modules/private/system/dilion.nix

   1 { privateFiles }:
   2 { config, pkgs, name, ... }:
   3 {
   4   boot.supportedFilesystems = [ "zfs" ];
   5   boot.kernelPackages = pkgs.linuxPackages_latest;
   6   myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; };
   7
   8   networking = {
   9     hostId = "27c3048d"; # generated with head -c4 /dev/urandom | od -A none -t x4
  10     firewall.enable = false;
  11     interfaces."eth0".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList
  12       (n: ips: { address = ips.ip4; prefixLength = 32; })
  13       (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips);
  14     interfaces."eth0".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
  15       (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
  16       config.hostEnv.ips);
  17   };
  18
  19   myServices.ssh.modules = [ config.myServices.ssh.predefinedModules.regular ];
  20   imports = builtins.attrValues (import ../..);
  21
  22   deployment = {
  23     targetEnv = "hetzner";
  24     hetzner = {
  25       robotUser = config.myEnv.hetzner.user;
  26       robotPass = config.myEnv.hetzner.pass;
  27       mainIPv4 = config.hostEnv.ips.main.ip4;
  28       partitions = ''
  29         clearpart --all --initlabel --drives=sda,sdb,sdc,sdd
  30
  31         part swap --recommended --label=swap --fstype=swap --ondisk=sda
  32
  33         part raid.1 --grow --ondisk=sdc
  34         part raid.2 --grow --ondisk=sdd
  35
  36         raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  37
  38         part /nix --grow --label=nix --ondisk=sda
  39         part /data --grow --label=data --ondisk=sdb
  40       '';
  41     };
  42   };
  43
  44   programs.zsh.enable = true;
  45
  46   users.users.backup = {
  47     home = "/var/lib/backup";
  48     createHome = true;
  49     hashedPassword = "!";
  50     isSystemUser = true;
  51     shell = pkgs.bashInteractive;
  52     openssh.authorizedKeys.keys = let
  53     in
  54       ["command=\"${pkgs.rrsync_sudo}/bin/rrsync /var/lib/backup/eldiron/\"  ${config.myEnv.rsync_backup.ssh_key.public}"];
  55   };
  56   security.sudo.extraRules = pkgs.lib.mkAfter [
  57     {
  58       commands = [
  59         { command = "${pkgs.rsync}/bin/rsync"; options = [ "NOPASSWD" ]; }
  60       ];
  61       users = [ "backup" ];
  62       runAs = "root";
  63     }
  64     {
  65       commands = [
  66         { command = "/home/immae/.nix-profile/root_scripts/*"; options = [ "NOPASSWD" ]; }
  67       ];
  68       users = [ "immae" ];
  69       runAs = "root";
  70     }
  71   ];
  72
  73   boot.kernel.sysctl."vm.nr_hugepages" = 256; # for xmr-stak
  74   system.activationScripts.backup_home = ''
  75     chown root:root /var/lib/backup
  76     install -m 0750 -o backup -g root -d /var/lib/backup/eldiron
  77   '';
  78
  79   virtualisation.docker.enable = true;
  80   virtualisation.libvirtd.enable = true;
  81   users.extraUsers.immae.extraGroups = [ "libvirtd" "docker" ];
  82   systemd.services.libvirtd.postStart = ''
  83     install -m 0770 -g libvirtd -d /var/lib/libvirt/images
  84   '';
  85
  86   time.timeZone = "Europe/Paris";
  87   nix = {
  88     useSandbox = "relaxed";
  89     extraOptions = ''
  90       keep-outputs = true
  91       keep-derivations = true
  92       #Assumed in NUR
  93       allow-import-from-derivation = true
  94     '';
  95   };
  96
  97   security.pki.certificateFiles = [
  98     (pkgs.fetchurl {
  99       url = "http://downloads.e.eriomem.net/eriomemca.pem";
 100       sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh";
 101     })
 102   ];
 103
 104   # This is equivalent to setting environment.sessionVariables.NIX_PATH
 105   nix.nixPath = [
 106     "home-manager=https://github.com/rycee/home-manager/archive/master.tar.gz"
 107     "nixpkgs=https://nixos.org/channels/nixos-unstable/nixexprs.tar.xz"
 108   ];
 109   nix.binaryCaches = [ "https://hydra.iohk.io" "https://cache.nixos.org" ];
 110   nix.binaryCachePublicKeys = [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
 111
 112   myServices.certificates.enable = true;
 113   security.acme.certs."${name}" = {
 114     user = config.services.nginx.user;
 115     group = config.services.nginx.group;
 116     extraDomains = {
 117       "discourse.immae.eu" = null;
 118       "discourse.cip-ca.fr" = null;
 119       "dev.immae.eu" = null;
 120     };
 121   };
 122   services.nginx = {
 123     enable = true;
 124     recommendedOptimisation = true;
 125     recommendedGzipSettings = true;
 126     recommendedProxySettings = true;
 127     virtualHosts = {
 128       "dev.immae.eu" = {
 129         acmeRoot = config.myServices.certificates.webroot;
 130         useACMEHost = name;
 131         forceSSL = true;
 132         root = "/home/immae/www";
 133       };
 134       "discourse.immae.eu" = {
 135         acmeRoot = config.myServices.certificates.webroot;
 136         useACMEHost = name;
 137         forceSSL = true;
 138         locations."/".proxyPass = "http://localhost:18031";
 139       };
 140       "discourse.cip-ca.fr" = {
 141         acmeRoot = config.myServices.certificates.webroot;
 142         useACMEHost = name;
 143         forceSSL = true;
 144         locations."/".proxyPass = "http://localhost:18031";
 145       };
 146     };
 147   };
 148
 149   # This value determines the NixOS release with which your system is
 150   # to be compatible, in order to avoid breaking some software such as
 151   # database servers. You should change this only after NixOS release
 152   # notes say you should.
 153   # https://nixos.org/nixos/manual/release-notes.html
 154   system.stateVersion = "20.03"; # Did you read the comment?
 155 }
 156