blob: cefef7048977cc70b0ecea12710368b776288751 (
plain) (
tree)
|
|
{
network = {
description = "Immae's network";
enableRollback = true;
};
# Full backup:
# The star after /var/lib/* avoids deleting all folders in case of problem
# rsync -e "ssh -i /root/.ssh/id_charon_vpn" -aAXvz --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu:
eldiron = { config, pkgs, mylibs, myconfig, ... }:
with mylibs;
let
mypkgs = pkgs.callPackage ./packages.nix {
inherit checkEnv fetchedGit fetchedGithub;
};
in
{
_module.args = {
mylibs = import ../libs.nix;
myconfig = {
ips = {
main = "176.9.151.89";
production = "176.9.151.154";
integration = "176.9.151.155";
};
};
};
imports = [
./modules/certificates.nix
./modules/gitolite.nix
./modules/gitweb
./modules/databases.nix
./modules/websites
./modules/websites/phpfpm
];
services.myGitolite.enable = true;
services.myGitweb.enable = true;
services.myDatabases.enable = true;
services.myWebsites.production.enable = true;
services.myWebsites.integration.enable = true;
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 22 9418 ];
};
};
deployment = {
targetEnv = "hetzner";
hetzner = {
#robotUser = "defined in HETZNER_ROBOT_USER";
#robotPass = "defined in HETZNER_ROBOT_PASS";
mainIPv4 = myconfig.ips.main;
partitions = ''
clearpart --all --initlabel --drives=sda,sdb
part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
part raid.1 --grow --ondisk=sda
part raid.2 --grow --ondisk=sdb
raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
'';
};
};
environment.systemPackages = let
# FIXME: move it to nextcloud
occ = pkgs.writeScriptBin "nextcloud-occ" ''
#! ${pkgs.stdenv.shell}
cd ${mypkgs.nextcloud.webRoot}
NEXTCLOUD_CONFIG_DIR="${mypkgs.nextcloud.webRoot}/config" \
exec \
${pkgs.php}/bin/php \
-c ${pkgs.php}/etc/php.ini \
occ $*
'';
in [
pkgs.telnet
pkgs.htop
pkgs.vim
occ
];
security.acme.certs."eldiron".extraDomains = {
"db-1.immae.eu" = null;
"tools.immae.eu" = null;
"cloud.immae.eu" = null;
"dav.immae.eu" = null;
};
services.openssh.extraConfig = ''
AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys
AuthorizedKeysCommandUser nobody
'';
services.ympd = mypkgs.ympd.config // { enable = false; };
services.myPhpfpm = {
phpPackage = pkgs.php;
phpOptions = ''
session.save_path = "/var/lib/php/sessions"
session.gc_maxlifetime = 60*60*24*15
session.cache_expire = 60*24*30
'';
extraConfig = ''
log_level = notice
'';
poolPhpConfigs = {
nextcloud = mypkgs.nextcloud.phpFpm.phpConfig;
};
poolConfigs = {
adminer = mypkgs.adminer.phpFpm.pool;
nextcloud = mypkgs.nextcloud.phpFpm.pool;
mantisbt = mypkgs.mantisbt.phpFpm.pool;
ttrss = mypkgs.ttrss.phpFpm.pool;
roundcubemail = mypkgs.roundcubemail.phpFpm.pool;
davical = mypkgs.davical.phpFpm.pool;
};
};
system.activationScripts = {
nextcloud = mypkgs.nextcloud.activationScript;
ttrss = mypkgs.ttrss.activationScript;
roundcubemail = mypkgs.roundcubemail.activationScript;
httpd = ''
install -d -m 0755 /var/lib/acme/acme-challenge
install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
'';
};
environment.etc."ssh/ldap_authorized_keys" = let
ldap_authorized_keys =
assert checkEnv "NIXOPS_SSHD_LDAP_PASSWORD";
wrap {
name = "ldap_authorized_keys";
file = ./ldap_authorized_keys.sh;
vars = {
LDAP_PASS = builtins.getEnv "NIXOPS_SSHD_LDAP_PASSWORD";
GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell";
ECHO = "${pkgs.coreutils}/bin/echo";
};
paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
};
in {
enable = true;
mode = "0755";
user = "root";
source = ldap_authorized_keys;
};
systemd.services.tt-rss = {
description = "Tiny Tiny RSS feeds update daemon";
serviceConfig = {
User = "wwwrun";
ExecStart = "${pkgs.php}/bin/php ${mypkgs.ttrss.webRoot}/update.php --daemon";
StandardOutput = "syslog";
StandardError = "syslog";
PermissionsStartOnly = true;
};
wantedBy = [ "multi-user.target" ];
requires = ["postgresql.service"];
after = ["network.target" "postgresql.service"];
};
};
}
|