nixops/eldiron.nix

   1 { environment ? ./environment.nix }:
   2 {
   3   network = {
   4     description = "Immae's network";
   5     enableRollback = true;
   6   };
   7
   8   eldiron = { config, pkgs, mylibs, myconfig, ... }:
   9     with mylibs;
  10   {
  11     _module.args = {
  12       mylibs = import ../libs.nix;
  13       myconfig = {
  14         env = import environment;
  15         ips = {
  16           main = "176.9.151.89";
  17           production = "176.9.151.154";
  18           integration = "176.9.151.155";
  19         };
  20       };
  21     };
  22
  23     imports = [
  24       ./modules/certificates.nix
  25       ./modules/gitolite
  26       ./modules/databases
  27       ./modules/websites
  28       ./modules/mail
  29       ./modules/ftp
  30     ];
  31     services.myGitolite.enable = true;
  32     services.myDatabases.enable = true;
  33     services.myWebsites.production.enable = true;
  34     services.myWebsites.integration.enable = true;
  35     services.myWebsites.tools.enable = true;
  36     services.pure-ftpd.enable = true;
  37
  38     networking = {
  39       firewall = {
  40         enable = true;
  41         allowedTCPPorts = [ 22 ];
  42       };
  43     };
  44
  45     deployment = {
  46       targetEnv = "hetzner";
  47       hetzner = {
  48         robotUser = myconfig.env.hetzner.user;
  49         robotPass = myconfig.env.hetzner.pass;
  50         mainIPv4 = myconfig.ips.main;
  51         partitions = ''
  52           clearpart --all --initlabel --drives=sda,sdb
  53
  54           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  55           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  56
  57           part raid.1 --grow --ondisk=sda
  58           part raid.2 --grow --ondisk=sdb
  59
  60           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  61         '';
  62       };
  63     };
  64
  65     environment.systemPackages = [
  66       pkgs.telnet
  67       pkgs.htop
  68       pkgs.vim
  69     ];
  70
  71     services.openssh.extraConfig = ''
  72       AuthorizedKeysCommand     /etc/ssh/ldap_authorized_keys
  73       AuthorizedKeysCommandUser nobody
  74       '';
  75
  76     environment.etc."ssh/ldap_authorized_keys" = let
  77       ldap_authorized_keys =
  78         wrap {
  79           name = "ldap_authorized_keys";
  80           file = ./ldap_authorized_keys.sh;
  81           vars = {
  82             LDAP_PASS = myconfig.env.sshd.ldap.password;
  83             GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell";
  84             ECHO = "${pkgs.coreutils}/bin/echo";
  85           };
  86           paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
  87         };
  88     in {
  89       enable = true;
  90       mode = "0755";
  91       user = "root";
  92       source = ldap_authorized_keys;
  93     };
  94
  95     services.cron = {
  96       enable = true;
  97       systemCronJobs = [
  98         ''
  99           # The star after /var/lib/* avoids deleting all folders in case of problem
 100           0 3,9,15,21 * * * root rsync -e "ssh -i /root/.ssh/id_charon_vpn" -aAXvz --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu: > /dev/null
 101         ''
 102       ];
 103     };
 104   };
 105 }