nixos-config/config/host-config/france.nix

{ config, lib, pkgs, ... }:

with lib;
let
  primary-ip = "208.81.3.117";
  git-server-ip = "208.81.3.118";
  hostname = config.instance.hostname;
  domain-name = config.fudo.hosts.${hostname}.domain;
  domain = config.fudo.domains.${domain-name};
  host-fqdn = "${hostname}.${domain-name}";
  mail-hostname = "mail.fudo.org";

  secrets = config.fudo.secrets.host-secrets.france;
  secret-files = config.fudo.secrets.files;

  letsencrypt-full-chain = name: chain: pkgs.stdenv.mkDerivation {
    name = "${name}-letsencrypt-full-chain.pem";
    phases = "installPhase";
    installPhase = ''
      cat ${chain} > $out
      cat ${pkgs.letsencrypt-ca}/ca.pem >> $out
    '';
  };

in {
  imports = let
    is-regular-file = filename: type: type == "regular" || type == "link";
    regular-files = path:
      attrNames (filterAttrs is-regular-file (builtins.readDir path));
    is-nix-file = filename: (builtins.match "^(.+)\.nix$" filename) != null;
    nix-files = path:
      map
        (file: path + "/${file}")
        (filter is-nix-file (regular-files path));
  in nix-files ./france;

  config = {
    security.acme.email = "admin@fudo.org";

    fudo = {
      hosts.france.external-interfaces = [ "extif0" ];

      acme.host-domains.france."france.fudo.org" = {
        email = "admin@fudo.org";
        local-copies = {
          postgres = {
            user = config.services.postgresql.user;
          };
          openldap = {
            user = config.services.openldap.user;
          };
        };
      };

      secrets.host-secrets.${hostname} = let
        ldap-user = config.services.openldap.user;
        ldap-group = config.services.openldap.group;
      in {
        ldap-ssl-certificate = {
          source-file = cfg.ssl-certificate;
          target-file = "/run/openldap/ssl-certificate.pem";
          user = ldap-user;
          group = ldap-group;
          permissions = "0444";
        };
        ldap-ssl-private-key = {
          source-file = cfg.ssl-private-key;
          target-file = "/run/openldap/ssl-private-key.pem";
          user = ldap-user;
          group = ldap-group;
        };
        ldap-ssl-ca-certificate = {
          source-file = cfg.ssl-ca-certificate;
          target-file = "/run/openldap/ssl-ca-certificate.pem";
          user = ldap-user;
          group = ldap-group;
          permissions = "0444";
        };
        ldap-keytab = {
          source-file = secret-files.service-keytabs.france.ldap;
          target-file = "/run/openldap/ldap.keytab";
          user = ldap-user;
          group = ldap-group;
        };
        ldap-root-passwd = {
          source-file = passwd.random-passwd-file;
          target-file = "/run/openldap/root.passwd";
          user = ldap-user;
          group = ldap-group;
        };
        postgres-keytab = {
          source-file = secret-files.service-keytabs.france.postgres;
          target-file = "/run/postgres/postgres.keytab";
          user = config.services.postgresql.user;
        };
      };

      client.dns = {
        enable = true;
        ipv4 = true;
        ipv6 = true;
        user = "fudo-client";
        external-interface = "extif0";
      };

      france = {
        ldap = let
          cert-copy = config.fudo.acme.host-domains.france."france.fudo.org".local-copies.openldap;
          chain = "${letsencrypt-full-chain "openldap-france" cert-copy.chain}";
        in {
          ssl-certificate = cert-copy.certificate;
          ssl-private-key = cert-copy.private-key;
          ssl-ca-certificate = chain;
          keytab = secrets.ldap-keytab.target-file;
          root-password-file = secrets.ldap-root-passwd.target-file;
        };

        kdc = {
          state-directory = "/state/kerberos";
          master-key-file = "";
          listen-ips = [ primary-ip "127.0.0.1" "127.0.1.1" "::1" ];
        };

        jabber = {
          ldap-servers = [ "france.fudo.org" ];
          listen-ips = [ primary-ip ];
        };

        backplane = {
          host-passwd-files = let
            hosts = attrNames config.fudo.hosts;
          in mapAttrs (hostname: hostOpts: hostOpts.backplane-password-file)
            config.fudo.hosts;
          service-passwd-files = genAttrs [ "dns" ]
            (service-name:
              lib.fudo.passwd.stablerandom-passwd-file
                "${service-name}-service-backplane-passwd"
                "${service-name}-service-backplane-passwd-${config.instance.build-seed}");
        };

        backplane-server = {
          listen-ips = [ primary-ip ];
        };

        mail = {
          mail-directory = "/srv/mail/mailboxes";
          state-directory = "/srv/mail/var";
          ldap-server-urls = [
            "ldap://france.fudo.org"
          ];
        };

        webmail = {
          mail-server = mail-hostname;
          database.hostname = "localhost";
        };

        git = {
          repository-directory = "/state/gitea/repo";
          state-directory = "/state/gitea/state";
          ssh.listen-ip = git-server-ip;
          database-host = "localhost";
        };

        postgresql = let
          cert-copy = config.fudo.acme.host-domains.france."france.fudo.org".local-copies.postgres;
        in {
          keytab = secrets.postgres-keytab.target-file;
          ssl-certificate = cert-copy.certificate;
          ssl-private-key = cert-copy.private-key;
        };
      };

      minecraft-server = {
        enable = true;
        package = pkgs.minecraft-current;
        data-dir = "/state/minecraft/selbyland";
        world-name = "selbyland";
        motd = "Welcome to the Selby Minecraft server.";
      };
    };

    networking = {
      useDHCP = false;

      interfaces = {
        intif0 = {
          ipv4.addresses = [{
            address = "192.168.11.1";
            prefixLength = 24;
          }];
        };
        extif0 = {
          ipv4.addresses = [
            {
              address = primary-ip;
              prefixLength = 28;
            }
            {
              address = git-server-ip;
              prefixLength = 32;
            }
          ];
        };
      };
    };

    services = {
      nginx = {
        enable = true;
        recommendedGzipSettings = true;
        recommendedOptimisation = true;
        recommendedTlsSettings = true;
        recommendedProxySettings = true;

        virtualHosts = {
          "mail.fudo.org" = {
            enableACME = true;
            locations."/".return = "301 https://webmail.fudo.org$request_uri";
          };
        };
      };
    };
  };
}