blob: b54702e68e71d2460c35174a97150aad1aae0083 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
{
network = {
description = "Immae's network";
enableRollback = true;
};
eldiron = { config, pkgs, mylibs, myconfig, ... }:
with mylibs;
{
_module.args = {
mylibs = import ../libs.nix;
myconfig = {
env = import ./environment.nix;
ips = {
main = "176.9.151.89";
production = "176.9.151.154";
integration = "176.9.151.155";
};
};
};
imports = [
./modules/certificates.nix
./modules/gitolite
./modules/databases
./modules/websites
./modules/mail
];
services.myGitolite.enable = true;
services.myDatabases.enable = true;
services.myWebsites.production.enable = true;
services.myWebsites.integration.enable = true;
services.myWebsites.tools.enable = true;
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 22 ];
};
};
deployment = {
targetEnv = "hetzner";
hetzner = {
robotUser = myconfig.env.hetzner.user;
robotPass = myconfig.env.hetzner.pass;
mainIPv4 = myconfig.ips.main;
partitions = ''
clearpart --all --initlabel --drives=sda,sdb
part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
part raid.1 --grow --ondisk=sda
part raid.2 --grow --ondisk=sdb
raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
'';
};
};
environment.systemPackages = [
pkgs.telnet
pkgs.htop
pkgs.vim
];
services.openssh.extraConfig = ''
AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys
AuthorizedKeysCommandUser nobody
'';
environment.etc."ssh/ldap_authorized_keys" = let
ldap_authorized_keys =
wrap {
name = "ldap_authorized_keys";
file = ./ldap_authorized_keys.sh;
vars = {
LDAP_PASS = myconfig.env.sshd.ldap.password;
GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell";
ECHO = "${pkgs.coreutils}/bin/echo";
};
paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
};
in {
enable = true;
mode = "0755";
user = "root";
source = ldap_authorized_keys;
};
services.cron = {
enable = true;
systemCronJobs = [
''
# The star after /var/lib/* avoids deleting all folders in case of problem
0 3,9,15,21 * * * root rsync -e "ssh -i /root/.ssh/id_charon_vpn" -aAXvz --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu:
''
];
};
};
}
|
