modules/private/system/backup-2.nix

   1 { privateFiles }:
   2 { config, pkgs, resources, name, ... }:
   3 {
   4   boot.kernelPackages = pkgs.linuxPackages_latest;
   5   myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; };
   6   hostEnv.FQDN = "backup-2.v.immae.eu";
   7
   8   imports = builtins.attrValues (import ../..);
   9
  10   deployment = {
  11     targetEnv = "hetznerCloud";
  12     hetznerCloud = {
  13       authToken = config.myEnv.hetznerCloud.authToken;
  14       datacenter = "hel1-dc2";
  15       location  ="hel1";
  16       serverType = "cx11";
  17     };
  18   };
  19
  20   fileSystems = {
  21     "/backup2" = {
  22       fsType = "ext4";
  23       device = "UUID=b9425333-f567-435d-94d8-b26c22d93426";
  24     };
  25   };
  26
  27   networking = {
  28     firewall.enable = true;
  29     interfaces."ens3".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList
  30       (n: ips: { address = ips.ip4; prefixLength = 32; })
  31       (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.myEnv.servers.backup-2.ips);
  32     interfaces."ens3".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
  33       (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
  34       config.myEnv.servers.backup-2.ips);
  35     defaultGateway6 = { address = "fe80::1"; interface = "ens3"; };
  36   };
  37
  38   services.cron = {
  39     mailto = "cron@immae.eu";
  40     enable = true;
  41   };
  42
  43   services.rsyncBackup = {
  44     mountpoint = "/backup2";
  45     mailto = config.myEnv.rsync_backup.mailto;
  46     profiles = config.myEnv.rsync_backup.profiles;
  47     ssh_key_public = config.myEnv.rsync_backup.ssh_key.public;
  48     ssh_key_private = config.myEnv.rsync_backup.ssh_key.private;
  49   };
  50
  51   myServices.mailRelay.enable = true;
  52   myServices.monitoring.enable = true;
  53   myServices.databasesReplication = {
  54     postgresql = {
  55       enable = true;
  56       base = "/backup2";
  57       hosts = {
  58         eldiron = {
  59           slot = "backup_2";
  60           connection = "postgresql://backup-2:${config.myEnv.servers.backup-2.ldap.password}@eldiron.immae.eu";
  61         };
  62       };
  63     };
  64     mariadb = {
  65       enable = true;
  66       base = "/backup2";
  67       hosts = {
  68         eldiron = {
  69           serverId = 2;
  70           # mysql resolves "backup-2" host and checks the ip, but uses /etc/hosts which only contains ip4
  71           host = config.myEnv.servers.eldiron.ips.main.ip4;
  72           port = "3306";
  73           user = "backup-2";
  74           password = config.myEnv.servers.backup-2.ldap.password;
  75           dumpUser = "root";
  76           dumpPassword = config.myEnv.databases.mysql.systemUsers.root;
  77         };
  78       };
  79     };
  80     redis = {
  81       enable = true;
  82       base = "/backup2";
  83       hosts = {
  84         eldiron = {
  85           host = "127.0.0.1";
  86           port = "16379";
  87         };
  88       };
  89     };
  90     openldap = {
  91       enable = true;
  92       base = "/backup2";
  93       hosts = {
  94         eldiron = {
  95           url = "ldaps://${config.myEnv.ldap.host}:636";
  96           dn = config.myEnv.ldap.replication_dn;
  97           password = config.myEnv.ldap.replication_pw;
  98           base = config.myEnv.ldap.base;
  99         };
 100       };
 101     };
 102   };
 103
 104   # This value determines the NixOS release with which your system is
 105   # to be compatible, in order to avoid breaking some software such as
 106   # database servers. You should change this only after NixOS release
 107   # notes say you should.
 108   # https://nixos.org/nixos/manual/release-notes.html
 109   system.stateVersion = "19.03"; # Did you read the comment?
 110 }