Move some elements to separate modules

9 files changed, 243 insertions, 160 deletions

diff --git a/virtual/eldiron.nix b/virtual/eldiron.nix
index 7dbca92..acd2cbd 100644
--- a/virtual/eldiron.nix
+++ b/virtual/eldiron.nix
@@ -4,44 +4,28 @@
     enableRollback = true;
   };
 
-  eldiron = { config, pkgs, ... }:
-    with import ../libs.nix;
+  eldiron = { config, pkgs, mylibs, ... }:
+    with mylibs;
     let
         mypkgs = pkgs.callPackage ./packages.nix {
           inherit checkEnv fetchedGit fetchedGitPrivate fetchedGithub;
         };
     in
   {
+    _module.args = {
+      mylibs = import ../libs.nix;
+    };
+
+    imports = [
+      ./modules/gitolite.nix
+      ./modules/gitweb.nix
+      ./modules/databases.nix
+    ];
+    services.myGitolite.enable = true;
+    services.myGitweb.enable = true;
+    services.myDatabases.enable = true;
+
     nixpkgs.config.packageOverrides = oldpkgs: rec {
-      gitolite = oldpkgs.gitolite.overrideAttrs(old: rec {
-        name = "gitolite-${version}";
-        version = "3.6.10";
-        src = pkgs.fetchFromGitHub {
-          owner = "sitaramc";
-          repo = "gitolite";
-          rev = "v${version}";
-          sha256 = "0p2697mn6rwm03ndlv7q137zczai82n41aplq1g006ii7f12xy8h";
-        };
-      });
-      gitweb = oldpkgs.gitweb.overrideAttrs(old: {
-        installPhase = old.installPhase + ''
-          cp -r ${./packages/gitweb} $out/gitweb-theme;
-          '';
-      });
-      postgresql = postgresql111;
-      postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
-        passthru = old.passthru // { psqlSchema = "11.0"; };
-        name = "postgresql-11.1";
-        src = pkgs.fetchurl {
-          url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
-          sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
-        };
-      });
-      mariadb = mariadbPAM;
-      mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec {
-        cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
-        buildInputs = old.buildInputs ++ [ pkgs.pam ];
-      });
       goaccess = oldpkgs.goaccess.overrideAttrs(old: rec {
         name = "goaccess-${version}";
         version = "1.3";
@@ -57,7 +41,7 @@
     networking = {
       firewall = {
         enable = true;
-        allowedTCPPorts = [ 22 80 443 3306 5432 9418 ];
+        allowedTCPPorts = [ 22 80 443 9418 ];
       };
     };
 
@@ -116,7 +100,6 @@
         allowKeysForGroup = true;
         extraDomains = {
           "db-1.immae.eu" = null;
-          "git.immae.eu" = null;
           "tools.immae.eu" = null;
           "connexionswing.immae.eu" = null;
           "sandetludo.immae.eu" = null;
@@ -197,32 +180,6 @@
       AuthorizedKeysCommandUser nobody
       '';
 
-    users.users.wwwrun.extraGroups = [ "gitolite" ];
-
-    users.users.gitolite.packages = let
-      python-packages = python-packages: with python-packages; [
-        simplejson
-        urllib3
-      ];
-    in
-      [
-        (pkgs.python3.withPackages python-packages)
-      ];
-    # FIXME: after initial install, need to
-    # (1) copy rc file (adjust gitolite_ldap_groups.sh)
-    # (2) (mark old readonly and) sync repos except gitolite-admin
-    #     rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/
-    #     chown -R gitolite:gitolite /var/lib/gitolite
-    # (3) push force the gitolite-admin to new location (from external point)
-    #     Don't use an existing key, it will take precedence over
-    #     gitolite-admin
-    # (4) su -u gitolite gitolite setup
-    services.gitolite = {
-      enable = true;
-      # FIXME: key from ./ssh
-      adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu";
-    };
-
     services.ympd = mypkgs.ympd.config // { enable = false; };
 
     services.phpfpm = {
@@ -288,29 +245,6 @@
         mkdir -p /run/redis
         chown redis /run/redis
         '';
-      gitolite =
-        assert checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
-        let
-        gitolite_ldap_groups = wrap {
-          name = "gitolite_ldap_groups.sh";
-          file = ./packages/gitolite_ldap_groups.sh;
-          vars = {
-            LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
-          };
-          paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
-        };
-      in {
-        deps = [ "users" ];
-        text = ''
-          if [ -d /var/lib/gitolite ]; then
-            ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh
-            chmod g+rx /var/lib/gitolite
-          fi
-          if [ -f /var/lib/gitolite/projects.list ]; then
-            chmod g+r /var/lib/gitolite/projects.list
-          fi
-        '';
-      };
       # FIXME: initial sync
       goaccess = ''
         mkdir -p /var/lib/goaccess
@@ -590,84 +524,6 @@
       ];
     };
 
-    security.pam.services = let
-      pam_ldap = pkgs.pam_ldap;
-      pam_ldap_mysql = assert checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
-              pkgs.writeText "mysql.conf" ''
-        host ldap.immae.eu
-        base dc=immae,dc=eu
-        binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
-        bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
-        pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
-        '';
-    in [
-      {
-        name = "mysql";
-        text = ''
-          # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
-          auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
-          account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
-          '';
-      }
-    ];
-
-    # FIXME: backup
-    # Nextcloud: 14
-    services.redis = rec {
-      enable = true;
-      bind = "127.0.0.1";
-      unixSocket = "/run/redis/redis.sock";
-      extraConfig = ''
-        unixsocketperm 777
-        maxclients 1024
-        '';
-    };
-
-    # FIXME: initial sync
-    # FIXME: backup
-    # FIXME: restart after pam
-    # FIXME: pam access doesn’t work (because of php module)
-    # FIXME: ssl
-    services.mysql = rec {
-      enable = true;
-      package = pkgs.mariadb;
-    };
-
-    # FIXME: initial sync
-    # FIXME: backup
-    # FIXME: ssl
-    services.postgresql = rec {
-      enable = true;
-      package = pkgs.postgresql;
-      enableTCPIP = true;
-      extraConfig = ''
-        max_connections = 100
-        wal_level = logical
-        shared_buffers = 128MB
-        max_wal_size = 1GB
-        min_wal_size = 80MB
-        log_timezone = 'Europe/Paris'
-        datestyle = 'iso, mdy'
-        timezone = 'Europe/Paris'
-        lc_messages = 'en_US.UTF-8'
-        lc_monetary = 'en_US.UTF-8'
-        lc_numeric = 'en_US.UTF-8'
-        lc_time = 'en_US.UTF-8'
-        default_text_search_config = 'pg_catalog.english'
-        # ssl = on
-        # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
-        # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
-        '';
-      authentication = ''
-        local   all     postgres                                ident
-        local   all     all                                     md5
-        host    all     all             samehost                md5
-        host    all     all             178.33.252.96/32        md5
-        host    all     all             188.165.209.148/32      md5
-        #host   all     all             all                     pam
-      '';
-    };
-
     services.cron = {
       enable = true;
       systemCronJobs = let
diff --git a/virtual/modules/databases.nix b/virtual/modules/databases.nix
new file mode 100644
index 0000000..25bd645
--- /dev/null
+++ b/virtual/modules/databases.nix
@@ -0,0 +1,133 @@
+{ lib, pkgs, config, mylibs, ... }:
+let
+    cfg = config.services.myDatabases;
+in {
+  options.services.myDatabases = {
+    enable = lib.mkEnableOption "my databases service";
+    postgresql = {
+      enable = lib.mkOption {
+        default = cfg.enable;
+        example = true;
+        description = "Whether to enable postgresql database";
+        type = lib.types.bool;
+      };
+    };
+
+    mariadb = {
+      enable = lib.mkOption {
+        default = cfg.enable;
+        example = true;
+        description = "Whether to enable mariadb database";
+        type = lib.types.bool;
+      };
+    };
+
+    redis = {
+      enable = lib.mkOption {
+        default = cfg.enable;
+        example = true;
+        description = "Whether to enable redis database";
+        type = lib.types.bool;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    nixpkgs.config.packageOverrides = oldpkgs: rec {
+      postgresql = postgresql111;
+      postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
+        passthru = old.passthru // { psqlSchema = "11.0"; };
+        name = "postgresql-11.1";
+        src = pkgs.fetchurl {
+          url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
+          sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
+        };
+      });
+      mariadb = mariadbPAM;
+      mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec {
+        cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
+        buildInputs = old.buildInputs ++ [ pkgs.pam ];
+      });
+    };
+
+    networking.firewall.allowedTCPPorts = [ 3306 5432 ];
+
+    # FIXME: initial sync
+    # FIXME: backup
+    # FIXME: restart after pam
+    # FIXME: pam access doesn’t work (because of php module)
+    # FIXME: ssl
+    services.mysql = rec {
+      enable = cfg.mariadb.enable;
+      package = pkgs.mariadb;
+    };
+
+    # FIXME: initial sync
+    # FIXME: backup
+    # FIXME: ssl
+    services.postgresql = rec {
+      enable = cfg.postgresql.enable;
+      package = pkgs.postgresql;
+      enableTCPIP = true;
+      extraConfig = ''
+        max_connections = 100
+        wal_level = logical
+        shared_buffers = 128MB
+        max_wal_size = 1GB
+        min_wal_size = 80MB
+        log_timezone = 'Europe/Paris'
+        datestyle = 'iso, mdy'
+        timezone = 'Europe/Paris'
+        lc_messages = 'en_US.UTF-8'
+        lc_monetary = 'en_US.UTF-8'
+        lc_numeric = 'en_US.UTF-8'
+        lc_time = 'en_US.UTF-8'
+        default_text_search_config = 'pg_catalog.english'
+        # ssl = on
+        # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
+        # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
+        '';
+      authentication = ''
+        local   all     postgres                                ident
+        local   all     all                                     md5
+        host    all     all             samehost                md5
+        host    all     all             178.33.252.96/32        md5
+        host    all     all             188.165.209.148/32      md5
+        #host   all     all             all                     pam
+      '';
+    };
+
+    security.pam.services = let
+      pam_ldap = pkgs.pam_ldap;
+      pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
+              pkgs.writeText "mysql.conf" ''
+        host ldap.immae.eu
+        base dc=immae,dc=eu
+        binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
+        bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
+        pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
+        '';
+    in [
+      {
+        name = "mysql";
+        text = ''
+          # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
+          auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
+          account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
+          '';
+      }
+    ];
+
+    # FIXME: backup
+    # Nextcloud: 14
+    services.redis = rec {
+      enable = config.services.myDatabases.redis.enable;
+      bind = "127.0.0.1";
+      unixSocket = "/run/redis/redis.sock";
+      extraConfig = ''
+        unixsocketperm 777
+        maxclients 1024
+        '';
+    };
+  };
+}
diff --git a/virtual/modules/gitolite.nix b/virtual/modules/gitolite.nix
new file mode 100644
index 0000000..85c7be1
--- /dev/null
+++ b/virtual/modules/gitolite.nix
@@ -0,0 +1,73 @@
+{ lib, pkgs, config, mylibs, ... }:
+let
+    cfg = config.services.myGitolite;
+in {
+  options.services.myGitolite = {
+    enable = lib.mkEnableOption "my gitolite service";
+  };
+
+  config = lib.mkIf cfg.enable {
+    nixpkgs.config.packageOverrides = oldpkgs: rec {
+      gitolite = oldpkgs.gitolite.overrideAttrs(old: rec {
+        name = "gitolite-${version}";
+        version = "3.6.10";
+        src = pkgs.fetchFromGitHub {
+          owner = "sitaramc";
+          repo = "gitolite";
+          rev = "v${version}";
+          sha256 = "0p2697mn6rwm03ndlv7q137zczai82n41aplq1g006ii7f12xy8h";
+        };
+      });
+    };
+
+    system.activationScripts.gitolite =
+      assert mylibs.checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
+      let
+      gitolite_ldap_groups = mylibs.wrap {
+        name = "gitolite_ldap_groups.sh";
+        file = ./gitolite/gitolite_ldap_groups.sh;
+        vars = {
+          LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
+        };
+        paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
+      };
+    in {
+      deps = [ "users" ];
+      text = ''
+        if [ -d /var/lib/gitolite ]; then
+          ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh
+          chmod g+rx /var/lib/gitolite
+        fi
+        if [ -f /var/lib/gitolite/projects.list ]; then
+          chmod g+r /var/lib/gitolite/projects.list
+        fi
+      '';
+    };
+
+    users.users.wwwrun.extraGroups = [ "gitolite" ];
+
+    users.users.gitolite.packages = let
+      python-packages = python-packages: with python-packages; [
+        simplejson
+        urllib3
+      ];
+    in
+      [
+        (pkgs.python3.withPackages python-packages)
+      ];
+    # FIXME: after initial install, need to
+    # (1) copy rc file (adjust gitolite_ldap_groups.sh)
+    # (2) (mark old readonly and) sync repos except gitolite-admin
+    #     rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/
+    #     chown -R gitolite:gitolite /var/lib/gitolite
+    # (3) push force the gitolite-admin to new location (from external point)
+    #     Don't use an existing key, it will take precedence over
+    #     gitolite-admin
+    # (4) su -u gitolite gitolite setup
+    services.gitolite = {
+      enable = true;
+      # FIXME: key from ./ssh
+      adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu";
+    };
+  };
+}
diff --git a/virtual/packages/gitolite_ldap_groups.sh b/virtual/modules/gitolite/gitolite_ldap_groups.sh
index 5f7ef6d..5f7ef6d 100755
--- a/virtual/packages/gitolite_ldap_groups.sh
+++ b/virtual/modules/gitolite/gitolite_ldap_groups.sh
diff --git a/virtual/modules/gitweb.nix b/virtual/modules/gitweb.nix
new file mode 100644
index 0000000..f3ef1bd
--- /dev/null
+++ b/virtual/modules/gitweb.nix
@@ -0,0 +1,21 @@
+{ lib, pkgs, config, mylibs, ... }:
+let
+    cfg = config.services.myGitweb;
+in {
+  options.services.myGitweb = {
+    enable = lib.mkEnableOption "my gitweb service";
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.acme.certs."eldiron".extraDomains."git.immae.eu" = null;
+
+    nixpkgs.config.packageOverrides = oldpkgs: rec {
+      gitweb = oldpkgs.gitweb.overrideAttrs(old: {
+        installPhase = old.installPhase + ''
+          cp -r ${./gitweb/theme} $out/gitweb-theme;
+          '';
+      });
+    };
+
+  };
+}
diff --git a/virtual/packages/gitweb/git-favicon.png b/virtual/modules/gitweb/theme/git-favicon.png
index 4fa44bb..4fa44bb 100644
--- a/virtual/packages/gitweb/git-favicon.png
+++ b/virtual/modules/gitweb/theme/git-favicon.png
diff --git a/virtual/packages/gitweb/git-logo.png b/virtual/modules/gitweb/theme/git-logo.png
index fdaf7b7..fdaf7b7 100644
--- a/virtual/packages/gitweb/git-logo.png
+++ b/virtual/modules/gitweb/theme/git-logo.png
diff --git a/virtual/packages/gitweb/gitweb.css b/virtual/modules/gitweb/theme/gitweb.css
index 83e0742..83e0742 100644
--- a/virtual/packages/gitweb/gitweb.css
+++ b/virtual/modules/gitweb/theme/gitweb.css
diff --git a/virtual/packages/gitweb/gitweb.js b/virtual/modules/gitweb/theme/gitweb.js
index 72f3cfa..72f3cfa 100644
--- a/virtual/packages/gitweb/gitweb.js
+++ b/virtual/modules/gitweb/theme/gitweb.js