virtual/eldiron.nix

   1 {
   2   network = {
   3     description = "Immae's network";
   4     enableRollback = true;
   5   };
   6
   7   # FIXME: improve purity by enforcing sandbox = true in
   8   # /etc/nix/nix.conf (need to do something about environment variables
   9   # before)
  10
  11   # Full backup:
  12   # The star after /var/lib/* avoids deleting all folders in case of problem
  13   # rsync -e "ssh -i /root/.ssh/id_charon_vpn" -aAXvz --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu:
  14   eldiron = { config, pkgs, mylibs, myconfig, ... }:
  15     with mylibs;
  16   {
  17     _module.args = {
  18       mylibs = import ../libs.nix;
  19       myconfig = {
  20         ips = {
  21           main = "176.9.151.89";
  22           production = "176.9.151.154";
  23           integration = "176.9.151.155";
  24         };
  25       };
  26     };
  27
  28     imports = [
  29       ./modules/certificates.nix
  30       ./modules/gitolite
  31       ./modules/databases
  32       ./modules/websites
  33     ];
  34     services.myGitolite.enable = true;
  35     services.myDatabases.enable = true;
  36     services.myWebsites.production.enable = true;
  37     services.myWebsites.integration.enable = true;
  38     services.myWebsites.tools.enable = true;
  39
  40     networking = {
  41       firewall = {
  42         enable = true;
  43         allowedTCPPorts = [ 22 ];
  44       };
  45     };
  46
  47     deployment = {
  48       targetEnv = "hetzner";
  49       hetzner = {
  50         #robotUser = "defined in HETZNER_ROBOT_USER";
  51         #robotPass = "defined in HETZNER_ROBOT_PASS";
  52         mainIPv4 = myconfig.ips.main;
  53         partitions = ''
  54           clearpart --all --initlabel --drives=sda,sdb
  55
  56           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  57           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  58
  59           part raid.1 --grow --ondisk=sda
  60           part raid.2 --grow --ondisk=sdb
  61
  62           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  63         '';
  64       };
  65     };
  66
  67     environment.systemPackages = [
  68       pkgs.telnet
  69       pkgs.htop
  70       pkgs.vim
  71     ];
  72
  73     services.openssh.extraConfig = ''
  74       AuthorizedKeysCommand     /etc/ssh/ldap_authorized_keys
  75       AuthorizedKeysCommandUser nobody
  76       '';
  77
  78     environment.etc."ssh/ldap_authorized_keys" = let
  79       ldap_authorized_keys =
  80         assert checkEnv "NIXOPS_SSHD_LDAP_PASSWORD";
  81         wrap {
  82           name = "ldap_authorized_keys";
  83           file = ./ldap_authorized_keys.sh;
  84           vars = {
  85             LDAP_PASS = builtins.getEnv "NIXOPS_SSHD_LDAP_PASSWORD";
  86             GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell";
  87             ECHO = "${pkgs.coreutils}/bin/echo";
  88           };
  89           paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
  90         };
  91     in {
  92       enable = true;
  93       mode = "0755";
  94       user = "root";
  95       source = ldap_authorized_keys;
  96     };
  97
  98   };
  99 }