nixos-config/hosts/france.nix

{ config, pkgs, lib, ... }:

with lib;
let
  hostname = "france.fudo.org";
  mail-hostname = "france.fudo.org";
  host_ipv4 = "208.81.3.117";
  all-hostnames = [];

  acme-private-key = hostname: "/var/lib/acme/${hostname}/key.pem";
  acme-certificate = hostname: "/var/lib/acme/${hostname}/fullchain.pem";
  acme-ca = "/etc/nixos/static/letsencryptauthorityx3.pem";

  fudo-ca = "/etc/nixos/static/fudo_ca.pem";

  minecraft-data-dir = "/srv/minecraft/data";

  system-mail-directory = "/srv/mail";

in {

  boot.loader.grub = {
    enable = true;
    version = 2;
    device = "/dev/sda";
  };

  imports = [
    ../hardware-configuration.nix

    ../defaults.nix

    # These should really both be settings...
    # ../networks/fudo.org.nix
    # ../profiles/server.nix
  ];

  fudo.profile = "server";
  fudo.site = "nutty-club";
  fudo.local-networks = [
    "208.81.1.128/28"
    "208.81.3.112/28"
    "172.17.0.0/16"
    "127.0.0.0/8"
  ];

  environment.systemPackages = with pkgs; [
    docker
    lxd
    multipath-tools
    nix-prefetch-docker
  ];

  fudo.prometheus = {
    enable = true;
    hostname = "metrics.fudo.org";
    service-discovery-dns = {
      node =    [ "node._metrics._tcp.fudo.org" ];
      postfix = [ "postfix._metrics._tcp.fudo.org" ];
      dovecot = [ "dovecot._metrics._tcp.fudo.org" ];
      rspamd =  [ "rspamd._metrics._tcp.fudo.org" ];
    };
    # Connections will be allowed from these networks. No auth is performed--the
    # data is read-only anyway.
    trusted-networks = [
      "208.81.1.128/28"
      "208.81.3.112/28"
      "172.17.0.0/16"
      "127.0.0.0/8"
    ];
  };

  fudo.grafana = {
    enable = true;
    hostname = "monitor.fudo.org";
    smtp-username = "metrics";
    smtp-password-file = "/srv/grafana/secure/smtp.passwd";
    database-password-file = "/srv/grafana/secure/db.passwd";
    admin-password-file = "/srv/grafana/secure/admin.passwd";
    secret-key-file = "/srv/grafana/secure/secret.key";
    prometheus-host = "metrics.fudo.org";
  };

  # So that grafana waits for postgresql
  systemd.services.grafana.requires = [
    "postgresql"
  ];

  fudo.postgresql = {
    enable = true;
    ssl-private-key = (acme-private-key hostname);
    ssl-certificate = (acme-certificate hostname);
    keytab = "/srv/postgres/secure/postgres.keytab";

    # We allow connections from local networks. Auth is still required. Outside
    # of these networks, no access is allowed.
    #
    # TODO: that's probably to strict, allow kerberos connections from anywhere.
    local-networks = [
      "208.81.1.128/28"
      "208.81.3.112/28"
      "192.168.11.1/24"
      "127.0.0.1/8"
      "172.17.0.0/16"
    ];
  };

  # Not all users need access to france; don't allow LDAP-user access.
  fudo.authentication.enable = false;

  # But we DO run an LDAP auth server. Should be better-named.
  fudo.auth = {
    server = {
      enable = true;
      base = "dc=fudo,dc=org";
      organization = "Fudo";
      rootpw-file = "/srv/ldap/secure/root.pw";
      kerberos-host = "france.fudo.org";
      kerberos-keytab = "/srv/ldap/secure/ldap.keytab";

      sslCert = "/srv/ldap/france.fudo.org.pem";
      sslKey = "/srv/ldap/secure/france.fudo.org-key.pem";
      sslCACert = fudo-ca;

      # We're using fudo-generated certs for now, but we should move to ACME
      # once I can figure out how to correctly produce the ca.pem file. Until
      # then, the server will fail to start using these certs. See:
      # https://serverfault.com/a/834565

      # sslCert = (acme-bare-cert hostname);
      # sslKey = (acme-private-key hostname);
      # sslCACert = acme-ca;

      # TODO: loop over v4 and v6 IPs.
      listen-uris = [
        "ldap://${host_ipv4}/"
        "ldaps://${host_ipv4}/"
        "ldap://localhost/"
        "ldaps://localhost/"
        "ldapi:///"
      ];

      users = import ../fudo/users.nix;

      groups = import ../fudo/groups.nix;

      system-users = import ../fudo/system-users.nix;
    };

    # Heimdal Kerberos server
    kdc = {
      enable = true;
      database-path = "/var/heimdal/heimdal";
      realm = "FUDO.ORG";
      mkey-file = "/var/heimdal/m-key";
      acl-file = "/etc/heimdal/kdc.acl";
      bind-addresses = [
        host_ipv4
        "127.0.0.1"
        "127.0.1.1"
      ];
    };
  };

  # TODO: not used yet
  fudo.acme.hostnames = all-hostnames;

  fudo.mail-server = import ../fudo/email.nix { inherit config; } // {
    enableContainer = true;
    debug = true;
    monitoring = true;

    hostname = mail-hostname;

    postfix.ssl-certificate = (acme-certificate mail-hostname);
    postfix.ssl-private-key = (acme-private-key mail-hostname);
    dovecot.ssl-certificate = (acme-certificate mail-hostname);
    dovecot.ssl-private-key = (acme-private-key mail-hostname);

    state-directory = "${system-mail-directory}/var";
    mail-directory = "${system-mail-directory}/mailboxes";

    dovecot.ldap-reader-dn = "cn=user_db_reader,dc=fudo,dc=org";
    dovecot.ldap-reader-passwd = removeSuffix "\n" (readFile /srv/ldap/secure/user_db.passwd);

    # FIXME: use SSL once I can figure out Acme SSL cert CA for LDAP.
    dovecot.ldap-urls = [ "ldap://france.fudo.org" ];

    clamav.enable = true;

    dkim.signing = true;
  };

  networking = {
    hostName = hostname;

    dhcpcd.enable = false;
    useDHCP = false;
    interfaces.enp4s0f0.useDHCP = true;
    interfaces.enp4s0f1.useDHCP = true;

    # TODO: fix IPv6
    enableIPv6 = false;

    # Create a bridge for VMs to use
    macvlans = {
      extif0 = {
        interface = "enp4s0f0";
        mode = "bridge";
      };
      intif0 = {
        interface = "enp4s0f1";
        mode = "bridge";
      };
    };

    interfaces = {
      extif0 = {
        # result of: echo $FQDN-extif|md5sum|sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/'
        macAddress = "02:d4:e8:3b:10:2f";
        ipv4.addresses = [
          {
            address = host_ipv4;
            prefixLength = 28;
          }
        ];
      };
      intif0 = {
        # result of: echo $FQDN-intif|md5sum|sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/'
        macAddress = "02:ba:ba:e9:08:21";
        ipv4.addresses = [
          {
            address = "192.168.11.1";
            prefixLength = 24;
          }
        ];
      };
    };
  };

  hardware.bluetooth.enable = false;

  virtualisation = {
    lxd = {
      enable = true;
    };

    docker = {
      enable = true;
      enableOnBoot = true;

      autoPrune = {
        enable = true;
      };
    };
  };

  fileSystems = {
    "/srv/archiva" = {
      fsType = "btrfs";
      options = ["subvol=archiva"];
      label = "pool0";
    };
    "/srv/grafana" = {
      fsType = "btrfs";
      options = ["subvol=grafana"];
      label = "pool0";
    };
    "${system-mail-directory}" = {
      fsType = "btrfs";
      options = ["subvol=mail"];
      label = "pool0";
    };
    "/srv/gitlab" = {
      fsType = "btrfs";
      options = ["subvol=gitlab"];
      label = "pool0";
    };
  };

  ##
  # Archiva
  ##

  users.extraUsers = {
    archiva = {
      isNormalUser = false;
      group = "nogroup";
      uid = 1000;
    };
  };

  docker-containers = {
    archiva = {
      image = "xetusoss/archiva";
      ports = ["127.0.0.1:8091:8080"];
      volumes = [
        "/srv/archiva:/archiva-data"
      ];
      environment = {
        # Not directly connected to the world anyway
        SSL_ENABLED = "false";
      };
      # Ugly as shit: name-to-uid lookup fails.
      #user = "1000";
      user = toString config.users.users.archiva.uid;
    };
  };

  ###
  # Minecraft
  ###

  fudo.minecraft-server = {
    enable = true;
    package = pkgs.minecraft-server_1_15_1;
    data-dir = minecraft-data-dir;
    world-name = "selbyland";
    motd = "Welcome to the Selby Minecraft server.";
  };
}