modules/private/system.nix

   1 { pkgs, lib, config, name, nodes, ... }:
   2 {
   3   config = {
   4     networking.extraHosts = builtins.concatStringsSep "\n"
   5       (lib.mapAttrsToList (n: v: "${v.config.hostEnv.ips.main.ip4} ${n}") nodes);
   6
   7     users.extraUsers.root.openssh.authorizedKeys.keyFiles = [ "${config.myEnv.privateFiles}/id_ed25519.pub" ];
   8     services.openssh.enable = true;
   9
  10     services.duplyBackup.profiles.system = {
  11       rootDir = "/var/lib";
  12       excludeFile = lib.mkAfter ''
  13         + /var/lib/nixos
  14         + /var/lib/udev
  15         + /var/lib/udisks2
  16         + /var/lib/systemd
  17         + /var/lib/private/systemd
  18         - /var/lib
  19         '';
  20     };
  21     nixpkgs.overlays = builtins.attrValues (import ../../overlays) ++ [
  22       (self: super: {
  23         postgresql = self.postgresql_pam;
  24         mariadb = self.mariadb_pam;
  25       }) # don’t put them as generic overlay because of home-manager
  26     ];
  27
  28     services.journald.extraConfig = ''
  29       #Should be "warning" but disabled for now, it prevents anything from being stored
  30       MaxLevelStore=info
  31       MaxRetentionSec=1year
  32       '';
  33
  34     users.users =
  35       builtins.listToAttrs (map (x: lib.attrsets.nameValuePair x.name ({
  36         isNormalUser = true;
  37         home = "/home/${x.name}";
  38         createHome = true;
  39         linger = true;
  40       } // x)) (config.hostEnv.users pkgs))
  41       // {
  42         root.packages = let
  43           nagios-cli = pkgs.writeScriptBin "nagios-cli" ''
  44             #!${pkgs.stdenv.shell}
  45             sudo -u naemon ${pkgs.nagios-cli}/bin/nagios-cli -c ${./monitoring/nagios-cli.cfg}
  46             '';
  47         in
  48           [
  49             pkgs.telnet
  50             pkgs.htop
  51             pkgs.iftop
  52             pkgs.bind.dnsutils
  53             pkgs.httpie
  54             pkgs.iotop
  55             pkgs.whois
  56             pkgs.ngrep
  57             pkgs.tcpdump
  58             pkgs.tshark
  59             pkgs.tcpflow
  60             # pkgs.mitmproxy # failing
  61             pkgs.nmap
  62             pkgs.p0f
  63             pkgs.socat
  64             pkgs.lsof
  65             pkgs.psmisc
  66             pkgs.openssl
  67             pkgs.wget
  68
  69             pkgs.cnagios
  70             nagios-cli
  71
  72             pkgs.pv
  73             pkgs.smartmontools
  74           ];
  75       };
  76
  77     users.mutableUsers = lib.mkDefault false;
  78
  79     environment.etc.cnagios.source = "${pkgs.cnagios}/share/doc/cnagios";
  80     environment.systemPackages = [
  81       pkgs.git
  82       pkgs.vim
  83       pkgs.rsync
  84       pkgs.strace
  85     ] ++
  86     (lib.optional (builtins.length (config.hostEnv.users pkgs) > 0) pkgs.home-manager);
  87
  88     systemd.targets.maintenance = {
  89       description = "Maintenance target with only sshd";
  90       after = [ "network-online.target" "sshd.service" ];
  91       requires = [ "network-online.target" "sshd.service" ];
  92       unitConfig.AllowIsolate = "yes";
  93     };
  94   };
  95 }