modules/private/system/dilion.nix

   1 { privateFiles }:
   2 { config, pkgs, name, lib, ... }:
   3 {
   4   boot.supportedFilesystems = [ "zfs" ];
   5   boot.kernelPackages = pkgs.linuxPackages_latest;
   6   myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; };
   7
   8   fileSystems = {
   9     "/"           = lib.mkForce { fsType = "zfs"; device = "zpool/root"; };
  10     "/boot"       = { fsType = "ext4"; device = "/dev/disk/by-uuid/fd1c511e-2bc0-49d5-b8bb-95e7e8c8c816"; };
  11     "/etc"        = { fsType = "zfs"; device = "zpool/root/etc"; };
  12     "/home"       = { fsType = "zfs"; device = "zpool/root/home"; };
  13     "/home/immae" = { fsType = "zfs"; device = "zpool/root/home/immae"; };
  14     "/tmp"        = { fsType = "zfs"; device = "zpool/root/tmp"; };
  15     "/var"        = { fsType = "zfs"; device = "zpool/root/var"; };
  16   };
  17   boot.initrd.secrets = {
  18     "/boot/pass.key" = "/boot/pass.key";
  19   };
  20
  21   networking = {
  22     hostId = "27c3048d"; # generated with head -c4 /dev/urandom | od -A none -t x4
  23     firewall.enable = false;
  24     interfaces."eth0".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList
  25       (n: ips: { address = ips.ip4; prefixLength = 32; })
  26       (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips);
  27     interfaces."eth0".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
  28       (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
  29       config.hostEnv.ips);
  30   };
  31
  32   myServices.ssh.modules = [ config.myServices.ssh.predefinedModules.regular ];
  33   imports = builtins.attrValues (import ../..);
  34
  35   deployment = {
  36     targetEnv = "hetzner";
  37     hetzner = {
  38       robotUser = config.myEnv.hetzner.user;
  39       robotPass = config.myEnv.hetzner.pass;
  40       mainIPv4 = config.hostEnv.ips.main.ip4;
  41       partitions = ''
  42         clearpart --all --initlabel --drives=sda,sdb,sdc,sdd
  43
  44         part swap --recommended --label=swap --fstype=swap --ondisk=sda
  45
  46         part raid.1 --grow --ondisk=sdc
  47         part raid.2 --grow --ondisk=sdd
  48
  49         raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  50
  51         part /nix --grow --label=nix --ondisk=sda
  52         part /data --grow --label=data --ondisk=sdb
  53       '';
  54     };
  55   };
  56
  57   system.nssModules = [ pkgs.libvirt ];
  58   system.nssDatabases.hosts = lib.mkForce [ "files" "libvirt_guest" "mymachines" "dns" "myhostname" ];
  59   programs.zsh.enable = true;
  60
  61   users.users.backup = {
  62     home = "/var/lib/backup";
  63     createHome = true;
  64     hashedPassword = "!";
  65     isSystemUser = true;
  66     shell = pkgs.bashInteractive;
  67     openssh.authorizedKeys.keys = let
  68     in
  69       ["command=\"${pkgs.rrsync_sudo}/bin/rrsync /var/lib/backup/eldiron/\"  ${config.myEnv.rsync_backup.ssh_key.public}"];
  70   };
  71   security.sudo.extraRules = pkgs.lib.mkAfter [
  72     {
  73       commands = [
  74         { command = "${pkgs.rsync}/bin/rsync"; options = [ "NOPASSWD" ]; }
  75       ];
  76       users = [ "backup" ];
  77       runAs = "root";
  78     }
  79     {
  80       commands = [
  81         { command = "/home/immae/.nix-profile/root_scripts/*"; options = [ "NOPASSWD" ]; }
  82       ];
  83       users = [ "immae" ];
  84       runAs = "root";
  85     }
  86   ];
  87
  88   boot.kernel.sysctl."vm.nr_hugepages" = 256; # for xmr-stak
  89   system.activationScripts.backup_home = ''
  90     chown root:root /var/lib/backup
  91     install -m 0750 -o backup -g root -d /var/lib/backup/eldiron
  92   '';
  93
  94   system.activationScripts.libvirtd_exports = ''
  95     install -m 0755 -o root -g root -d /var/lib/caldance
  96   '';
  97   virtualisation.docker.enable = true;
  98   virtualisation.docker.storageDriver = "zfs";
  99   virtualisation.libvirtd.enable = true;
 100   users.extraUsers.immae.extraGroups = [ "libvirtd" "docker" ];
 101   systemd.services.libvirtd.postStart = ''
 102     install -m 0770 -g libvirtd -d /var/lib/libvirt/images
 103   '';
 104   systemd.services.socat-caldance = {
 105     description = "Forward ssh port to caldance";
 106     wantedBy = [ "multi-user.target" ];
 107     after = [ "network.target" ];
 108
 109     serviceConfig = {
 110       ExecStart = "${pkgs.socat}/bin/socat TCP-LISTEN:8022,fork TCP:nixops-99a7e1ba-54dc-11ea-a965-10bf487fe63b-caldance:22";
 111     };
 112   };
 113
 114   time.timeZone = "Europe/Paris";
 115   nix = {
 116     useSandbox = "relaxed";
 117     extraOptions = ''
 118       keep-outputs = true
 119       keep-derivations = true
 120       #Assumed in NUR
 121       allow-import-from-derivation = true
 122     '';
 123   };
 124
 125   security.pki.certificateFiles = [
 126     (pkgs.fetchurl {
 127       url = "http://downloads.e.eriomem.net/eriomemca.pem";
 128       sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh";
 129     })
 130   ];
 131
 132   # This is equivalent to setting environment.sessionVariables.NIX_PATH
 133   nix.nixPath = [
 134     "home-manager=${pkgs.sources.home-manager.url}"
 135     "nixpkgs=${pkgs.sources.nixpkgs-home-manager.url}"
 136   ];
 137   nix.binaryCaches = [ "https://hydra.iohk.io" "https://cache.nixos.org" ];
 138   nix.binaryCachePublicKeys = [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
 139
 140   myServices.certificates.enable = true;
 141   security.acme.certs."${name}" = {
 142     user = config.services.nginx.user;
 143     group = config.services.nginx.group;
 144     extraDomains = {
 145       "discourse.immae.eu" = null;
 146       "discourse.cip-ca.fr" = null;
 147       "dev.immae.eu" = null;
 148       "caldance.immae.eu" = null;
 149     };
 150   };
 151   services.nginx = {
 152     enable = true;
 153     recommendedOptimisation = true;
 154     recommendedGzipSettings = true;
 155     recommendedProxySettings = true;
 156     upstreams = {
 157       caldance.servers."nixops-99a7e1ba-54dc-11ea-a965-10bf487fe63b-caldance:3031" = {};
 158     };
 159     virtualHosts = {
 160       "dev.immae.eu" = {
 161         acmeRoot = config.myServices.certificates.webroot;
 162         useACMEHost = name;
 163         forceSSL = true;
 164         root = "/home/immae/www";
 165       };
 166       "discourse.immae.eu" = {
 167         acmeRoot = config.myServices.certificates.webroot;
 168         useACMEHost = name;
 169         forceSSL = true;
 170         locations."/".proxyPass = "http://localhost:18031";
 171       };
 172       "discourse.cip-ca.fr" = {
 173         acmeRoot = config.myServices.certificates.webroot;
 174         useACMEHost = name;
 175         forceSSL = true;
 176         locations."/".proxyPass = "http://localhost:18031";
 177       };
 178       "caldance.immae.eu" = {
 179         acmeRoot = config.myServices.certificates.webroot;
 180         useACMEHost = name;
 181         forceSSL = true;
 182         locations."/".extraConfig = ''
 183           uwsgi_pass caldance;
 184         '';
 185         locations."/static/".alias = "/var/lib/caldance/caldance/app/www/static/";
 186         locations."/media/".alias = "/var/lib/caldance/caldance/media/";
 187         extraConfig = ''
 188           auth_basic           "Authentification requise";
 189           auth_basic_user_file ${pkgs.writeText "htpasswd" config.myEnv.websites.caldance.integration.password};
 190         '';
 191       };
 192     };
 193   };
 194
 195   # This value determines the NixOS release with which your system is
 196   # to be compatible, in order to avoid breaking some software such as
 197   # database servers. You should change this only after NixOS release
 198   # notes say you should.
 199   # https://nixos.org/nixos/manual/release-notes.html
 200   system.stateVersion = "20.03"; # Did you read the comment?
 201 }
 202