nixops/eldiron.nix

   1 { environment ? ./environment.nix }:
   2 {
   3   network = {
   4     description = "Immae's network";
   5     enableRollback = true;
   6   };
   7
   8   eldiron = { config, pkgs, mylibs, myconfig, ... }:
   9     with mylibs;
  10   {
  11     _module.args = {
  12       mylibs = import ../libs.nix;
  13       myconfig = {
  14         env = import environment;
  15         ips = {
  16           main = "176.9.151.89";
  17           production = "176.9.151.154";
  18           integration = "176.9.151.155";
  19         };
  20       };
  21     };
  22
  23     imports = [
  24       ./modules/certificates.nix
  25       ./modules/gitolite
  26       ./modules/databases
  27       ./modules/mpd
  28       ./modules/websites
  29       ./modules/mail
  30       ./modules/ftp
  31     ];
  32     services.myGitolite.enable = true;
  33     services.myDatabases.enable = true;
  34     services.myWebsites.production.enable = true;
  35     services.myWebsites.integration.enable = true;
  36     services.myWebsites.tools.enable = true;
  37     services.pure-ftpd.enable = true;
  38
  39     networking = {
  40       firewall = {
  41         enable = true;
  42         allowedTCPPorts = [ 22 ];
  43       };
  44     };
  45
  46     deployment = {
  47       targetEnv = "hetzner";
  48       hetzner = {
  49         robotUser = myconfig.env.hetzner.user;
  50         robotPass = myconfig.env.hetzner.pass;
  51         mainIPv4 = myconfig.ips.main;
  52         partitions = ''
  53           clearpart --all --initlabel --drives=sda,sdb
  54
  55           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  56           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  57
  58           part raid.1 --grow --ondisk=sda
  59           part raid.2 --grow --ondisk=sdb
  60
  61           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  62         '';
  63       };
  64     };
  65
  66     environment.systemPackages = [
  67       pkgs.telnet
  68       pkgs.htop
  69       pkgs.vim
  70     ];
  71
  72     services.openssh.extraConfig = ''
  73       AuthorizedKeysCommand     /etc/ssh/ldap_authorized_keys
  74       AuthorizedKeysCommandUser nobody
  75       '';
  76
  77     environment.etc."ssh/ldap_authorized_keys" = let
  78       ldap_authorized_keys =
  79         wrap {
  80           name = "ldap_authorized_keys";
  81           file = ./ldap_authorized_keys.sh;
  82           vars = {
  83             LDAP_PASS = myconfig.env.sshd.ldap.password;
  84             GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell";
  85             ECHO = "${pkgs.coreutils}/bin/echo";
  86           };
  87           paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
  88         };
  89     in {
  90       enable = true;
  91       mode = "0755";
  92       user = "root";
  93       source = ldap_authorized_keys;
  94     };
  95
  96     services.cron = {
  97       enable = true;
  98       systemCronJobs = [
  99         ''
 100           # The star after /var/lib/* avoids deleting all folders in case of problem
 101           0 3,9,15,21 * * * root rsync -e "ssh -i /root/.ssh/id_charon_vpn" -aAXvz --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu: > /dev/null
 102         ''
 103       ];
 104     };
 105   };
 106 }