | |
192 | prefix: zrepl_ | |
8b150321 IB |
193 | interval: 1h |
194 | #hooks: | |
195 | # - type: mysql-lock-tables | |
196 | # dsn: "${config.myEnv.zrepl_backup.mysql.user}:${config.myEnv.zrepl_backup.mysql.password}@tcp(localhost)/" | |
197 | # filesystems: | |
198 | # "zpool/root/var": true | |
199 | # - type: command | |
200 | # path: ${redis_dump} | |
201 | # err_is_fatal: false | |
202 | # filesystems: | |
203 | # "zpool/root/var": true | |
5dda316b IB |
204 | send: |
205 | encrypted: true | |
206 | pruning: | |
207 | keep_sender: | |
5dda316b IB |
208 | - type: regex |
209 | regex: "^manual_.*" | |
210 | - type: grid | |
8b150321 | 211 | grid: 24x1h | 7x1d | 4x7d | 6x30d |
5dda316b IB |
212 | regex: "^zrepl_.*" |
213 | keep_receiver: | |
214 | - type: regex | |
215 | regex: "^manual_.*" | |
216 | - type: grid | |
8b150321 | 217 | grid: 6x4h | 7x1d | 4x7d | 6x30d |
5dda316b IB |
218 | regex: "^zrepl_.*" |
219 | ''; | |
220 | }; | |
f807d917 IB |
221 | # This value determines the NixOS release with which your system is |
222 | # to be compatible, in order to avoid breaking some software such as | |
223 | # database servers. You should change this only after NixOS release | |
224 | # notes say you should. | |
61ebe69b | 225 | # https://nixos.org/nixos/manual/release-notes.html |
d43e0c61 | 226 | system.stateVersion = "20.03"; # Did you read the comment? |
f807d917 | 227 | } |