modules/private/system/dilion.nix

   1 { privateFiles }:
   2 { config, pkgs, ... }:
   3 {
   4   boot.kernelPackages = pkgs.linuxPackages_latest;
   5   myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; };
   6
   7   networking = {
   8     firewall.enable = false;
   9     interfaces."eth0".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList
  10       (n: ips: { address = ips.ip4; prefixLength = 32; })
  11       (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips);
  12     interfaces."eth0".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
  13       (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
  14       config.hostEnv.ips);
  15   };
  16
  17   myServices.ssh.modules = [ config.myServices.ssh.predefinedModules.regular ];
  18   imports = builtins.attrValues (import ../..);
  19
  20   deployment = {
  21     targetEnv = "hetzner";
  22     hetzner = {
  23       robotUser = config.myEnv.hetzner.user;
  24       robotPass = config.myEnv.hetzner.pass;
  25       mainIPv4 = config.hostEnv.ips.main.ip4;
  26       partitions = ''
  27         clearpart --all --initlabel --drives=sda,sdb,sdc,sdd
  28
  29         part swap --recommended --label=swap --fstype=swap --ondisk=sda
  30
  31         part raid.1 --grow --ondisk=sdc
  32         part raid.2 --grow --ondisk=sdd
  33
  34         raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  35
  36         part /nix --grow --label=nix --ondisk=sda
  37         part /data --grow --label=data --ondisk=sdb
  38       '';
  39     };
  40   };
  41
  42   programs.zsh.enable = true;
  43
  44   users.users.backup = {
  45     home = "/var/lib/backup";
  46     createHome = true;
  47     hashedPassword = "!";
  48     isSystemUser = true;
  49     shell = pkgs.bashInteractive;
  50     openssh.authorizedKeys.keys = let
  51     in
  52       ["command=\"${pkgs.rrsync_sudo}/bin/rrsync /var/lib/backup/eldiron/\"  ${config.myEnv.rsync_backup.ssh_key.public}"];
  53   };
  54   security.sudo.extraRules = [
  55     {
  56       commands = [
  57         { command = "${pkgs.rsync}/bin/rsync"; options = [ "NOPASSWD" ]; }
  58       ];
  59       users = [ "backup" ];
  60       runAs = "root";
  61     }
  62   ];
  63
  64   system.activationScripts.backup_home = ''
  65     chown root:root /var/lib/backup
  66     install -m 0750 -o backup -g root -d /var/lib/backup/eldiron
  67   '';
  68
  69   time.timeZone = "Europe/Paris";
  70   nix = {
  71     useSandbox = "relaxed";
  72     extraOptions = ''
  73       keep-outputs = true
  74       keep-derivations = true
  75       #Assumed in NUR
  76       allow-import-from-derivation = true
  77     '';
  78   };
  79
  80   # This is equivalent to setting environment.sessionVariables.NIX_PATH
  81   nix.nixPath = [
  82     "home-manager=https://github.com/rycee/home-manager/archive/release-19.03.tar.gz"
  83     "nixpkgs=https://nixos.org/channels/nixos-19.03/nixexprs.tar.xz"
  84   ];
  85
  86   # This value determines the NixOS release with which your system is
  87   # to be compatible, in order to avoid breaking some software such as
  88   # database servers. You should change this only after NixOS release
  89   # notes say you should.
  90   # https://nixos.org/nixos/manual/release-notes.html
  91   system.stateVersion = "19.03"; # Did you read the comment?
  92 }
  93