blob: 8be7368d8d4a2e306f8307c691948062feeb0962 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
{ pkgs, lib, config, name, nodes, ... }:
{
config = {
deployment.secrets."secret_vars.yml" = {
source = builtins.toString ../../nixops/secrets/vars.yml;
destination = config.secrets.secretsVars;
owner.user = "root";
owner.group = "root";
permissions = "0400";
};
networking.extraHosts = builtins.concatStringsSep "\n"
(lib.mapAttrsToList (n: v: "${v.config.hostEnv.ips.main.ip4} ${n}") nodes);
users.extraUsers.root.openssh.authorizedKeys.keys = [ config.myEnv.sshd.rootKeys.nix_repository ];
secrets.deleteSecretsVars = true;
secrets.gpgKeys = [
../../nixops/public_keys/Immae.pub
];
secrets.secretsVars = "/run/keys/vars.yml";
services.openssh.enable = true;
services.duplyBackup.profiles.system = {
rootDir = "/var/lib";
excludeFile = lib.mkAfter ''
+ /var/lib/nixos
+ /var/lib/udev
+ /var/lib/udisks2
+ /var/lib/systemd
+ /var/lib/private/systemd
- /var/lib
'';
};
nixpkgs.overlays = builtins.attrValues (import ../../overlays) ++ [
(self: super: {
postgresql = self.postgresql_pam;
mariadb = self.mariadb_pam;
}) # don’t put them as generic overlay because of home-manager
];
services.journald.extraConfig = ''
#Should be "warning" but disabled for now, it prevents anything from being stored
MaxLevelStore=info
MaxRetentionSec=1year
'';
users.users =
builtins.listToAttrs (map (x: lib.attrsets.nameValuePair x.name ({
isNormalUser = true;
home = "/home/${x.name}";
createHome = true;
linger = true;
} // x)) (config.hostEnv.users pkgs))
// {
root.packages = let
nagios-cli = pkgs.writeScriptBin "nagios-cli" ''
#!${pkgs.stdenv.shell}
sudo -u naemon ${pkgs.nagios-cli}/bin/nagios-cli -c ${./monitoring/nagios-cli.cfg}
'';
in
[
pkgs.telnet
pkgs.htop
pkgs.iftop
pkgs.bind.dnsutils
pkgs.httpie
pkgs.iotop
pkgs.whois
pkgs.ngrep
pkgs.tcpdump
pkgs.tshark
pkgs.tcpflow
# pkgs.mitmproxy # failing
pkgs.nmap
pkgs.p0f
pkgs.socat
pkgs.lsof
pkgs.psmisc
pkgs.openssl
pkgs.wget
pkgs.cnagios
nagios-cli
pkgs.pv
pkgs.smartmontools
];
};
users.mutableUsers = lib.mkDefault false;
environment.etc.cnagios.source = "${pkgs.cnagios}/share/doc/cnagios";
environment.systemPackages = [
pkgs.git
pkgs.vim
pkgs.rsync
pkgs.strace
] ++
(lib.optional (builtins.length (config.hostEnv.users pkgs) > 0) pkgs.home-manager);
systemd.targets.maintenance = {
description = "Maintenance target with only sshd";
after = [ "network-online.target" "sshd.service" ];
requires = [ "network-online.target" "sshd.service" ];
unitConfig.AllowIsolate = "yes";
};
};
}
|
