modules/private/system/backup-2.nix

   1 { config, pkgs, resources, name, ... }:
   2 {
   3   deployment = {
   4     targetUser = "root";
   5     targetHost = config.hostEnv.ips.main.ip4;
   6     substituteOnDestination = true;
   7   };
   8   # ssh-keyscan backup-2 | nix-shell -p ssh-to-age --run ssh-to-age
   9   secrets.ageKeys = [ "age1kk3nr27qu42j28mcfdag5lhq0zu2pky7gfanvne8l4z2ctevjpgskmw0sr" ];
  10   boot.kernelPackages = pkgs.linuxPackages_latest;
  11   myEnv = import ../../../nixops/secrets/environment.nix;
  12
  13   imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ] ++ builtins.attrValues (import ../..);
  14
  15   fileSystems = {
  16     "/backup2" = {
  17       fsType = "ext4";
  18       device = "UUID=b9425333-f567-435d-94d8-b26c22d93426";
  19     };
  20     "/" = { device = "/dev/sda1"; fsType = "ext4"; };
  21   };
  22
  23   networking = {
  24     firewall.enable = true;
  25     interfaces."ens3".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList
  26       (n: ips: { address = ips.ip4; prefixLength = 32; })
  27       (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips);
  28     interfaces."ens3".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
  29       (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
  30       config.hostEnv.ips);
  31     defaultGateway6 = { address = "fe80::1"; interface = "ens3"; };
  32   };
  33
  34   boot.loader.grub.device = "nodev";
  35
  36   myServices.certificates.enable = true;
  37   security.acme.certs."${name}" = {
  38     user = config.services.nginx.user;
  39     group = config.services.nginx.group;
  40   };
  41   services.nginx = {
  42     enable = true;
  43     recommendedOptimisation = true;
  44     recommendedGzipSettings = true;
  45     recommendedProxySettings = true;
  46   };
  47   networking.firewall.allowedTCPPorts = [ 80 443 ];
  48
  49   services.cron = {
  50     mailto = "cron@immae.eu";
  51     enable = true;
  52   };
  53
  54   services.rsyncBackup = {
  55     mountpoint = "/backup2";
  56     profiles = config.myEnv.rsync_backup.profiles;
  57     ssh_key_public = config.myEnv.rsync_backup.ssh_key.public;
  58     ssh_key_private = config.myEnv.rsync_backup.ssh_key.private;
  59   };
  60
  61   myServices.mailRelay.enable = true;
  62   myServices.mailBackup.enable = true;
  63   myServices.monitoring.enable = true;
  64   myServices.databasesReplication = {
  65     postgresql = {
  66       enable = true;
  67       base = "/backup2";
  68       mainPackage = pkgs.postgresql;
  69       hosts = {
  70         eldiron = {
  71           slot = "backup_2";
  72           connection = "postgresql://backup-2:${config.hostEnv.ldap.password}@eldiron.immae.eu";
  73           package = pkgs.postgresql;
  74         };
  75       };
  76     };
  77     mariadb = {
  78       enable = true;
  79       base = "/backup2";
  80       hosts = {
  81         eldiron = {
  82           serverId = 2;
  83           # mysql resolves "backup-2" host and checks the ip, but uses /etc/hosts which only contains ip4
  84           host = config.myEnv.servers.eldiron.ips.main.ip4;
  85           port = "3306";
  86           user = "backup-2";
  87           password = config.hostEnv.ldap.password;
  88           dumpUser = "root";
  89           dumpPassword = config.myEnv.databases.mysql.systemUsers.root;
  90         };
  91       };
  92     };
  93     redis = {
  94       enable = true;
  95       base = "/backup2";
  96       hosts = {
  97         eldiron = {
  98           host = "127.0.0.1";
  99           port = "16379";
 100         };
 101       };
 102     };
 103     openldap = {
 104       enable = true;
 105       base = "/backup2";
 106       hosts = {
 107         eldiron = {
 108           url = "ldaps://${config.myEnv.ldap.host}:636";
 109           dn = config.myEnv.ldap.replication_dn;
 110           password = config.myEnv.ldap.replication_pw;
 111           base = config.myEnv.ldap.base;
 112         };
 113       };
 114     };
 115   };
 116
 117   # This value determines the NixOS release with which your system is
 118   # to be compatible, in order to avoid breaking some software such as
 119   # database servers. You should change this only after NixOS release
 120   # notes say you should.
 121   # https://nixos.org/nixos/manual/release-notes.html
 122   system.stateVersion = "20.03"; # Did you read the comment?
 123 }