modules/private/system/dilion.nix

   1 { privateFiles }:
   2 { config, pkgs, name, lib, ... }:
   3 {
   4   boot.supportedFilesystems = [ "zfs" ];
   5   boot.kernelPackages = pkgs.linuxPackages_latest;
   6   myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; };
   7
   8   fileSystems = {
   9     "/"           = lib.mkForce { fsType = "zfs"; device = "zpool/root"; };
  10     "/boot"       = { fsType = "ext4"; device = "/dev/disk/by-uuid/fd1c511e-2bc0-49d5-b8bb-95e7e8c8c816"; };
  11     "/etc"        = { fsType = "zfs"; device = "zpool/root/etc"; };
  12     "/home"       = { fsType = "zfs"; device = "zpool/root/home"; };
  13     "/home/immae" = { fsType = "zfs"; device = "zpool/root/home/immae"; };
  14     "/tmp"        = { fsType = "zfs"; device = "zpool/root/tmp"; };
  15     "/var"        = { fsType = "zfs"; device = "zpool/root/var"; };
  16   };
  17   boot.initrd.secrets = {
  18     "/boot/pass.key" = "/boot/pass.key";
  19   };
  20
  21   networking = {
  22     hostId = "27c3048d"; # generated with head -c4 /dev/urandom | od -A none -t x4
  23     firewall.enable = false;
  24     interfaces."eth0".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList
  25       (n: ips: { address = ips.ip4; prefixLength = 32; })
  26       (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips);
  27     interfaces."eth0".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
  28       (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
  29       config.hostEnv.ips);
  30   };
  31
  32   myServices.ssh.modules = [ config.myServices.ssh.predefinedModules.regular ];
  33   imports = builtins.attrValues (import ../..);
  34
  35   deployment = {
  36     targetEnv = "hetzner";
  37     hetzner = {
  38       robotUser = config.myEnv.hetzner.user;
  39       robotPass = config.myEnv.hetzner.pass;
  40       mainIPv4 = config.hostEnv.ips.main.ip4;
  41       partitions = ''
  42         clearpart --all --initlabel --drives=sda,sdb,sdc,sdd
  43
  44         part swap --recommended --label=swap --fstype=swap --ondisk=sda
  45
  46         part raid.1 --grow --ondisk=sdc
  47         part raid.2 --grow --ondisk=sdd
  48
  49         raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  50
  51         part /nix --grow --label=nix --ondisk=sda
  52         part /data --grow --label=data --ondisk=sdb
  53       '';
  54     };
  55   };
  56
  57   system.nssModules = [ pkgs.libvirt ];
  58   system.nssDatabases.hosts = lib.mkForce [ "files" "libvirt_guest" "mymachines" "dns" "myhostname" ];
  59   programs.zsh.enable = true;
  60
  61   users.users.backup = {
  62     hashedPassword = "!";
  63     isSystemUser = true;
  64     extraGroups = [ "keys" ];
  65     shell = pkgs.bashInteractive;
  66     openssh.authorizedKeys.keys = let
  67       zreplConfig = config.secrets.fullPaths."zrepl/zrepl.yml";
  68     in
  69       ["command=\"${pkgs.zrepl}/bin/zrepl stdinserver --config ${zreplConfig} eldiron\",restrict ${config.myEnv.zrepl_backup.ssh_key.public}"];
  70   };
  71   security.sudo.extraRules = pkgs.lib.mkAfter [
  72     {
  73       commands = [
  74         { command = "/home/immae/.nix-profile/root_scripts/*"; options = [ "NOPASSWD" ]; }
  75       ];
  76       users = [ "immae" ];
  77       runAs = "root";
  78     }
  79   ];
  80
  81   boot.kernel.sysctl."vm.nr_hugepages" = 256; # for xmr-stak
  82   system.activationScripts.libvirtd_exports = ''
  83     install -m 0755 -o root -g root -d /var/lib/caldance
  84   '';
  85   virtualisation.docker.enable = true;
  86   virtualisation.docker.storageDriver = "zfs";
  87   virtualisation.libvirtd.enable = true;
  88   users.extraUsers.immae.extraGroups = [ "libvirtd" "docker" ];
  89   systemd.services.libvirtd.postStart = ''
  90     install -m 0770 -g libvirtd -d /var/lib/libvirt/images
  91   '';
  92   systemd.services.socat-caldance = {
  93     description = "Forward ssh port to caldance";
  94     wantedBy = [ "multi-user.target" ];
  95     after = [ "network.target" ];
  96
  97     serviceConfig = {
  98       ExecStart = "${pkgs.socat}/bin/socat TCP-LISTEN:8022,fork TCP:nixops-99a7e1ba-54dc-11ea-a965-10bf487fe63b-caldance:22";
  99     };
 100   };
 101
 102   time.timeZone = "Europe/Paris";
 103   nix = {
 104     useSandbox = "relaxed";
 105     extraOptions = ''
 106       keep-outputs = true
 107       keep-derivations = true
 108       #Assumed in NUR
 109       allow-import-from-derivation = true
 110     '';
 111   };
 112
 113   security.pki.certificateFiles = [
 114     (pkgs.fetchurl {
 115       url = "http://downloads.e.eriomem.net/eriomemca.pem";
 116       sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh";
 117     })
 118   ];
 119
 120   # This is equivalent to setting environment.sessionVariables.NIX_PATH
 121   nix.nixPath = [
 122     "home-manager=${pkgs.sources.home-manager.url}"
 123     "nixpkgs=${pkgs.sources.nixpkgs-home-manager.url}"
 124   ];
 125   nix.binaryCaches = [ "https://hydra.iohk.io" "https://cache.nixos.org" ];
 126   nix.binaryCachePublicKeys = [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
 127
 128   myServices.certificates.enable = true;
 129   security.acme.certs."${name}" = {
 130     user = config.services.nginx.user;
 131     group = config.services.nginx.group;
 132     extraDomains = {
 133       "discourse.immae.eu" = null;
 134       "discourse.cip-ca.fr" = null;
 135       "dev.immae.eu" = null;
 136       "caldance.immae.eu" = null;
 137     };
 138   };
 139   services.nginx = {
 140     enable = true;
 141     recommendedOptimisation = true;
 142     recommendedGzipSettings = true;
 143     recommendedProxySettings = true;
 144     upstreams = {
 145       caldance.servers."nixops-99a7e1ba-54dc-11ea-a965-10bf487fe63b-caldance:3031" = {};
 146     };
 147     virtualHosts = {
 148       "dev.immae.eu" = {
 149         acmeRoot = config.myServices.certificates.webroot;
 150         useACMEHost = name;
 151         forceSSL = true;
 152         root = "/home/immae/www";
 153       };
 154       "discourse.immae.eu" = {
 155         acmeRoot = config.myServices.certificates.webroot;
 156         useACMEHost = name;
 157         forceSSL = true;
 158         locations."/".proxyPass = "http://localhost:18031";
 159       };
 160       "discourse.cip-ca.fr" = {
 161         acmeRoot = config.myServices.certificates.webroot;
 162         useACMEHost = name;
 163         forceSSL = true;
 164         locations."/".proxyPass = "http://localhost:18031";
 165       };
 166       "caldance.immae.eu" = {
 167         acmeRoot = config.myServices.certificates.webroot;
 168         useACMEHost = name;
 169         forceSSL = true;
 170         locations."/".extraConfig = ''
 171           uwsgi_pass caldance;
 172         '';
 173         locations."/static/".alias = "/var/lib/caldance/caldance/app/www/static/";
 174         locations."/media/".alias = "/var/lib/caldance/caldance/media/";
 175         extraConfig = ''
 176           auth_basic           "Authentification requise";
 177           auth_basic_user_file ${pkgs.writeText "htpasswd" config.myEnv.websites.caldance.integration.password};
 178         '';
 179       };
 180     };
 181   };
 182
 183   systemd.services.zrepl.serviceConfig.RuntimeDirectory = lib.mkForce "zrepl zrepl/stdinserver";
 184   systemd.services.zrepl.serviceConfig.User = "backup";
 185   # zfs allow backup create,mount,receive,destroy,rename,snapshot,hold,bookmark,release zpool/backup
 186   services.zrepl = {
 187     enable = true;
 188     config = ''
 189       global:
 190         control:
 191           sockpath: /run/zrepl/control
 192         serve:
 193           stdinserver:
 194             sockdir: /run/zrepl/stdinserver
 195       jobs:
 196         - type: sink
 197           # must not change
 198           name: "backup-from-eldiron"
 199           root_fs: "zpool/backup"
 200           serve:
 201             type: stdinserver
 202             client_identities:
 203               - eldiron
 204     '';
 205   };
 206   # This value determines the NixOS release with which your system is
 207   # to be compatible, in order to avoid breaking some software such as
 208   # database servers. You should change this only after NixOS release
 209   # notes say you should.
 210   # https://nixos.org/nixos/manual/release-notes.html
 211   system.stateVersion = "20.03"; # Did you read the comment?
 212 }
 213