nixos-config/config/host-config/procul.nix

{ config, lib, pkgs, ... }:

with lib;
let
  hostname = "procul";
  host-ipv4 = "172.86.179.18";
  domain = config.fudo.hosts.${hostname}.domain;
  site = config.fudo.hosts.${hostname}.site;
  host-fqdn = "${hostname}.${domain}";

  local-networks = config.fudo.domains.${domain}.local-networks
    ++ config.fudo.sites.${site}.local-networks;

  acme-private-key = hostname: "/var/lib/acme/${hostname}/key.pem";
  acme-certificate = hostname: "/var/lib/acme/${hostname}/fullchain.pem";
  acme-ca = "/etc/nixos/static/letsencryptauthorityx3.pem";

  local-packages = with pkgs; [ ldns.examples ];

in {
  networking = {
    dhcpcd.enable = false;
    useDHCP = false;

    enableIPv6 = true;

    # FIXME: this isn't the right place
    search = [ domain ];
    nameservers = [ "127.0.0.1" ];
    defaultGateway = "172.86.179.17";

    interfaces = {
      extif0 = {
        ipv4.addresses = [{
          address = host-ipv4;
          prefixLength = 29;
        }];
      };
    };
  };

  environment.systemPackages = local-packages;

  networking.firewall.allowedTCPPorts = [ 80 443 ];

  users.users = {
    gituser = {
      isSystemUser = true;
      group = "nogroup";
    };
  };

  informis.cl-gemini = {
    enable = true;

    hostname = "gemini.informis.land";
    server-ip = host-ipv4;
    document-root = "/srv/gemini/root";
    textfiles-archive = "${pkgs.textfiles}";
    slynk-port = 4005;

    feeds = {
      viator = {
        title = "viator's phlog";
        path = "/home/viator/gemini-public/feed/";
        url = "gemini://informis.land/user/viator/feed/";
      };
    };
  };

  fudo = {
    hosts.procul.external-interfaces = [ "extif0" ];

    secrets.procul = {
      backplane-client-passwd = {
        source-file = "/srv/secrets/backplane-client/procul.passwd";
        target-file = "/srv/backplane/dns/client.passwd";
        user = config.fudo.client.dns.user;
      };

      postgres-keytab = {
        source-file = "/srv/secrets/kerberos/procul-postgres.keytab";
        target-file = "/srv/postgres/secure/postgres.keytab";
        user = "root";
      };

      gitea-database-password = {
        source-file = "/srv/secrets/gitea/procul-database.passwd";
        target-file = "/srv/gitea/secure/database.passwd";
        user = config.fudo.git.user;
      };
    };

    client.dns = {
      enable = true;
      ipv4 = true;
      ipv6 = true;
      user = "fudo-client";
      external-interface = "extif0";
      password-file =
        config.fudo.secrets.procul.backplane-client-passwd.target-file;
    };

    auth.kdc = {
      enable = true;
      realm = "INFORMIS.LAND";
      bind-addresses = [ host-ipv4 "127.0.0.1" ];
      acl = {
        "niten" = { perms = [ "add" "change-password" "list" ]; };
        "*/root" = { perms = [ "all" ]; };
      };
    };

    secure-dns-proxy = {
      enable = true;
      upstream-dns =
        [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
      bootstrap-dns = "1.1.1.1";
      listen-ips = [ "127.0.0.1" ];
      listen-port = 53;
      allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
    };

    dns = {
      enable = true;
      identity = "procul.informis.land";
      nameservers = {
        ns1 = {
          ipv4-address = host-ipv4;
          description = "Primary Informis Nameserver";
        };
        ns2 = {
          ipv4-address = host-ipv4;
          description = "Secondary Informis Nameserver";
        };
      };

      listen-ips = [ host-ipv4 ];

      domains = {
        "informis.land" = {
          dnssec = true;
          default-host = host-ipv4;
          gssapi-realm = "INFORMIS.LAND";
          mx = [ "smtp.informis.land" ];
          network-definition = config.fudo.networks."informis.land";
          dmarc-report-address = "dmarc-report@informis.land";
        };
      };
    };

    mail-server = {
      enable = true;
      debug = true;

      domain = domain;
      hostname = "${host-fqdn}";
      monitoring = false;
      mail-user = "mailuser";
      mail-user-id = 525;
      mail-group = "mailgroup";
      clamav.enable = true;
      dkim.signing = true;

      dovecot = {
        ssl-certificate = acme-certificate "imap.${domain}";
        ssl-private-key = acme-private-key "imap.${domain}";
      };

      postfix = {
        ssl-certificate = acme-certificate "smtp.${domain}";
        ssl-private-key = acme-private-key "smtp.${domain}";
      };

      # This should NOT include the primary domain
      local-domains = [ host-fqdn "smtp.${domain}" ];

      mail-directory = "/srv/mailserver/mail";
      state-directory = "/srv/mailserver/state";

      trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];

      alias-users = {
        root = [ "niten" ];
        postmaster = [ "niten" ];
        hostmaster = [ "niten" ];
        webmaster = [ "niten" ];
        system = [ "niten" ];
        admin = [ "niten" ];
        dmarc-report = [ "niten" ];
      };
    };

    postgresql = {
      enable = true;
      ssl-certificate = (acme-certificate host-fqdn);
      ssl-private-key = (acme-private-key host-fqdn);
      keytab = config.fudo.secrets.procul.postgres-keytab.target-file;
      local-networks = local-networks;

      users = {
        gituser = {
          password-file =
            config.fudo.secrets.procul.gitea-database-password.target-file;
          databases = {
            git = {
              access = "CONNECT";
              entity-access = {
                "ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
                "ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
              };
            };
          };
        };
      };

      databases = { git = { users = [ "niten" ]; }; };
    };

    git = {
      enable = true;
      hostname = "git.informis.land";
      site-name = "informis git";
      user = "gituser";
      repository-dir = /srv/git/repo;
      state-dir = /srv/git/state;
      database = {
        user = "gituser";
        password-file =
          config.fudo.secrets.procul.gitea-database-password.target-file;
        hostname = "127.0.0.1";
        name = "git";
      };
      ssh = {
        listen-ip = host-ipv4;
        listen-port = 2222;
      };
    };

    acme = {
      enable = true;
      admin-address = "admin@${domain}";
      hostnames = [
        "informis.land"
        "imap.informis.land"
        "smtp.informis.land"
        "gemini.informis.land"
      ];
    };
  };
}