{ privateFiles }: { config, pkgs, myconfig, ... }: { boot.kernelPackages = pkgs.linuxPackages_latest; _module.args.privateFiles = privateFiles; networking = { firewall.enable = true; # 176.9.151.89 declared in nixops -> infra / tools interfaces."eth0".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList (n: ips: { address = ips.ip4; prefixLength = 32; }) (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") myconfig.env.servers.eldiron.ips); interfaces."eth0".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or [])) myconfig.env.servers.eldiron.ips); }; imports = builtins.attrValues (import ../..); boot.kernel.sysctl = { # https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md "net.ipv4.tcp_sack" = 0; }; myServices.buildbot.enable = true; myServices.databases.enable = true; myServices.gitolite.enable = true; myServices.monitoring.enable = true; myServices.irc.enable = true; myServices.pub.enable = true; myServices.tasks.enable = true; services.pure-ftpd.enable = true; deployment = { targetEnv = "hetzner"; hetzner = { robotUser = myconfig.env.hetzner.user; robotPass = myconfig.env.hetzner.pass; mainIPv4 = myconfig.env.servers.eldiron.ips.main.ip4; partitions = '' clearpart --all --initlabel --drives=sda,sdb part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb part raid.1 --grow --ondisk=sda part raid.2 --grow --ondisk=sdb raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2 ''; }; }; services.cron = { enable = true; systemCronJobs = [ '' # The star after /var/lib/* avoids deleting all folders in case of problem 0 3,9,15,21 * * * root rsync -e "ssh -i /root/.ssh/id_charon_vpn" -aAXvz --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu: > /dev/null '' ]; }; # This value determines the NixOS release with which your system is # to be compatible, in order to avoid breaking some software such as # database servers. You should change this only after NixOS release # notes say you should. # https://nixos.org/nixos/manual/release-notes.html system.stateVersion = "19.03"; # Did you read the comment? }