{ privateFiles }: { config, pkgs, resources, name, ... }: { deployment = { targetUser = "root"; targetHost = config.hostEnv.ips.main.ip4; substituteOnDestination = true; }; boot.kernelPackages = pkgs.linuxPackages_latest; myEnv = import "${privateFiles}/environment.nix" // { inherit privateFiles; }; imports = [ ] ++ builtins.attrValues (import ../..); fileSystems = { "/backup2" = { fsType = "ext4"; device = "UUID=b9425333-f567-435d-94d8-b26c22d93426"; }; "/" = { device = "/dev/sda1"; fsType = "ext4"; }; }; networking = { firewall.enable = true; interfaces."ens3".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList (n: ips: { address = ips.ip4; prefixLength = 32; }) (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips); interfaces."ens3".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or [])) config.hostEnv.ips); defaultGateway6 = { address = "fe80::1"; interface = "ens3"; }; }; boot.loader.grub.device = "nodev"; myServices.certificates.enable = true; security.acme.certs."${name}" = { user = config.services.nginx.user; group = config.services.nginx.group; }; services.nginx = { enable = true; recommendedOptimisation = true; recommendedGzipSettings = true; recommendedProxySettings = true; }; networking.firewall.allowedTCPPorts = [ 80 443 ]; services.cron = { mailto = "cron@immae.eu"; enable = true; }; services.rsyncBackup = { mountpoint = "/backup2"; profiles = config.myEnv.rsync_backup.profiles; ssh_key_public = config.myEnv.rsync_backup.ssh_key.public; ssh_key_private = config.myEnv.rsync_backup.ssh_key.private; }; myServices.mailRelay.enable = true; myServices.mailBackup.enable = true; myServices.monitoring.enable = true; myServices.databasesReplication = { postgresql = { enable = true; base = "/backup2"; mainPackage = pkgs.postgresql; hosts = { eldiron = { slot = "backup_2"; connection = "postgresql://backup-2:${config.hostEnv.ldap.password}@eldiron.immae.eu"; package = pkgs.postgresql; }; }; }; mariadb = { enable = true; base = "/backup2"; hosts = { eldiron = { serverId = 2; # mysql resolves "backup-2" host and checks the ip, but uses /etc/hosts which only contains ip4 host = config.myEnv.servers.eldiron.ips.main.ip4; port = "3306"; user = "backup-2"; password = config.hostEnv.ldap.password; dumpUser = "root"; dumpPassword = config.myEnv.databases.mysql.systemUsers.root; }; }; }; redis = { enable = true; base = "/backup2"; hosts = { eldiron = { host = "127.0.0.1"; port = "16379"; }; }; }; openldap = { enable = true; base = "/backup2"; hosts = { eldiron = { url = "ldaps://${config.myEnv.ldap.host}:636"; dn = config.myEnv.ldap.replication_dn; password = config.myEnv.ldap.replication_pw; base = config.myEnv.ldap.base; }; }; }; }; # This value determines the NixOS release with which your system is # to be compatible, in order to avoid breaking some software such as # database servers. You should change this only after NixOS release # notes say you should. # https://nixos.org/nixos/manual/release-notes.html system.stateVersion = "20.03"; # Did you read the comment? }