blob: 1f226c0bdff723c766a5bc1d732c1c12ded00ee7 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
{ config, pkgs, resources, name, ... }:
{
deployment = {
targetUser = "root";
targetHost = config.hostEnv.ips.main.ip4;
substituteOnDestination = true;
};
# ssh-keyscan backup-2 | nix-shell -p ssh-to-age --run ssh-to-age
secrets.ageKeys = [ "age1kk3nr27qu42j28mcfdag5lhq0zu2pky7gfanvne8l4z2ctevjpgskmw0sr" ];
boot.kernelPackages = pkgs.linuxPackages_latest;
myEnv = import ../../../nixops/secrets/environment.nix;
imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ] ++ builtins.attrValues (import ../..);
fileSystems = {
"/backup2" = {
fsType = "ext4";
device = "UUID=b9425333-f567-435d-94d8-b26c22d93426";
};
"/" = { device = "/dev/sda1"; fsType = "ext4"; };
};
networking = {
firewall.enable = true;
interfaces."ens3".ipv4.addresses = pkgs.lib.attrsets.mapAttrsToList
(n: ips: { address = ips.ip4; prefixLength = 32; })
(pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips);
interfaces."ens3".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
(n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
config.hostEnv.ips);
defaultGateway6 = { address = "fe80::1"; interface = "ens3"; };
};
boot.loader.grub.device = "nodev";
myServices.certificates.enable = true;
security.acme.certs."${name}" = {
user = config.services.nginx.user;
group = config.services.nginx.group;
};
services.nginx = {
enable = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedProxySettings = true;
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
services.cron = {
mailto = "cron@immae.eu";
enable = true;
};
services.rsyncBackup = {
mountpoint = "/backup2";
profiles = config.myEnv.rsync_backup.profiles;
ssh_key_public = config.myEnv.rsync_backup.ssh_key.public;
ssh_key_private = config.myEnv.rsync_backup.ssh_key.private;
};
myServices.mailRelay.enable = true;
myServices.mailBackup.enable = true;
myServices.monitoring.enable = true;
myServices.databasesReplication = {
postgresql = {
enable = true;
base = "/backup2";
mainPackage = pkgs.postgresql;
hosts = {
eldiron = {
slot = "backup_2";
connection = "postgresql://backup-2:${config.hostEnv.ldap.password}@eldiron.immae.eu";
package = pkgs.postgresql;
};
};
};
mariadb = {
enable = true;
base = "/backup2";
hosts = {
eldiron = {
serverId = 2;
# mysql resolves "backup-2" host and checks the ip, but uses /etc/hosts which only contains ip4
host = config.myEnv.servers.eldiron.ips.main.ip4;
port = "3306";
user = "backup-2";
password = config.hostEnv.ldap.password;
dumpUser = "root";
dumpPassword = config.myEnv.databases.mysql.systemUsers.root;
};
};
};
redis = {
enable = true;
base = "/backup2";
hosts = {
eldiron = {
host = "127.0.0.1";
port = "16379";
};
};
};
openldap = {
enable = true;
base = "/backup2";
hosts = {
eldiron = {
url = "ldaps://${config.myEnv.ldap.host}:636";
dn = config.myEnv.ldap.replication_dn;
password = config.myEnv.ldap.replication_pw;
base = config.myEnv.ldap.base;
};
};
};
};
# This value determines the NixOS release with which your system is
# to be compatible, in order to avoid breaking some software such as
# database servers. You should change this only after NixOS release
# notes say you should.
# https://nixos.org/nixos/manual/release-notes.html
system.stateVersion = "20.03"; # Did you read the comment?
}
|
