nixops/eldiron.nix

   1 {
   2   network = {
   3     description = "Immae's network";
   4     enableRollback = true;
   5   };
   6
   7   eldiron = { config, pkgs, mylibs, myconfig, ... }:
   8     with mylibs;
   9   {
  10     _module.args = {
  11       mylibs = import ../libs.nix;
  12       myconfig = {
  13         env = import ./environment.nix;
  14         ips = {
  15           main = "176.9.151.89";
  16           production = "176.9.151.154";
  17           integration = "176.9.151.155";
  18         };
  19       };
  20     };
  21
  22     imports = [
  23       ./modules/certificates.nix
  24       ./modules/gitolite
  25       ./modules/databases
  26       ./modules/websites
  27       ./modules/mail
  28     ];
  29     services.myGitolite.enable = true;
  30     services.myDatabases.enable = true;
  31     services.myWebsites.production.enable = true;
  32     services.myWebsites.integration.enable = true;
  33     services.myWebsites.tools.enable = true;
  34
  35     networking = {
  36       firewall = {
  37         enable = true;
  38         allowedTCPPorts = [ 22 ];
  39       };
  40     };
  41
  42     deployment = {
  43       targetEnv = "hetzner";
  44       hetzner = {
  45         robotUser = myconfig.env.hetzner.user;
  46         robotPass = myconfig.env.hetzner.pass;
  47         mainIPv4 = myconfig.ips.main;
  48         partitions = ''
  49           clearpart --all --initlabel --drives=sda,sdb
  50
  51           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  52           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  53
  54           part raid.1 --grow --ondisk=sda
  55           part raid.2 --grow --ondisk=sdb
  56
  57           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  58         '';
  59       };
  60     };
  61
  62     environment.systemPackages = [
  63       pkgs.telnet
  64       pkgs.htop
  65       pkgs.vim
  66     ];
  67
  68     services.openssh.extraConfig = ''
  69       AuthorizedKeysCommand     /etc/ssh/ldap_authorized_keys
  70       AuthorizedKeysCommandUser nobody
  71       '';
  72
  73     environment.etc."ssh/ldap_authorized_keys" = let
  74       ldap_authorized_keys =
  75         wrap {
  76           name = "ldap_authorized_keys";
  77           file = ./ldap_authorized_keys.sh;
  78           vars = {
  79             LDAP_PASS = myconfig.env.sshd.ldap.password;
  80             GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell";
  81             ECHO = "${pkgs.coreutils}/bin/echo";
  82           };
  83           paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
  84         };
  85     in {
  86       enable = true;
  87       mode = "0755";
  88       user = "root";
  89       source = ldap_authorized_keys;
  90     };
  91
  92   };
  93 }