enableRollback = true;
};
- eldiron = { config, pkgs, ... }:
- with import ../libs.nix;
+ eldiron = { config, pkgs, mylibs, ... }:
+ with mylibs;
let
mypkgs = pkgs.callPackage ./packages.nix {
inherit checkEnv fetchedGit fetchedGitPrivate fetchedGithub;
};
in
{
+ _module.args = {
+ mylibs = import ../libs.nix;
+ };
+
+ imports = [
+ ./modules/gitolite.nix
+ ./modules/gitweb.nix
+ ./modules/databases.nix
+ ];
+ services.myGitolite.enable = true;
+ services.myGitweb.enable = true;
+ services.myDatabases.enable = true;
+
nixpkgs.config.packageOverrides = oldpkgs: rec {
- gitolite = oldpkgs.gitolite.overrideAttrs(old: rec {
- name = "gitolite-${version}";
- version = "3.6.10";
- src = pkgs.fetchFromGitHub {
- owner = "sitaramc";
- repo = "gitolite";
- rev = "v${version}";
- sha256 = "0p2697mn6rwm03ndlv7q137zczai82n41aplq1g006ii7f12xy8h";
- };
- });
- gitweb = oldpkgs.gitweb.overrideAttrs(old: {
- installPhase = old.installPhase + ''
- cp -r ${./packages/gitweb} $out/gitweb-theme;
- '';
- });
- postgresql = postgresql111;
- postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
- passthru = old.passthru // { psqlSchema = "11.0"; };
- name = "postgresql-11.1";
- src = pkgs.fetchurl {
- url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
- sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
- };
- });
- mariadb = mariadbPAM;
- mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec {
- cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
- buildInputs = old.buildInputs ++ [ pkgs.pam ];
- });
goaccess = oldpkgs.goaccess.overrideAttrs(old: rec {
name = "goaccess-${version}";
version = "1.3";
networking = {
firewall = {
enable = true;
- allowedTCPPorts = [ 22 80 443 3306 5432 9418 ];
+ allowedTCPPorts = [ 22 80 443 9418 ];
};
};
allowKeysForGroup = true;
extraDomains = {
"db-1.immae.eu" = null;
- "git.immae.eu" = null;
"tools.immae.eu" = null;
"connexionswing.immae.eu" = null;
"sandetludo.immae.eu" = null;
AuthorizedKeysCommandUser nobody
'';
- users.users.wwwrun.extraGroups = [ "gitolite" ];
-
- users.users.gitolite.packages = let
- python-packages = python-packages: with python-packages; [
- simplejson
- urllib3
- ];
- in
- [
- (pkgs.python3.withPackages python-packages)
- ];
- # FIXME: after initial install, need to
- # (1) copy rc file (adjust gitolite_ldap_groups.sh)
- # (2) (mark old readonly and) sync repos except gitolite-admin
- # rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/
- # chown -R gitolite:gitolite /var/lib/gitolite
- # (3) push force the gitolite-admin to new location (from external point)
- # Don't use an existing key, it will take precedence over
- # gitolite-admin
- # (4) su -u gitolite gitolite setup
- services.gitolite = {
- enable = true;
- # FIXME: key from ./ssh
- adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu";
- };
-
services.ympd = mypkgs.ympd.config // { enable = false; };
services.phpfpm = {
mkdir -p /run/redis
chown redis /run/redis
'';
- gitolite =
- assert checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
- let
- gitolite_ldap_groups = wrap {
- name = "gitolite_ldap_groups.sh";
- file = ./packages/gitolite_ldap_groups.sh;
- vars = {
- LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
- };
- paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
- };
- in {
- deps = [ "users" ];
- text = ''
- if [ -d /var/lib/gitolite ]; then
- ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh
- chmod g+rx /var/lib/gitolite
- fi
- if [ -f /var/lib/gitolite/projects.list ]; then
- chmod g+r /var/lib/gitolite/projects.list
- fi
- '';
- };
# FIXME: initial sync
goaccess = ''
mkdir -p /var/lib/goaccess
];
};
- security.pam.services = let
- pam_ldap = pkgs.pam_ldap;
- pam_ldap_mysql = assert checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
- pkgs.writeText "mysql.conf" ''
- host ldap.immae.eu
- base dc=immae,dc=eu
- binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
- bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
- pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
- '';
- in [
- {
- name = "mysql";
- text = ''
- # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
- auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
- account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
- '';
- }
- ];
-
- # FIXME: backup
- # Nextcloud: 14
- services.redis = rec {
- enable = true;
- bind = "127.0.0.1";
- unixSocket = "/run/redis/redis.sock";
- extraConfig = ''
- unixsocketperm 777
- maxclients 1024
- '';
- };
-
- # FIXME: initial sync
- # FIXME: backup
- # FIXME: restart after pam
- # FIXME: pam access doesn’t work (because of php module)
- # FIXME: ssl
- services.mysql = rec {
- enable = true;
- package = pkgs.mariadb;
- };
-
- # FIXME: initial sync
- # FIXME: backup
- # FIXME: ssl
- services.postgresql = rec {
- enable = true;
- package = pkgs.postgresql;
- enableTCPIP = true;
- extraConfig = ''
- max_connections = 100
- wal_level = logical
- shared_buffers = 128MB
- max_wal_size = 1GB
- min_wal_size = 80MB
- log_timezone = 'Europe/Paris'
- datestyle = 'iso, mdy'
- timezone = 'Europe/Paris'
- lc_messages = 'en_US.UTF-8'
- lc_monetary = 'en_US.UTF-8'
- lc_numeric = 'en_US.UTF-8'
- lc_time = 'en_US.UTF-8'
- default_text_search_config = 'pg_catalog.english'
- # ssl = on
- # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
- # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
- '';
- authentication = ''
- local all postgres ident
- local all all md5
- host all all samehost md5
- host all all 178.33.252.96/32 md5
- host all all 188.165.209.148/32 md5
- #host all all all pam
- '';
- };
-
services.cron = {
enable = true;
systemCronJobs = let
--- /dev/null
+{ lib, pkgs, config, mylibs, ... }:
+let
+ cfg = config.services.myDatabases;
+in {
+ options.services.myDatabases = {
+ enable = lib.mkEnableOption "my databases service";
+ postgresql = {
+ enable = lib.mkOption {
+ default = cfg.enable;
+ example = true;
+ description = "Whether to enable postgresql database";
+ type = lib.types.bool;
+ };
+ };
+
+ mariadb = {
+ enable = lib.mkOption {
+ default = cfg.enable;
+ example = true;
+ description = "Whether to enable mariadb database";
+ type = lib.types.bool;
+ };
+ };
+
+ redis = {
+ enable = lib.mkOption {
+ default = cfg.enable;
+ example = true;
+ description = "Whether to enable redis database";
+ type = lib.types.bool;
+ };
+ };
+ };
+
+ config = lib.mkIf cfg.enable {
+ nixpkgs.config.packageOverrides = oldpkgs: rec {
+ postgresql = postgresql111;
+ postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
+ passthru = old.passthru // { psqlSchema = "11.0"; };
+ name = "postgresql-11.1";
+ src = pkgs.fetchurl {
+ url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
+ sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
+ };
+ });
+ mariadb = mariadbPAM;
+ mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec {
+ cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
+ buildInputs = old.buildInputs ++ [ pkgs.pam ];
+ });
+ };
+
+ networking.firewall.allowedTCPPorts = [ 3306 5432 ];
+
+ # FIXME: initial sync
+ # FIXME: backup
+ # FIXME: restart after pam
+ # FIXME: pam access doesn’t work (because of php module)
+ # FIXME: ssl
+ services.mysql = rec {
+ enable = cfg.mariadb.enable;
+ package = pkgs.mariadb;
+ };
+
+ # FIXME: initial sync
+ # FIXME: backup
+ # FIXME: ssl
+ services.postgresql = rec {
+ enable = cfg.postgresql.enable;
+ package = pkgs.postgresql;
+ enableTCPIP = true;
+ extraConfig = ''
+ max_connections = 100
+ wal_level = logical
+ shared_buffers = 128MB
+ max_wal_size = 1GB
+ min_wal_size = 80MB
+ log_timezone = 'Europe/Paris'
+ datestyle = 'iso, mdy'
+ timezone = 'Europe/Paris'
+ lc_messages = 'en_US.UTF-8'
+ lc_monetary = 'en_US.UTF-8'
+ lc_numeric = 'en_US.UTF-8'
+ lc_time = 'en_US.UTF-8'
+ default_text_search_config = 'pg_catalog.english'
+ # ssl = on
+ # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
+ # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
+ '';
+ authentication = ''
+ local all postgres ident
+ local all all md5
+ host all all samehost md5
+ host all all 178.33.252.96/32 md5
+ host all all 188.165.209.148/32 md5
+ #host all all all pam
+ '';
+ };
+
+ security.pam.services = let
+ pam_ldap = pkgs.pam_ldap;
+ pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
+ pkgs.writeText "mysql.conf" ''
+ host ldap.immae.eu
+ base dc=immae,dc=eu
+ binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
+ bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
+ pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
+ '';
+ in [
+ {
+ name = "mysql";
+ text = ''
+ # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
+ auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
+ account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
+ '';
+ }
+ ];
+
+ # FIXME: backup
+ # Nextcloud: 14
+ services.redis = rec {
+ enable = config.services.myDatabases.redis.enable;
+ bind = "127.0.0.1";
+ unixSocket = "/run/redis/redis.sock";
+ extraConfig = ''
+ unixsocketperm 777
+ maxclients 1024
+ '';
+ };
+ };
+}
--- /dev/null
+{ lib, pkgs, config, mylibs, ... }:
+let
+ cfg = config.services.myGitolite;
+in {
+ options.services.myGitolite = {
+ enable = lib.mkEnableOption "my gitolite service";
+ };
+
+ config = lib.mkIf cfg.enable {
+ nixpkgs.config.packageOverrides = oldpkgs: rec {
+ gitolite = oldpkgs.gitolite.overrideAttrs(old: rec {
+ name = "gitolite-${version}";
+ version = "3.6.10";
+ src = pkgs.fetchFromGitHub {
+ owner = "sitaramc";
+ repo = "gitolite";
+ rev = "v${version}";
+ sha256 = "0p2697mn6rwm03ndlv7q137zczai82n41aplq1g006ii7f12xy8h";
+ };
+ });
+ };
+
+ system.activationScripts.gitolite =
+ assert mylibs.checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
+ let
+ gitolite_ldap_groups = mylibs.wrap {
+ name = "gitolite_ldap_groups.sh";
+ file = ./gitolite/gitolite_ldap_groups.sh;
+ vars = {
+ LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
+ };
+ paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
+ };
+ in {
+ deps = [ "users" ];
+ text = ''
+ if [ -d /var/lib/gitolite ]; then
+ ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh
+ chmod g+rx /var/lib/gitolite
+ fi
+ if [ -f /var/lib/gitolite/projects.list ]; then
+ chmod g+r /var/lib/gitolite/projects.list
+ fi
+ '';
+ };
+
+ users.users.wwwrun.extraGroups = [ "gitolite" ];
+
+ users.users.gitolite.packages = let
+ python-packages = python-packages: with python-packages; [
+ simplejson
+ urllib3
+ ];
+ in
+ [
+ (pkgs.python3.withPackages python-packages)
+ ];
+ # FIXME: after initial install, need to
+ # (1) copy rc file (adjust gitolite_ldap_groups.sh)
+ # (2) (mark old readonly and) sync repos except gitolite-admin
+ # rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/
+ # chown -R gitolite:gitolite /var/lib/gitolite
+ # (3) push force the gitolite-admin to new location (from external point)
+ # Don't use an existing key, it will take precedence over
+ # gitolite-admin
+ # (4) su -u gitolite gitolite setup
+ services.gitolite = {
+ enable = true;
+ # FIXME: key from ./ssh
+ adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu";
+ };
+ };
+}
--- /dev/null
+{ lib, pkgs, config, mylibs, ... }:
+let
+ cfg = config.services.myGitweb;
+in {
+ options.services.myGitweb = {
+ enable = lib.mkEnableOption "my gitweb service";
+ };
+
+ config = lib.mkIf cfg.enable {
+ security.acme.certs."eldiron".extraDomains."git.immae.eu" = null;
+
+ nixpkgs.config.packageOverrides = oldpkgs: rec {
+ gitweb = oldpkgs.gitweb.overrideAttrs(old: {
+ installPhase = old.installPhase + ''
+ cp -r ${./gitweb/theme} $out/gitweb-theme;
+ '';
+ });
+ };
+
+ };
+}
projects / perso / Immae / Config / Nix.git / commitdiff
