nixos-config/config/host-config/procul.nix

{ config, lib, pkgs, ... }:

with lib;
let
  hostname = "procul";

  host-ipv4 = "172.86.179.18";
  git-ipv4 = "172.86.179.19";
  domain-name = config.fudo.hosts.${hostname}.domain;
  domain = config.fudo.domains.${domain-name};
  site-name = config.fudo.hosts.${hostname}.site;
  site = config.fudo.sites.${site-name};
  host-fqdn = "${hostname}.${domain-name}";

  local-networks =
    domain.local-networks ++ site.local-networks;

  local-packages = with pkgs; [ ldns.examples ];

  secrets = config.fudo.secrets.host-secrets.procul;

  passwd = pkgs.lib.fudo.passwd;

in {
  networking = {
    dhcpcd.enable = false;
    useDHCP = false;

    enableIPv6 = true;

    # FIXME: this isn't the right place
    search = [ domain-name ];
    nameservers = [ "127.0.0.1" ];
    defaultGateway = site.gateway-v4;

    interfaces = {
      extif0 = {
        ipv4.addresses = [
          {
            address = host-ipv4;
            prefixLength = 29;
          }
          {
            address = git-ipv4;
            prefixLength = 29;
          }
        ];
      };
    };
  };

  environment.systemPackages = local-packages;

  networking.firewall.allowedTCPPorts = [ 80 443 ];

  users = {
    users = {
      gituser = {
        isSystemUser = true;
        group = "nogroup";
      };
    };
    groups = { acme = { members = [ "nginx" ]; }; };
  };

  informis.cl-gemini = {
    enable = true;

    hostname = "gemini.informis.land";
    server-ip = host-ipv4;
    document-root = "/srv/gemini/root";
    textfiles-archive = "${pkgs.textfiles}";
    slynk-port = 4005;

    feeds = {
      viator = {
        title = "viator's phlog";
        path = "/home/viator/gemini-public/feed/";
        url = "gemini://informis.land/user/viator/feed/";
      };
    };
  };

  fudo = {
    hosts.procul.external-interfaces = [ "extif0" ];

    acme.host-domains.${hostname}.${host-fqdn}.local-copies = {
      postgresql = {
        user = postgresql-user;
        dependent-services = [ "postgresql.service" ];
        part-of = [ config.fudo.postgresql.systemd-target ];
      };
    };

    secrets.host-secrets.procul = let
      files = config.fudo.secrets.files;
    in {
      postgres-keytab = {
        source-file = files.service-keytabs.procul.postgres;
        target-file = "/srv/postgres/secure/postgres.keytab";
        user = "root";
      };

      gitea-database-password = {
        source-file = files.service-passwords.procul.gitea-database;
        target-file = "/srv/gitea/secure/database.passwd";
        user = config.fudo.git.user;
      };

      heimdal-master-key = {
        source-file = files.realm-master-keys."INFORMIS.LAND";
        target-file = "/run/heimdal/master-key";
        user = config.fudo.auth.kdc.user;
      };
    };

    client.dns = {
      ipv4 = true;
      ipv6 = true;
      user = "fudo-client";
      external-interface = "extif0";
    };

    auth.kdc.master-key-file = secrets.heimdal-master-key.target-file;

    secure-dns-proxy = {
      enable = true;
      upstream-dns =
        [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
      bootstrap-dns = "1.1.1.1";
      listen-ips = [ "127.0.0.1" ];
      listen-port = 53;
      allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
    };

    mail-server = {
      enable = true;
      debug = true;

      domain = domain-name;
      mail-hostname = "${host-fqdn}";
      monitoring = false;
      mail-user = "mailuser";
      mail-user-id = 525;
      mail-group = "mailgroup";
      clamav.enable = true;
      dkim.signing = true;

      dovecot = {
        ssl-certificate = acme-certificate "imap.${domain-name}";
        ssl-private-key = acme-private-key "imap.${domain-name}";
      };

      postfix = {
        ssl-certificate = acme-certificate "smtp.${domain-name}";
        ssl-private-key = acme-private-key "smtp.${domain-name}";
      };

      # This should NOT include the primary domain
      local-domains = [ host-fqdn "smtp.${domain-name}" ];

      mail-directory = "/srv/mailserver/mail";
      state-directory = "/srv/mailserver/state";

      trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];

      alias-users = {
        root = [ "niten" ];
        postmaster = [ "niten" ];
        hostmaster = [ "niten" ];
        webmaster = [ "niten" ];
        system = [ "niten" ];
        admin = [ "niten" ];
        dmarc-report = [ "niten" ];
      };
    };

    postgresql = let
      cert-copy = config.fudo.acme.host-domains.${hostname}.${host-fqdn}.local-copies.postgresql;
    in {
      enable = true;
      ssl-certificate = cert-copy.full-certificate;
      ssl-private-key = cert-copy.private-key;
      keytab = secrets.postgres-keytab.target-file;
      local-networks = local-networks;

      users = {
        gituser = {
          password-file =
            secrets.gitea-database-password.target-file;
          databases = {
            git = {
              access = "CONNECT";
              entity-access = {
                "ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
                "ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
              };
            };
          };
        };
      };

      databases = { git = { users = [ "niten" ]; }; };
    };

    git = {
      enable = true;
      hostname = "git.informis.land";
      site-name = "informis git";
      user = "gituser";
      repository-dir = "/srv/git/repo";
      state-dir = "/srv/git/state";
      database = {
        user = "gituser";
        password-file =
          secrets.gitea-database-password.target-file;
        hostname = "127.0.0.1";
        name = "git";
      };
      ssh = {
        listen-ip = host-ipv4;
        listen-port = 2222;
      };
    };

    acme = {
      enable = true;
      admin-address = "admin@${domain-name}";
      hostnames = [
        "informis.land"
        "imap.informis.land"
        "smtp.informis.land"
        "gemini.informis.land"
      ];
    };
  };
}