virtual/eldiron.nix

   1 {
   2   network = {
   3     description = "Immae's network";
   4     enableRollback = true;
   5   };
   6
   7   eldiron = { config, pkgs, ... }:
   8     let mypkgs = import ./packages.nix;
   9     in
  10   {
  11     networking = {
  12       firewall = {
  13         enable = true;
  14         allowedTCPPorts = [ 22 80 443 3306 5432 ];
  15       };
  16     };
  17
  18     deployment = {
  19       targetEnv = "hetzner";
  20       hetzner = {
  21         #robotUser = "defined in HETZNER_ROBOT_USER";
  22         #robotPass = "defined in HETZNER_ROBOT_PASS";
  23         mainIPv4 = "176.9.151.89";
  24         partitions = ''
  25           clearpart --all --initlabel --drives=sda,sdb
  26
  27           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  28           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  29
  30           part raid.1 --grow --ondisk=sda
  31           part raid.2 --grow --ondisk=sdb
  32
  33           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  34         '';
  35       };
  36     };
  37
  38     # FIXME: how to run it? currently set as timer
  39     security.acme.certs = {
  40       "eldiron" = {
  41         webroot = "/var/lib/acme/acme-challenge";
  42         email = "ismael@bouya.org";
  43         domain = "eldiron.immae.eu";
  44         extraDomains = {
  45           "db-1.immae.eu" = null;
  46         };
  47       };
  48     };
  49
  50     services.nginx = rec {
  51       enable = true;
  52       virtualHosts = {
  53         "_" = {
  54           serverName = "_";
  55           useACMEHost = "eldiron";
  56         };
  57         "eldiron.immae.eu" = {
  58           forceSSL = true;
  59           useACMEHost = "eldiron";
  60           locations."/" = {
  61             # FIXME: directory needs to exist
  62             root = "/var/www";
  63           };
  64         };
  65       };
  66     };
  67
  68     # FIXME: environment variables ?
  69     security.pam.services = let
  70       pam_ldap = pkgs.pam_ldap;
  71       pam_ldap_mysql = pkgs.writeText "mysql.conf" ''
  72         host ldap.immae.eu
  73         base dc=immae,dc=eu
  74         binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
  75         bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
  76         pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
  77         '';
  78     in [
  79       {
  80         name = "mysql";
  81         text = ''
  82           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
  83           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
  84           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
  85           '';
  86       }
  87     ];
  88
  89     # FIXME: initial sync
  90     # FIXME: backup
  91     # FIXME: restart after pam
  92     # FIXME: pam access doesn’t work (because of php module)
  93     services.mysql = rec {
  94       enable = true;
  95       package = pkgs.mariadb.overrideAttrs(old: rec {
  96         cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
  97         buildInputs = old.buildInputs ++ [ pkgs.pam ];
  98       });
  99     };
 100
 101     # FIXME: initial sync
 102     # FIXME: backup
 103     services.postgresql = rec {
 104       enable = true;
 105       package = pkgs.postgresql100.overrideAttrs(old: rec {
 106         passthru = old.passthru // { psqlSchema = "11.0"; };
 107         name = "postgresql-11.1";
 108         src = pkgs.fetchurl {
 109           url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
 110           sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
 111         };
 112       });
 113       enableTCPIP = true;
 114       extraConfig = ''
 115         max_connections = 100
 116         wal_level = logical
 117         shared_buffers = 128MB
 118         max_wal_size = 1GB
 119         min_wal_size = 80MB
 120         log_timezone = 'Europe/Paris'
 121         datestyle = 'iso, mdy'
 122         timezone = 'Europe/Paris'
 123         lc_messages = 'en_US.UTF-8'
 124         lc_monetary = 'en_US.UTF-8'
 125         lc_numeric = 'en_US.UTF-8'
 126         lc_time = 'en_US.UTF-8'
 127         default_text_search_config = 'pg_catalog.english'
 128         # ssl = on
 129         # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
 130         # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
 131         '';
 132       authentication = ''
 133         local   all     postgres                                ident
 134         local   all     all                                     md5
 135         host    all     all             178.33.252.96/32        md5
 136         host    all     all             188.165.209.148/32      md5
 137         #host   all     all             all                     pam
 138       '';
 139     };
 140   };
 141 }