modules/private/system/dilion.nix

   1 { privateFiles }:
   2 { config, pkgs, name, lib, ... }:
   3 {
   4   deployment = {
   5     targetUser = "root";
   6     targetHost = config.hostEnv.ips.main.ip4;
   7     substituteOnDestination = true;
   8   };
   9   nixpkgs.system = lib.mkOverride 900 "x86_64-linux";
  10   boot = {
  11     loader = {
  12       grub = {
  13         version = 2;
  14         devices = [ "/dev/sda" "/dev/sdb" "/dev/sdc" "/dev/sdd" ];
  15       };
  16       timeout = 1;
  17     };
  18     blacklistedKernelModules = [ "nvidiafb" ];
  19     supportedFilesystems = [ "zfs" ];
  20     kernelPackages = pkgs.linuxPackages_latest;
  21     kernelModules = [ "kvm-intel" ];
  22     initrd.availableKernelModules = [ "ahci" "sd_mod" ];
  23     initrd.secrets = {
  24       "/boot/pass.key" = "/boot/pass.key";
  25     };
  26     kernel.sysctl."vm.nr_hugepages" = 256; # for xmr-stak
  27   };
  28   nix.maxJobs = 8;
  29   powerManagement.cpuFreqGovernor = "powersave";
  30   hardware.enableRedistributableFirmware = true;
  31
  32   myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; };
  33
  34   swapDevices = [ { label = "swap"; } ];
  35   fileSystems = {
  36     "/"           = { fsType = "zfs"; device = "zpool/root"; };
  37     "/boot"       = { fsType = "ext4"; device = "/dev/disk/by-uuid/fd1c511e-2bc0-49d5-b8bb-95e7e8c8c816"; };
  38     "/etc"        = { fsType = "zfs"; device = "zpool/root/etc"; };
  39     "/home"       = { fsType = "zfs"; device = "zpool/root/home"; };
  40     "/home/immae" = { fsType = "zfs"; device = "zpool/root/home/immae"; };
  41     "/tmp"        = { fsType = "zfs"; device = "zpool/root/tmp"; };
  42     "/var"        = { fsType = "zfs"; device = "zpool/root/var"; };
  43     "/data"       = { fsType = "ext4"; label = "data"; };
  44     "/nix"        = { fsType = "ext4"; label = "nix"; };
  45   };
  46
  47   services.udev.extraRules = ''
  48     ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="10:bf:48:7f:e6:3b", NAME="eth0"
  49   '';
  50
  51   networking = {
  52     hostId = "27c3048d"; # generated with head -c4 /dev/urandom | od -A none -t x4
  53     firewall.enable = false;
  54     interfaces."eth0".ipv4.addresses =
  55       [ { address = config.hostEnv.ips.main.ip4; prefixLength = 27; } ]
  56       ++ pkgs.lib.attrsets.mapAttrsToList
  57         (n: ips: { address = ips.ip4; prefixLength = 32; })
  58         (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips);
  59     interfaces."eth0".ipv6.addresses =
  60       [ { address = "2a01:4f8:141:53e7::"; prefixLength = 64; } ]
  61       ++ pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
  62         (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
  63         config.hostEnv.ips);
  64     defaultGateway = { address = "176.9.10.225"; interface = "eth0"; };
  65     defaultGateway6 = { address = "fe80::1"; interface = "eth0"; };
  66     nameservers = [
  67       "213.133.98.98"
  68       "213.133.99.99"
  69       "213.133.100.100"
  70       "2a01:4f8:0:a0a1::add:1010"
  71       "2a01:4f8:0:a102::add:9999"
  72       "2a01:4f8:0:a111::add:9898"
  73     ];
  74   };
  75
  76   myServices.ssh.modules = [ config.myServices.ssh.predefinedModules.regular ];
  77   imports = builtins.attrValues (import ../..);
  78
  79   system.nssModules = [ pkgs.libvirt ];
  80   system.nssDatabases.hosts = lib.mkForce [ "files" "libvirt_guest" "mymachines" "dns" "myhostname" ];
  81   programs.zsh.enable = true;
  82
  83   users.users.backup = {
  84     hashedPassword = "!";
  85     isSystemUser = true;
  86     extraGroups = [ "keys" ];
  87     shell = pkgs.bashInteractive;
  88     openssh.authorizedKeys.keys = let
  89       zreplConfig = config.secrets.fullPaths."zrepl/zrepl.yml";
  90     in
  91       ["command=\"${pkgs.zrepl}/bin/zrepl stdinserver --config ${zreplConfig} eldiron\",restrict ${config.myEnv.zrepl_backup.ssh_key.public}"];
  92   };
  93   security.sudo.extraRules = pkgs.lib.mkAfter [
  94     {
  95       commands = [
  96         { command = "/home/immae/.nix-profile/root_scripts/*"; options = [ "NOPASSWD" ]; }
  97       ];
  98       users = [ "immae" ];
  99       runAs = "root";
 100     }
 101   ];
 102
 103   system.activationScripts.libvirtd_exports = ''
 104     install -m 0755 -o root -g root -d /var/lib/caldance
 105   '';
 106   virtualisation.docker.enable = true;
 107   virtualisation.docker.storageDriver = "zfs";
 108   virtualisation.libvirtd.enable = true;
 109   users.extraUsers.immae.extraGroups = [ "libvirtd" "docker" ];
 110   systemd.services.libvirtd.postStart = ''
 111     install -m 0770 -g libvirtd -d /var/lib/libvirt/images
 112   '';
 113   systemd.services.socat-caldance = {
 114     description = "Forward ssh port to caldance";
 115     wantedBy = [ "multi-user.target" ];
 116     after = [ "network.target" ];
 117
 118     serviceConfig = {
 119       ExecStart = "${pkgs.socat}/bin/socat TCP-LISTEN:8022,fork TCP:nixops-99a7e1ba-54dc-11ea-a965-10bf487fe63b-caldance:22";
 120     };
 121   };
 122
 123   time.timeZone = "Europe/Paris";
 124   nix = {
 125     useSandbox = "relaxed";
 126     extraOptions = ''
 127       keep-outputs = true
 128       keep-derivations = true
 129       #Assumed in NUR
 130       allow-import-from-derivation = true
 131     '';
 132   };
 133
 134   security.pki.certificateFiles = [
 135     (pkgs.fetchurl {
 136       url = "http://downloads.e.eriomem.net/eriomemca.pem";
 137       sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh";
 138     })
 139   ];
 140
 141   # This is equivalent to setting environment.sessionVariables.NIX_PATH
 142   nix.nixPath = [
 143     "home-manager=${pkgs.sources.home-manager.url}"
 144     "nixpkgs=${pkgs.sources.nixpkgs-home-manager.url}"
 145   ];
 146   nix.binaryCaches = [ "https://hydra.iohk.io" "https://cache.nixos.org" ];
 147   nix.binaryCachePublicKeys = [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
 148
 149   myServices.certificates.enable = true;
 150   security.acme.certs."${name}" = {
 151     user = config.services.nginx.user;
 152     group = config.services.nginx.group;
 153     extraDomains = {
 154       "dev.immae.eu" = null;
 155       "caldance.immae.eu" = null;
 156     };
 157   };
 158   services.nginx = {
 159     enable = true;
 160     recommendedOptimisation = true;
 161     recommendedGzipSettings = true;
 162     recommendedProxySettings = true;
 163     upstreams = {
 164       caldance.servers."nixops-99a7e1ba-54dc-11ea-a965-10bf487fe63b-caldance:3031" = {};
 165     };
 166     virtualHosts = {
 167       "dev.immae.eu" = {
 168         acmeRoot = config.myServices.certificates.webroot;
 169         useACMEHost = name;
 170         forceSSL = true;
 171         root = "/home/immae/www";
 172       };
 173       "caldance.immae.eu" = {
 174         acmeRoot = config.myServices.certificates.webroot;
 175         useACMEHost = name;
 176         forceSSL = true;
 177         locations."/".extraConfig = ''
 178           uwsgi_pass caldance;
 179         '';
 180         locations."/static/".alias = "/var/lib/caldance/caldance/app/www/static/";
 181         locations."/media/".alias = "/var/lib/caldance/caldance/media/";
 182         extraConfig = ''
 183           auth_basic           "Authentification requise";
 184           auth_basic_user_file ${pkgs.writeText "htpasswd" config.myEnv.websites.caldance.integration.password};
 185         '';
 186       };
 187     };
 188   };
 189
 190   systemd.services.zrepl.serviceConfig.RuntimeDirectory = lib.mkForce "zrepl zrepl/stdinserver";
 191   systemd.services.zrepl.serviceConfig.User = "backup";
 192   # zfs allow backup create,mount,receive,destroy,rename,snapshot,hold,bookmark,release zpool/backup
 193   services.zrepl = {
 194     enable = true;
 195     config = ''
 196       global:
 197         control:
 198           sockpath: /run/zrepl/control
 199         serve:
 200           stdinserver:
 201             sockdir: /run/zrepl/stdinserver
 202       jobs:
 203         - type: sink
 204           # must not change
 205           name: "backup-from-eldiron"
 206           root_fs: "zpool/backup"
 207           serve:
 208             type: stdinserver
 209             client_identities:
 210               - eldiron
 211     '';
 212   };
 213   # This value determines the NixOS release with which your system is
 214   # to be compatible, in order to avoid breaking some software such as
 215   # database servers. You should change this only after NixOS release
 216   # notes say you should.
 217   # https://nixos.org/nixos/manual/release-notes.html
 218   system.stateVersion = "20.03"; # Did you read the comment?
 219 }
 220