nixos-config/config/host-config/procul.nix

{ config, lib, pkgs, ... }:

with pkgs.lib;
let
  hostname = "procul";

  host-ipv4 = "172.86.179.18";
  git-ipv4 = "172.86.179.19";
  domain-name = config.fudo.hosts.${hostname}.domain;
  domain = config.fudo.domains.${domain-name};
  site-name = config.fudo.hosts.${hostname}.site;
  site = config.fudo.sites.${site-name};
  host-fqdn = "${hostname}.${domain-name}";

  local-networks = domain.local-networks ++ site.local-networks;

  local-packages = with pkgs; [ ldns.examples ];

  host-secrets = config.fudo.secrets.host-secrets.procul;

  passwd = pkgs.lib.fudo.passwd;

  host-certs = config.fudo.acme.host-domains.${hostname};

  # grafana-database-password = pkgs.lib.passwd.stablerandom-passwd-file
  #   "grafana-database-password-${hostname}"
  #   "grafana-database-password-${hostname}-${config.instance.build-seed}";

in {
  networking = {
    dhcpcd.enable = false;
    useDHCP = false;

    enableIPv6 = true;

    # FIXME: this isn't the right place
    search = [ domain-name ];
    nameservers = [ "127.0.0.1" ];
    defaultGateway = site.gateway-v4;

    interfaces = {
      extif0 = {
        ipv4.addresses = [
          {
            address = host-ipv4;
            prefixLength = 29;
          }
          {
            address = git-ipv4;
            prefixLength = 29;
          }
        ];
      };
    };
  };

  virtualisation = {
    docker.enable = false;
    podman = {
      enable = true;
      autoPrune.enable = true;
      dockerSocket.enable = true;
    };
    oci-containers.backend = "podman";
    arion.backend = "podman-socket";
  };

  services = {
    # lemmy = {
    #   server.package = pkgs.unstable.lemmy-server;
    #   ui.package = pkgs.unstable.lemmy-ui;
    # };

    # lemmyDocker = {
    #   enable = true;
    #   hostname = "informis.land";
    #   site-name = "Informis Lemmy";
    #   version = "0.18.2";
    #   state-directory = "/state/services/lem";
    #   smtp-server = "smtp.informis.land:587";
    #   docker-images = {
    #     pictrs = "asonix/pictrs:0.4.0-rc.14";
    #     postgres = "postgres:15-alpine";
    #   };
    # };

    nginx = {
      enable = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;

      # virtualHosts."lemmy.informis.land" = {
      #   enableACME = true;
      #   forceSSL = true;
      #   locations = {
      #     "/" = {
      #       proxyPass =
      #         "http://localhost:${toString config.services.lemmy.ui.port}";
      #       proxyWebsockets = true;
      #       extraConfig = ''
      #         proxy_set_header Host $host;
      #         proxy_set_header Upgrade $http_upgrade;
      #         proxy_set_header Connection "Upgrade";
      #         proxy_set_header X-Real-IP $remote_addr;
      #         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      #       '';
      #     };
      #     "/api" = {
      #       proxyPass = "http://localhost:${
      #           toString config.services.lemmy.settings.port
      #         }";
      #       proxyWebsockets = true;
      #       extraConfig = ''
      #         proxy_set_header Host $host;
      #         proxy_set_header Upgrade $http_upgrade;
      #         proxy_set_header Connection "Upgrade";
      #         proxy_set_header X-Real-IP $remote_addr;
      #         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      #       '';
      #     };
      #   };
      # };
    };
  };

  environment.systemPackages = local-packages;

  networking.firewall.allowedTCPPorts = [ 80 443 ];

  security.acme.defaults.email = "root@informis.land";

  users = {
    users.gituser = {
      isSystemUser = true;
      group = "nogroup";
    };
    groups.acme.members = [ "nginx" ];
  };

  informis = {
    cl-gemini = {
      enable = true;

      hostname = "gemini.informis.land";
      server-ip = host-ipv4;
      document-root = "/srv/gemini/root";
      textfiles-archive = "${pkgs.textfiles}";
      slynk-port = 4005;

      feeds = {
        viator = {
          title = "viator's phlog";
          path = "/home/viator/gemini-public/feed/";
          url = "gemini://informis.land/user/viator/feed/";
        };
      };
    };

    # services.chute = let
    #   secret-files = config.fudo.secrets.files.service-secrets.procul;
    # in {
    #   enable = true;
    #   jabber-user = "niten@jabber.fudo.org";
    #   staging = {
    #     secret-file = secret-files."chute-staging.secret";
    #     passphrase-file = secret-files."chute-staging.passphrase";
    #     key-file = secret-files."chute-staging.key";
    #   };
    # };
  };

  fudo = {
    hosts.procul.external-interfaces = [ "extif0" ];

    # zones."informis.land".aliases.lemmy = "procul";

    acme.host-domains.${hostname} = {
      ${host-fqdn} = {
        admin-email = "admin@${domain-name}";
        local-copies = {
          postgresql = {
            user = config.systemd.services.postgresql.serviceConfig.User;
            dependent-services = [ "postgresql.service" ];
            part-of = [ config.fudo.postgresql.systemd-target ];
          };
        };
      };

      # "imap.${domain-name}" = {
      #   admin-email = "admin@${domain-name}";
      #   local-copies.dovecot = {
      #     user = config.services.dovecot2.user;
      #     dependent-services = [ "dovecot2.service" ];
      #   };
      # };

      # "smtp.${domain-name}" = {
      #   admin-email = "admin@${domain-name}";
      #   local-copies.postfix = {
      #     user = config.services.postfix.user;
      #     dependent-services = [ "postfix.service" ];
      #   };
      # };
    };

    secrets.host-secrets.procul = let files = config.fudo.secrets.files;
    in {
      # postgres-keytab = {
      #   source-file = files.service-keytabs.procul.postgres;
      #   target-file = "/srv/postgres/secure/postgres.keytab";
      #   user = "root";
      # };

      gitea-database-password = {
        source-file = files.service-passwords.procul.gitea-database;
        target-file = "/srv/gitea/secure/database.passwd";
        user = config.fudo.git.user;
      };

      postgres-gitea-password = {
        source-file = files.service-passwords.procul.gitea-database;
        target-file = "/srv/postgres-users/database.passwd";
        user = config.services.postgresql.superUser;
      };

      # heimdal-master-key = {
      #   source-file = files.realm-master-keys."INFORMIS.LAND";
      #   target-file = "/run/heimdal/master-key";
      #   user = config.fudo.auth.kdc.user;
      # };

      chute-staging-credentials = {
        source-file = files.service-secrets.procul."chute-staging.env";
        target-file = "/run/chute/staging/credentials.env";
        user = "root";
      };

      # grafana-postgres-password = {
      #   source-file = grafana-database-password;
      #   target-file = "/run/metrics/grafana/db.passwd";
      #   user = config.systemd.services.grafana.serviceConfig.User;
      # };

      # postgres-grafana-password = {
      #   source-file = grafana-database-password;
      #   target-file = "/run/postgres-users/grafana.passwd";
      #   user = config.services.postgresql.superUser;
      # };
    };

    client.dns = {
      ipv4 = true;
      ipv6 = true;
      user = "fudo-client";
      external-interface = "extif0";
    };

    secure-dns-proxy = {
      enable = true;
      upstream-dns =
        [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
      bootstrap-dns = "1.1.1.1";
      listen-ips = [ "127.0.0.1" ];
      listen-port = 53;
      allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
    };

    # mail-server = {
    #   enable = true;
    #   debug = true;

    #   domain = domain-name;
    #   mail-hostname = "${host-fqdn}";
    #   monitoring = false;
    #   mail-user = "mailuser";
    #   mail-user-id = 525;
    #   mail-group = "mailgroup";
    #   clamav.enable = true;
    #   dkim.signing = true;

    #   dovecot = let
    #     cert-copy =
    #       host-certs."imap.${domain-name}".local-copies.dovecot;
    #   in {
    #     ssl-certificate = cert-copy.full-certificate;
    #     ssl-private-key = cert-copy.private-key;
    #   };

    #   postfix = let
    #     cert-copy =
    #       host-certs."smtp.${domain-name}".local-copies.postfix;
    #   in {
    #     ssl-certificate = cert-copy.full-certificate;
    #     ssl-private-key = cert-copy.private-key;
    #   };

    #   # This should NOT include the primary domain
    #   local-domains = [ host-fqdn "smtp.${domain-name}" ];

    #   mail-directory = "/srv/mailserver/mail";
    #   state-directory = "/srv/mailserver/state";

    #   trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];

    #   alias-users = {
    #     root = [ "niten" ];
    #     postmaster = [ "niten" ];
    #     hostmaster = [ "niten" ];
    #     webmaster = [ "niten" ];
    #     system = [ "niten" ];
    #     admin = [ "niten" ];
    #     dmarc-report = [ "niten" ];
    #   };
    # };

    services = {
      auth = {
        kerberos = {
          state-directory = "/var/lib/kerberos";
          master-key-file = host-secrets.heimdal-master-key.target-file;
        };
        ldap.state-directory = "/state/services/ldap";
      };
      dns.zones."informis.land".enable = true;
      postgresql = {
        state-directory = "/state/services/postgresql-15";
        keytab = extractFudoHostKeytab {
          inherit hostname;
          realm = domain.gssapi-realm;
          services = [ "postgres" ];
        };
      };
      # lemmy = {
      #   enable = true;
      #   hostname = "lemmy.informis.land";
      # };
      logging.loki.state-directory = "/state/services/loki";
      mail-server = { state-directory = "/srv/mailserver"; };
      metrics = {
        prometheus.state-directory = "/state/services/prometheus";
        grafana = {
          state-directory = "/state/services/grafana";
          # database = {
          #   user = "grafana";
          #   password-file = host-secrets.grafana-postgres-password.target-file;
          # };
        };
      };
    };

    postgresql = let
      # cert-copy = host-certs.${host-fqdn}.local-copies.postgresql;
    in {
      # enable = true;
      # ssl-certificate = cert-copy.full-certificate;
      # ssl-private-key = cert-copy.private-key;
      # keytab = host-secrets.postgres-keytab.target-file;
      # local-networks = local-networks;

      users = {
        # grafana = {
        #   password-file = host-secrets.postgres-grafana-password.target-file;
        #   databases.grafana = {
        #     access = "CONNECT";
        #     entity-access = {
        #       "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
        #       # "SELECT,INSERT,UPDATE,DELETE";
        #       "ALL SEQUENCES IN SCHEMA public" = "ALL PRIVILEGES";
        #       # "SELECT, UPDATE";
        #     };
        #   };
        # };

        gituser = {
          password-file = host-secrets.postgres-gitea-password.target-file;
          databases = {
            git = {
              access = "CONNECT";
              entity-access = {
                "ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
                "ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
              };
            };
          };
        };
      };

      databases = {
        # grafana.users = config.instance.local-admins;
        git.users = config.instance.local-admins;
      };
    };

    git = {
      enable = true;
      hostname = "git.informis.land";
      site-name = "informis git";
      user = "gituser";
      repository-dir = "/srv/git/repo";
      state-dir = "/srv/git/state";
      database = {
        user = "gituser";
        password-file = host-secrets.gitea-database-password.target-file;
        hostname = "127.0.0.1";
        name = "git";
      };
      ssh = {
        listen-ip = host-ipv4;
        listen-port = 2222;
      };
    };
  };
}