nixops/eldiron.nix

   1 { environment ? ./environment.nix }:
   2 {
   3   network = {
   4     description = "Immae's network";
   5     enableRollback = true;
   6   };
   7
   8   eldiron = { config, pkgs, mylibs, myconfig, ... }:
   9     with mylibs;
  10   {
  11     _module.args = {
  12       mylibs = import ../libs.nix;
  13       myconfig = {
  14         env = import environment;
  15         ips = {
  16           main = "176.9.151.89";
  17           production = "176.9.151.154";
  18           integration = "176.9.151.155";
  19         };
  20       };
  21     };
  22
  23     imports = [
  24       ./modules/certificates.nix
  25       ./modules/gitolite
  26       ./modules/databases
  27       ./modules/mpd
  28       ./modules/websites
  29       ./modules/mail
  30       ./modules/ftp
  31     ];
  32     services.myGitolite.enable = true;
  33     services.myDatabases.enable = true;
  34     services.myWebsites.production.enable = true;
  35     services.myWebsites.integration.enable = true;
  36     services.myWebsites.tools.enable = true;
  37     services.pure-ftpd.enable = true;
  38
  39     services.journald.extraConfig = ''
  40       MaxLevelStore="warning"
  41       MaxRetentionSec="1year"
  42       '';
  43     networking = {
  44       firewall = {
  45         enable = true;
  46         allowedTCPPorts = [ 22 ];
  47       };
  48     };
  49
  50     deployment = {
  51       targetEnv = "hetzner";
  52       hetzner = {
  53         robotUser = myconfig.env.hetzner.user;
  54         robotPass = myconfig.env.hetzner.pass;
  55         mainIPv4 = myconfig.ips.main;
  56         partitions = ''
  57           clearpart --all --initlabel --drives=sda,sdb
  58
  59           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  60           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  61
  62           part raid.1 --grow --ondisk=sda
  63           part raid.2 --grow --ondisk=sdb
  64
  65           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  66         '';
  67       };
  68     };
  69
  70     environment.systemPackages = [
  71       pkgs.telnet
  72       pkgs.htop
  73       pkgs.vim
  74     ];
  75
  76     services.openssh.extraConfig = ''
  77       AuthorizedKeysCommand     /etc/ssh/ldap_authorized_keys
  78       AuthorizedKeysCommandUser nobody
  79       '';
  80
  81     environment.etc."ssh/ldap_authorized_keys" = let
  82       ldap_authorized_keys =
  83         wrap {
  84           name = "ldap_authorized_keys";
  85           file = ./ldap_authorized_keys.sh;
  86           vars = {
  87             LDAP_PASS = myconfig.env.sshd.ldap.password;
  88             GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell";
  89             ECHO = "${pkgs.coreutils}/bin/echo";
  90           };
  91           paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
  92         };
  93     in {
  94       enable = true;
  95       mode = "0755";
  96       user = "root";
  97       source = ldap_authorized_keys;
  98     };
  99
 100     services.cron = {
 101       enable = true;
 102       systemCronJobs = [
 103         ''
 104           # The star after /var/lib/* avoids deleting all folders in case of problem
 105           0 3,9,15,21 * * * root rsync -e "ssh -i /root/.ssh/id_charon_vpn" -aAXvz --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu: > /dev/null
 106         ''
 107       ];
 108     };
 109   };
 110 }