]>
Commit | Line | Data |
---|---|---|
1a64deeb | 1 | { config, pkgs, name, lib, pkgs-no-overlay, secrets, ... }: |
8a304ef4 | 2 | { |
282c67a1 IB |
3 | # ssh-keyscan dilion | nix-shell -p ssh-to-age --run ssh-to-age |
4 | secrets.ageKeys = [ "age1x49n6qa0arkdpq8530s7umgm0gqkq90exv4jep97q30rfnzknpaqate06a" ]; | |
34abd6af IB |
5 | boot = { |
6 | loader = { | |
7 | grub = { | |
34abd6af IB |
8 | devices = [ "/dev/sda" "/dev/sdb" "/dev/sdc" "/dev/sdd" ]; |
9 | }; | |
10 | timeout = 1; | |
11 | }; | |
12 | blacklistedKernelModules = [ "nvidiafb" ]; | |
13 | supportedFilesystems = [ "zfs" ]; | |
1a64deeb | 14 | kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages; |
34abd6af IB |
15 | kernelModules = [ "kvm-intel" ]; |
16 | initrd.availableKernelModules = [ "ahci" "sd_mod" ]; | |
17 | initrd.secrets = { | |
18 | "/boot/pass.key" = "/boot/pass.key"; | |
19 | }; | |
20 | kernel.sysctl."vm.nr_hugepages" = 256; # for xmr-stak | |
6ee77836 IB |
21 | # available in nixos-20.09 |
22 | #zfs.requestEncryptionCredentials = [ "zpool/root" ]; | |
34abd6af | 23 | }; |
34abd6af IB |
24 | powerManagement.cpuFreqGovernor = "powersave"; |
25 | hardware.enableRedistributableFirmware = true; | |
26 | ||
34abd6af | 27 | swapDevices = [ { label = "swap"; } ]; |
740a6506 | 28 | fileSystems = { |
34abd6af | 29 | "/" = { fsType = "zfs"; device = "zpool/root"; }; |
740a6506 IB |
30 | "/boot" = { fsType = "ext4"; device = "/dev/disk/by-uuid/fd1c511e-2bc0-49d5-b8bb-95e7e8c8c816"; }; |
31 | "/etc" = { fsType = "zfs"; device = "zpool/root/etc"; }; | |
32 | "/home" = { fsType = "zfs"; device = "zpool/root/home"; }; | |
33 | "/home/immae" = { fsType = "zfs"; device = "zpool/root/home/immae"; }; | |
34 | "/tmp" = { fsType = "zfs"; device = "zpool/root/tmp"; }; | |
35 | "/var" = { fsType = "zfs"; device = "zpool/root/var"; }; | |
34abd6af IB |
36 | "/data" = { fsType = "ext4"; label = "data"; }; |
37 | "/nix" = { fsType = "ext4"; label = "nix"; }; | |
740a6506 | 38 | }; |
34abd6af IB |
39 | |
40 | services.udev.extraRules = '' | |
41 | ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="10:bf:48:7f:e6:3b", NAME="eth0" | |
42 | ''; | |
740a6506 | 43 | |
1a64deeb IB |
44 | nixpkgs.config.permittedInsecurePackages = [ |
45 | "python-2.7.18.6" # for nagios-cli | |
46 | ]; | |
47 | ||
8a304ef4 | 48 | networking = { |
31e11cdf | 49 | hostId = "27c3048d"; # generated with head -c4 /dev/urandom | od -A none -t x4 |
8a304ef4 | 50 | firewall.enable = false; |
34abd6af | 51 | interfaces."eth0".ipv4.addresses = |
1a64deeb IB |
52 | [ { address = lib.head config.hostEnv.ips.main.ip4; prefixLength = 27; } ] |
53 | ++ pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList | |
54 | (n: ips: map (ip: { address = ip; prefixLength = 32; }) (ips.ip4 or [])) | |
55 | (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips)); | |
34abd6af IB |
56 | interfaces."eth0".ipv6.addresses = |
57 | [ { address = "2a01:4f8:141:53e7::"; prefixLength = 64; } ] | |
58 | ++ pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList | |
59 | (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or [])) | |
60 | config.hostEnv.ips); | |
61 | defaultGateway = { address = "176.9.10.225"; interface = "eth0"; }; | |
62 | defaultGateway6 = { address = "fe80::1"; interface = "eth0"; }; | |
63 | nameservers = [ | |
64 | "213.133.98.98" | |
65 | "213.133.99.99" | |
66 | "213.133.100.100" | |
67 | "2a01:4f8:0:a0a1::add:1010" | |
68 | "2a01:4f8:0:a102::add:9999" | |
69 | "2a01:4f8:0:a111::add:9898" | |
70 | ]; | |
8a304ef4 IB |
71 | }; |
72 | ||
1a64deeb IB |
73 | myServices.ssh.modules.regular.snippet = builtins.readFile ./ssh_ldap_regular.sh; |
74 | ||
75 | imports = [ | |
76 | secrets.nixosModules.users-config-dilion | |
77 | ./monitoring.nix | |
78 | ./vms.nix | |
79 | ]; | |
80 | ||
81 | myServices.vms.libvirt-guests = { | |
82 | buildbot = { | |
83 | pool = "zfspool"; | |
84 | network = "immae"; | |
85 | cpus = 1; | |
86 | memory = 3; | |
87 | diskSize = 10; | |
88 | destroyVolumeOnExit = true; | |
89 | }; | |
90 | }; | |
91 | myServices.vms.libvirt-images = { | |
92 | nixos = ./vms/base_configuration.nix; | |
93 | buildbot = ./vms/buildbot_configuration.nix; | |
94 | }; | |
95 | myServices.vms.libvirt-networks.immae = { | |
96 | bridgeNumber = 1; | |
97 | ipRange = "192.168.100"; | |
98 | }; | |
99 | myServices.vms.libvirt-pools = { | |
100 | niximages = { | |
101 | type = "dir"; | |
102 | target = "/etc/libvirtd/base-images"; | |
103 | }; | |
104 | buildbot-disks = rec { | |
105 | type = "dir"; | |
106 | target = "/var/lib/libvirt/images/buildbot-disks"; | |
107 | preStart = '' | |
108 | mkdir -p ${target} | |
109 | ''; | |
110 | }; | |
111 | zfspool = { | |
112 | # pool-define-as --name zfspool --source-name zpool/libvirt --type zfs | |
113 | type = "zfs"; | |
114 | xml = '' | |
115 | <source> | |
116 | <name>zpool/libvirt</name> | |
117 | </source> | |
118 | ''; | |
119 | }; | |
120 | }; | |
8a304ef4 | 121 | |
6c95e93c | 122 | system.nssModules = [ pkgs.libvirt ]; |
2053ddac | 123 | system.nssDatabases.hosts = lib.mkForce [ "files" "libvirt_guest" "mymachines" "dns" "myhostname" ]; |
8a304ef4 IB |
124 | programs.zsh.enable = true; |
125 | ||
200690c9 IB |
126 | users.users.libvirt = { |
127 | hashedPassword = "!"; | |
128 | shell = pkgs.bashInteractive; | |
129 | isSystemUser = true; | |
130 | group = "libvirtd"; | |
1a64deeb | 131 | packages = [ pkgs.libressl.nc ]; |
282c67a1 IB |
132 | openssh.authorizedKeys.keys = [ |
133 | config.myEnv.buildbot.ssh_key.public | |
134 | config.myEnv.sshd.rootKeys.ismael_flony | |
200690c9 | 135 | ]; |
200690c9 IB |
136 | }; |
137 | ||
1a64deeb | 138 | users.groups.backup = {}; |
8bf83d7a | 139 | users.users.backup = { |
8bf83d7a IB |
140 | hashedPassword = "!"; |
141 | isSystemUser = true; | |
5dda316b | 142 | extraGroups = [ "keys" ]; |
1a64deeb | 143 | group = "backup"; |
8bf83d7a IB |
144 | shell = pkgs.bashInteractive; |
145 | openssh.authorizedKeys.keys = let | |
1a64deeb | 146 | zreplConfig = "/etc/zrepl/zrepl.yml"; |
8bf83d7a | 147 | in |
5dda316b | 148 | ["command=\"${pkgs.zrepl}/bin/zrepl stdinserver --config ${zreplConfig} eldiron\",restrict ${config.myEnv.zrepl_backup.ssh_key.public}"]; |
8bf83d7a | 149 | }; |
50c100ba | 150 | security.sudo.extraRules = pkgs.lib.mkAfter [ |
50c100ba IB |
151 | { |
152 | commands = [ | |
153 | { command = "/home/immae/.nix-profile/root_scripts/*"; options = [ "NOPASSWD" ]; } | |
154 | ]; | |
155 | users = [ "immae" ]; | |
156 | runAs = "root"; | |
157 | } | |
8bf83d7a IB |
158 | ]; |
159 | ||
f2bc9fcc | 160 | virtualisation.docker.enable = true; |
740a6506 | 161 | virtualisation.docker.storageDriver = "zfs"; |
7067c25c | 162 | virtualisation.libvirtd.enable = true; |
1a64deeb IB |
163 | virtualisation.libvirtd.qemu.package = pkgs-no-overlay.qemu; |
164 | systemd.services.libvirtd.path = lib.mkAfter [ config.boot.zfs.package ]; | |
165 | users.groups.immae = {}; | |
166 | users.extraUsers.immae.extraGroups = [ "immae" "libvirtd" "docker" ]; | |
7067c25c IB |
167 | systemd.services.libvirtd.postStart = '' |
168 | install -m 0770 -g libvirtd -d /var/lib/libvirt/images | |
169 | ''; | |
170 | ||
8a304ef4 IB |
171 | time.timeZone = "Europe/Paris"; |
172 | nix = { | |
1a64deeb IB |
173 | settings = { |
174 | sandbox = "relaxed"; | |
175 | max-jobs = 8; | |
176 | substituters = [ "https://hydra.iohk.io" "https://cache.nixos.org" ]; | |
177 | trusted-public-keys = [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ]; | |
178 | trusted-users = [ "root" "@wheel"] ; | |
179 | }; | |
8a304ef4 IB |
180 | extraOptions = '' |
181 | keep-outputs = true | |
182 | keep-derivations = true | |
969d8daf | 183 | allow-unsafe-native-code-during-evaluation = true |
bb9bc238 | 184 | experimental-features = nix-command flakes |
8a304ef4 IB |
185 | #Assumed in NUR |
186 | allow-import-from-derivation = true | |
187 | ''; | |
188 | }; | |
189 | ||
50c100ba IB |
190 | security.pki.certificateFiles = [ |
191 | (pkgs.fetchurl { | |
192 | url = "http://downloads.e.eriomem.net/eriomemca.pem"; | |
193 | sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh"; | |
194 | }) | |
195 | ]; | |
196 | ||
6ee77836 | 197 | myServices.monitoring.enable = true; |
1a64deeb IB |
198 | security.acme.certs."${name}-immae" = { |
199 | group = "immae"; | |
83e79a89 IB |
200 | domain = "dilion.immae.eu"; |
201 | }; | |
ba941296 | 202 | security.acme.certs."${name}" = { |
ba941296 | 203 | group = config.services.nginx.group; |
1a64deeb IB |
204 | extraDomainNames = [ |
205 | "dilion.immae.dev" | |
206 | ]; | |
ba941296 | 207 | }; |
1a64deeb | 208 | systemd.services.nginx.serviceConfig.ProtectHome = "read-only"; |
ba941296 IB |
209 | services.nginx = { |
210 | enable = true; | |
211 | recommendedOptimisation = true; | |
212 | recommendedGzipSettings = true; | |
213 | recommendedProxySettings = true; | |
214 | virtualHosts = { | |
7c5e6fe8 | 215 | "dilion.immae.dev" = { |
1a64deeb | 216 | acmeRoot = config.security.acme.defaults.webroot; |
63500b22 IB |
217 | useACMEHost = name; |
218 | forceSSL = true; | |
1a64deeb | 219 | locations."/".root = "/home/immae/www"; |
6c95e93c | 220 | }; |
ba941296 IB |
221 | }; |
222 | }; | |
223 | ||
1a64deeb IB |
224 | secrets.keys = { |
225 | "zrepl/${name}.key" = { | |
226 | permissions = "0400"; | |
227 | text = config.myEnv.zrepl_backup.certs."${name}".key; | |
228 | user = "backup"; | |
229 | group = "root"; | |
230 | }; | |
231 | } // builtins.listToAttrs (map (x: lib.attrsets.nameValuePair "zrepl/certificates/${x}.crt" { | |
232 | permissions = "0400"; | |
233 | text = config.myEnv.zrepl_backup.certs."${x}".certificate; | |
234 | user = "backup"; | |
235 | group = "root"; | |
236 | }) (builtins.attrNames config.myEnv.zrepl_backup.certs)); | |
237 | ||
238 | environment.etc."mdadm.conf" = { | |
239 | enable = true; | |
240 | mode = "0644"; | |
241 | user = "root"; | |
242 | text = "MAILADDR ${config.myEnv.monitoring.email}"; | |
243 | }; | |
244 | ||
245 | ||
5dda316b | 246 | systemd.services.zrepl.serviceConfig.User = "backup"; |
1a64deeb IB |
247 | systemd.services.zrepl.path = [ pkgs.openssh ]; |
248 | # pour eldiron: | |
5dda316b | 249 | # zfs allow backup create,mount,receive,destroy,rename,snapshot,hold,bookmark,release zpool/backup |
1a64deeb IB |
250 | # pour flony: |
251 | # zfs allow backup hold,release,bookmark,snapshot,send zpool | |
5dda316b IB |
252 | services.zrepl = { |
253 | enable = true; | |
1a64deeb IB |
254 | settings = { |
255 | global.control.sockpath = "/run/zrepl/control"; | |
256 | global.serve.stdinserver.sockdir = "/run/zrepl/stdinserver"; | |
257 | jobs = [ | |
258 | { | |
259 | type = "sink"; | |
5dda316b | 260 | # must not change |
1a64deeb IB |
261 | name = "backup-from-eldiron"; |
262 | root_fs = "zpool/backup"; | |
263 | serve.type = "tls"; | |
264 | serve.listen = ":19000"; | |
265 | serve.ca = config.secrets.fullPaths."zrepl/certificates/eldiron.crt"; | |
266 | serve.cert = config.secrets.fullPaths."zrepl/certificates/dilion.crt"; | |
267 | serve.key = config.secrets.fullPaths."zrepl/dilion.key"; | |
268 | serve.client_cns = [ "eldiron" ]; | |
269 | } | |
270 | { | |
271 | type = "source"; | |
272 | # must not change | |
273 | name = "backup-to-wd-zpool"; | |
274 | # not encrypted! | |
275 | serve.type = "tls"; | |
276 | serve.listen = ":19001"; | |
277 | serve.ca = config.secrets.fullPaths."zrepl/certificates/flony.crt"; | |
278 | serve.cert = config.secrets.fullPaths."zrepl/certificates/dilion.crt"; | |
279 | serve.key = config.secrets.fullPaths."zrepl/dilion.key"; | |
280 | serve.client_cns = [ "flony" ]; | |
281 | filesystems."zpool/libvirt<" = true; | |
282 | filesystems."zpool/root<" = true; | |
283 | snapshotting.type = "manual"; | |
284 | } | |
285 | { | |
286 | type = "source"; | |
287 | # must not change | |
288 | name = "backup-to-wd-zpool-docker"; | |
289 | # not encrypted! | |
290 | serve.type = "tls"; | |
291 | serve.listen = ":19002"; | |
292 | serve.ca = config.secrets.fullPaths."zrepl/certificates/flony.crt"; | |
293 | serve.cert = config.secrets.fullPaths."zrepl/certificates/dilion.crt"; | |
294 | serve.key = config.secrets.fullPaths."zrepl/dilion.key"; | |
295 | serve.client_cns = [ "flony" ]; | |
296 | filesystems."zpool/docker<" = true; | |
297 | snapshotting.type = "manual"; | |
298 | } | |
299 | ]; | |
300 | }; | |
5dda316b | 301 | }; |
8a304ef4 IB |
302 | # This value determines the NixOS release with which your system is |
303 | # to be compatible, in order to avoid breaking some software such as | |
304 | # database servers. You should change this only after NixOS release | |
305 | # notes say you should. | |
306 | # https://nixos.org/nixos/manual/release-notes.html | |
1a64deeb | 307 | system.stateVersion = "23.05"; # Did you read the comment? |
8a304ef4 IB |
308 | } |
309 |