systems/dilion/base.nix

   1 { config, pkgs, name, lib, pkgs-no-overlay, secrets, ... }:
   2 {
   3   # ssh-keyscan dilion | nix-shell -p ssh-to-age --run ssh-to-age
   4   secrets.ageKeys = [ "age1x49n6qa0arkdpq8530s7umgm0gqkq90exv4jep97q30rfnzknpaqate06a" ];
   5   boot = {
   6     loader = {
   7       grub = {
   8         devices = [ "/dev/sda" "/dev/sdb" "/dev/sdc" "/dev/sdd" ];
   9       };
  10       timeout = 1;
  11     };
  12     blacklistedKernelModules = [ "nvidiafb" ];
  13     supportedFilesystems = [ "zfs" ];
  14     kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
  15     kernelModules = [ "kvm-intel" ];
  16     initrd.availableKernelModules = [ "ahci" "sd_mod" ];
  17     initrd.secrets = {
  18       "/boot/pass.key" = "/boot/pass.key";
  19     };
  20     kernel.sysctl."vm.nr_hugepages" = 256; # for xmr-stak
  21     # available in nixos-20.09
  22     #zfs.requestEncryptionCredentials = [ "zpool/root" ];
  23   };
  24   powerManagement.cpuFreqGovernor = "powersave";
  25   hardware.enableRedistributableFirmware = true;
  26
  27   swapDevices = [ { label = "swap"; } ];
  28   fileSystems = {
  29     "/"           = { fsType = "zfs"; device = "zpool/root"; };
  30     "/boot"       = { fsType = "ext4"; device = "/dev/disk/by-uuid/fd1c511e-2bc0-49d5-b8bb-95e7e8c8c816"; };
  31     "/etc"        = { fsType = "zfs"; device = "zpool/root/etc"; };
  32     "/home"       = { fsType = "zfs"; device = "zpool/root/home"; };
  33     "/tmp"        = { fsType = "zfs"; device = "zpool/root/tmp"; };
  34     "/var"        = { fsType = "zfs"; device = "zpool/root/var"; };
  35     "/data"       = { fsType = "ext4"; label = "data"; };
  36     "/nix"        = { fsType = "ext4"; label = "nix"; };
  37   };
  38
  39   services.udev.extraRules = ''
  40     ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="10:bf:48:7f:e6:3b", NAME="eth0"
  41   '';
  42
  43   nixpkgs.config.permittedInsecurePackages = [
  44     "python-2.7.18.6" # for nagios-cli
  45   ];
  46
  47   networking = {
  48     hostId = "27c3048d"; # generated with head -c4 /dev/urandom | od -A none -t x4
  49     firewall.enable = false;
  50     interfaces."eth0".ipv4.addresses =
  51       [ { address = lib.head config.hostEnv.ips.main.ip4; prefixLength = 27; } ]
  52       ++ pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
  53         (n: ips: map (ip: { address = ip; prefixLength = 32; }) (ips.ip4 or []))
  54         (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips));
  55     interfaces."eth0".ipv6.addresses =
  56       [ { address = "2a01:4f8:141:53e7::"; prefixLength = 64; } ]
  57       ++ pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
  58         (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
  59         config.hostEnv.ips);
  60     defaultGateway = { address = "176.9.10.225"; interface = "eth0"; };
  61     defaultGateway6 = { address = "fe80::1"; interface = "eth0"; };
  62     nameservers = [
  63       "213.133.98.98"
  64       "213.133.99.99"
  65       "213.133.100.100"
  66       "2a01:4f8:0:a0a1::add:1010"
  67       "2a01:4f8:0:a102::add:9999"
  68       "2a01:4f8:0:a111::add:9898"
  69     ];
  70   };
  71
  72   imports = [
  73     secrets.nixosModules.users-config-dilion
  74     ./monitoring.nix
  75     ./vms.nix
  76   ];
  77
  78   myServices.vms.libvirt-guests = {
  79     buildbot = {
  80       pool = "zfspool";
  81       network = "immae";
  82       cpus = 1;
  83       memory = 3;
  84       diskSize = 10;
  85       destroyVolumeOnExit = true;
  86     };
  87   };
  88   myServices.vms.libvirt-images = {
  89     nixos = ./vms/base_configuration.nix;
  90     buildbot = ./vms/buildbot_configuration.nix;
  91   };
  92   myServices.vms.libvirt-networks.immae = {
  93     bridgeNumber = 1;
  94     ipRange = "192.168.100";
  95   };
  96   myServices.vms.libvirt-pools = {
  97     niximages = {
  98       type = "dir";
  99       target = "/etc/libvirtd/base-images";
 100     };
 101     buildbot-disks = rec {
 102       type = "dir";
 103       target = "/var/lib/libvirt/images/buildbot-disks";
 104       preStart = ''
 105         mkdir -p ${target}
 106       '';
 107     };
 108     zfspool = {
 109       # pool-define-as --name zfspool --source-name zpool/libvirt --type zfs
 110       type = "zfs";
 111       xml = ''
 112         <source>
 113           <name>zpool/libvirt</name>
 114         </source>
 115       '';
 116     };
 117   };
 118
 119   system.nssModules = [ pkgs.libvirt ];
 120   system.nssDatabases.hosts = lib.mkForce [ "files" "libvirt_guest" "mymachines" "dns" "myhostname" ];
 121   programs.zsh.enable = true;
 122
 123   users.users.libvirt = {
 124     hashedPassword = "!";
 125     shell = pkgs.bashInteractive;
 126     isSystemUser = true;
 127     group = "libvirtd";
 128     packages = [ pkgs.libressl.nc ];
 129     openssh.authorizedKeys.keys = [
 130       config.myEnv.buildbot.ssh_key.public
 131       config.myEnv.sshd.rootKeys.ismael_flony
 132     ];
 133   };
 134
 135   users.groups.backup = {};
 136   users.users.backup = {
 137     hashedPassword = "!";
 138     isSystemUser = true;
 139     extraGroups = [ "keys" ];
 140     group = "backup";
 141     shell = pkgs.bashInteractive;
 142     openssh.authorizedKeys.keys = let
 143       zreplConfig = "/etc/zrepl/zrepl.yml";
 144     in
 145       ["command=\"${pkgs.zrepl}/bin/zrepl stdinserver --config ${zreplConfig} eldiron\",restrict ${config.myEnv.zrepl_backup.ssh_key.public}"];
 146   };
 147
 148   virtualisation.docker.enable = true;
 149   virtualisation.docker.storageDriver = "zfs";
 150   virtualisation.libvirtd.enable = true;
 151   virtualisation.libvirtd.qemu.package = pkgs-no-overlay.qemu;
 152   systemd.services.libvirtd.path = lib.mkAfter [ config.boot.zfs.package ];
 153   systemd.services.libvirtd.postStart = ''
 154     install -m 0770 -g libvirtd -d /var/lib/libvirt/images
 155   '';
 156
 157   time.timeZone = "Europe/Paris";
 158   nix = {
 159     settings = {
 160       sandbox = "relaxed";
 161       max-jobs = 8;
 162       substituters = [ "https://hydra.iohk.io" "https://cache.nixos.org" ];
 163       trusted-public-keys = [ "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=" ];
 164       trusted-users = [ "root" "@wheel"] ;
 165     };
 166     extraOptions = ''
 167       keep-outputs = true
 168       keep-derivations = true
 169       allow-unsafe-native-code-during-evaluation = true
 170       experimental-features = nix-command flakes
 171       #Assumed in NUR
 172       allow-import-from-derivation = true
 173     '';
 174   };
 175
 176   security.pki.certificateFiles = [
 177     (pkgs.fetchurl {
 178       url = "http://downloads.e.eriomem.net/eriomemca.pem";
 179       sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh";
 180     })
 181   ];
 182
 183   myServices.monitoring.enable = true;
 184   security.acme.certs."${name}-immae" = {
 185     group = "immae";
 186     domain = "dilion.immae.eu";
 187   };
 188   security.acme.certs."${name}" = {
 189     group = config.services.nginx.group;
 190     extraDomainNames = [
 191       "dilion.immae.dev"
 192     ];
 193   };
 194   systemd.services.nginx.serviceConfig.ProtectHome = "read-only";
 195   services.nginx = {
 196     enable = true;
 197     recommendedOptimisation = true;
 198     recommendedGzipSettings = true;
 199     recommendedProxySettings = true;
 200     virtualHosts = {
 201       "dilion.immae.dev" = {
 202         acmeRoot = config.security.acme.defaults.webroot;
 203         useACMEHost = name;
 204         forceSSL = true;
 205         locations."/".root = "/home/immae/www";
 206       };
 207     };
 208   };
 209
 210   secrets.keys = {
 211     "zrepl/${name}.key" = {
 212       permissions = "0400";
 213       text = config.myEnv.zrepl_backup.certs."${name}".key;
 214       user = "backup";
 215       group = "root";
 216     };
 217   } // builtins.listToAttrs (map (x: lib.attrsets.nameValuePair "zrepl/certificates/${x}.crt" {
 218     permissions = "0400";
 219     text = config.myEnv.zrepl_backup.certs."${x}".certificate;
 220     user = "backup";
 221     group = "root";
 222   }) (builtins.attrNames config.myEnv.zrepl_backup.certs));
 223
 224   environment.etc."mdadm.conf" = {
 225     enable = true;
 226     mode = "0644";
 227     user = "root";
 228     text = "MAILADDR ${config.myEnv.monitoring.email}";
 229   };
 230
 231
 232   systemd.services.zrepl.serviceConfig.User = "backup";
 233   systemd.services.zrepl.path = [ pkgs.openssh ];
 234   # pour eldiron:
 235   # zfs allow backup create,mount,receive,destroy,rename,snapshot,hold,bookmark,release zpool/backup
 236   # pour flony:
 237   # zfs allow backup hold,release,bookmark,snapshot,send zpool
 238   services.zrepl = {
 239     enable = true;
 240     settings = {
 241       global.control.sockpath = "/run/zrepl/control";
 242       global.serve.stdinserver.sockdir = "/run/zrepl/stdinserver";
 243       jobs = [
 244         {
 245           type = "sink";
 246           # must not change
 247           name = "backup-from-eldiron";
 248           root_fs = "zpool/backup";
 249           serve.type = "tls";
 250           serve.listen = ":19000";
 251           serve.ca = config.secrets.fullPaths."zrepl/certificates/eldiron.crt";
 252           serve.cert = config.secrets.fullPaths."zrepl/certificates/dilion.crt";
 253           serve.key = config.secrets.fullPaths."zrepl/dilion.key";
 254           serve.client_cns = [ "eldiron" ];
 255         }
 256         {
 257           type = "source";
 258           # must not change
 259           name = "backup-to-wd-zpool";
 260           # not encrypted!
 261           serve.type = "tls";
 262           serve.listen = ":19001";
 263           serve.ca = config.secrets.fullPaths."zrepl/certificates/flony.crt";
 264           serve.cert = config.secrets.fullPaths."zrepl/certificates/dilion.crt";
 265           serve.key = config.secrets.fullPaths."zrepl/dilion.key";
 266           serve.client_cns = [ "flony" ];
 267           filesystems."zpool/libvirt<" = true;
 268           filesystems."zpool/root<" = true;
 269           snapshotting.type = "manual";
 270         }
 271         {
 272           type = "source";
 273           # must not change
 274           name = "backup-to-wd-zpool-docker";
 275           # not encrypted!
 276           serve.type = "tls";
 277           serve.listen = ":19002";
 278           serve.ca = config.secrets.fullPaths."zrepl/certificates/flony.crt";
 279           serve.cert = config.secrets.fullPaths."zrepl/certificates/dilion.crt";
 280           serve.key = config.secrets.fullPaths."zrepl/dilion.key";
 281           serve.client_cns = [ "flony" ];
 282           filesystems."zpool/docker<" = true;
 283           snapshotting.type = "manual";
 284         }
 285       ];
 286     };
 287   };
 288   # This value determines the NixOS release with which your system is
 289   # to be compatible, in order to avoid breaking some software such as
 290   # database servers. You should change this only after NixOS release
 291   # notes say you should.
 292   # https://nixos.org/nixos/manual/release-notes.html
 293   system.stateVersion = "23.05"; # Did you read the comment?
 294 }
 295