modules/private/system.nix

   1 { pkgs, lib, config, name, nodes, ... }:
   2 {
   3   config = {
   4     networking.extraHosts = builtins.concatStringsSep "\n"
   5       (lib.mapAttrsToList (n: v: "${v.config.hostEnv.ips.main.ip4} ${n}") nodes);
   6
   7     users.extraUsers.root.openssh.authorizedKeys.keys = [ config.myEnv.sshd.rootKeys.nix_repository ];
   8     secrets.deleteSecretsVars = true;
   9     secrets.gpgKeys = [
  10       ../../nixops/public_keys/Immae.pub
  11     ];
  12
  13     services.openssh.enable = true;
  14
  15     services.duplyBackup.profiles.system = {
  16       rootDir = "/var/lib";
  17       excludeFile = lib.mkAfter ''
  18         + /var/lib/nixos
  19         + /var/lib/udev
  20         + /var/lib/udisks2
  21         + /var/lib/systemd
  22         + /var/lib/private/systemd
  23         - /var/lib
  24         '';
  25     };
  26     nixpkgs.overlays = builtins.attrValues (import ../../overlays) ++ [
  27       (self: super: {
  28         postgresql = self.postgresql_pam;
  29         mariadb = self.mariadb_pam;
  30       }) # don’t put them as generic overlay because of home-manager
  31     ];
  32
  33     services.journald.extraConfig = ''
  34       #Should be "warning" but disabled for now, it prevents anything from being stored
  35       MaxLevelStore=info
  36       MaxRetentionSec=1year
  37       '';
  38
  39     users.users =
  40       builtins.listToAttrs (map (x: lib.attrsets.nameValuePair x.name ({
  41         isNormalUser = true;
  42         home = "/home/${x.name}";
  43         createHome = true;
  44         linger = true;
  45       } // x)) (config.hostEnv.users pkgs))
  46       // {
  47         root.packages = let
  48           nagios-cli = pkgs.writeScriptBin "nagios-cli" ''
  49             #!${pkgs.stdenv.shell}
  50             sudo -u naemon ${pkgs.nagios-cli}/bin/nagios-cli -c ${./monitoring/nagios-cli.cfg}
  51             '';
  52         in
  53           [
  54             pkgs.telnet
  55             pkgs.htop
  56             pkgs.iftop
  57             pkgs.bind.dnsutils
  58             pkgs.httpie
  59             pkgs.iotop
  60             pkgs.whois
  61             pkgs.ngrep
  62             pkgs.tcpdump
  63             pkgs.tshark
  64             pkgs.tcpflow
  65             # pkgs.mitmproxy # failing
  66             pkgs.nmap
  67             pkgs.p0f
  68             pkgs.socat
  69             pkgs.lsof
  70             pkgs.psmisc
  71             pkgs.openssl
  72             pkgs.wget
  73
  74             pkgs.cnagios
  75             nagios-cli
  76
  77             pkgs.pv
  78             pkgs.smartmontools
  79           ];
  80       };
  81
  82     users.mutableUsers = lib.mkDefault false;
  83
  84     environment.etc.cnagios.source = "${pkgs.cnagios}/share/doc/cnagios";
  85     environment.systemPackages = [
  86       pkgs.git
  87       pkgs.vim
  88       pkgs.rsync
  89       pkgs.strace
  90     ] ++
  91     (lib.optional (builtins.length (config.hostEnv.users pkgs) > 0) pkgs.home-manager);
  92
  93     systemd.targets.maintenance = {
  94       description = "Maintenance target with only sshd";
  95       after = [ "network-online.target" "sshd.service" ];
  96       requires = [ "network-online.target" "sshd.service" ];
  97       unitConfig.AllowIsolate = "yes";
  98     };
  99   };
 100 }