modules/private/system/backup-2.nix

   1 { privateFiles }:
   2 { config, pkgs, resources, ... }:
   3 {
   4   boot.kernelPackages = pkgs.linuxPackages_latest;
   5   myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; };
   6   hostEnv.FQDN = "backup-2.v.immae.eu";
   7
   8   imports = builtins.attrValues (import ../..);
   9
  10   deployment = {
  11     targetEnv = "hetznerCloud";
  12     hetznerCloud = {
  13       authToken = config.myEnv.hetznerCloud.authToken;
  14       datacenter = "hel1-dc2";
  15       location  ="hel1";
  16       serverType = "cx11";
  17     };
  18   };
  19
  20   fileSystems = {
  21     "/backup2" = {
  22       fsType = "ext4";
  23       device = "UUID=b9425333-f567-435d-94d8-b26c22d93426";
  24     };
  25   };
  26
  27   networking = {
  28     firewall.enable = true;
  29     interfaces."ens3".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList
  30       (n: ips: { address = ips.ip4; prefixLength = 32; })
  31       (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.myEnv.servers.backup-2.ips);
  32     interfaces."ens3".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
  33       (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
  34       config.myEnv.servers.backup-2.ips);
  35
  36     defaultMailServer = {
  37       directDelivery = true;
  38       hostName = "eldiron.immae.eu:25";
  39       useTLS = true;
  40       useSTARTTLS = true;
  41       root = "postmaster@immae.eu";
  42     };
  43   };
  44
  45   services.cron = {
  46     mailto = "cron@immae.eu";
  47     enable = true;
  48   };
  49
  50   services.rsyncBackup = {
  51     mountpoint = "/backup2";
  52     mailto = config.myEnv.rsync_backup.mailto;
  53     profiles = config.myEnv.rsync_backup.profiles;
  54     ssh_key_public = config.myEnv.rsync_backup.ssh_key.public;
  55     ssh_key_private = config.myEnv.rsync_backup.ssh_key.private;
  56   };
  57
  58   myServices.monitoring.enable = true;
  59   myServices.databasesReplication = {
  60     postgresql = {
  61       enable = true;
  62       base = "/backup2";
  63       hosts = {
  64         eldiron = {
  65           slot = "backup_2";
  66           connection = "postgresql://backup-2:${config.myEnv.servers.backup-2.ldap.password}@eldiron.immae.eu";
  67         };
  68       };
  69     };
  70     mariadb = {
  71       enable = true;
  72       base = "/backup2";
  73       hosts = {
  74         eldiron = {
  75           serverId = 2;
  76           # mysql resolves "backup-2" host and checks the ip, but uses /etc/hosts which only contains ip4
  77           host = config.myEnv.servers.eldiron.ips.main.ip4;
  78           port = "3306";
  79           user = "backup-2";
  80           password = config.myEnv.servers.backup-2.ldap.password;
  81           dumpUser = "root";
  82           dumpPassword = config.myEnv.databases.mysql.systemUsers.root;
  83         };
  84       };
  85     };
  86     redis = {
  87       enable = true;
  88       base = "/backup2";
  89       hosts = {
  90         eldiron = {
  91           host = "127.0.0.1";
  92           port = "16379";
  93         };
  94       };
  95     };
  96     openldap = {
  97       enable = true;
  98       base = "/backup2";
  99       hosts = {
 100         eldiron = {
 101           url = "ldaps://${config.myEnv.ldap.host}:636";
 102           dn = config.myEnv.ldap.replication_dn;
 103           password = config.myEnv.ldap.replication_pw;
 104           base = config.myEnv.ldap.base;
 105         };
 106       };
 107     };
 108   };
 109
 110   # This value determines the NixOS release with which your system is
 111   # to be compatible, in order to avoid breaking some software such as
 112   # database servers. You should change this only after NixOS release
 113   # notes say you should.
 114   # https://nixos.org/nixos/manual/release-notes.html
 115   system.stateVersion = "19.03"; # Did you read the comment?
 116 }