135 lines
3.5 KiB
Nix
135 lines
3.5 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
hostname = "legatus";
|
|
host-ipv4 = "91.229.23.204";
|
|
domain-name = config.fudo.hosts.${hostname}.domain;
|
|
domain = config.fudo.domains.${domain-name};
|
|
site-name = config.fudo.hosts.${hostname}.site;
|
|
site = config.fudo.sites.${site-name};
|
|
|
|
local-packages = with pkgs; [ ldns.examples ];
|
|
|
|
host-secrets = config.fudo.secrets.host-secrets.${hostname};
|
|
|
|
in {
|
|
networking = {
|
|
enableIPv6 = true;
|
|
|
|
nameservers = [ "1.1.1.1" ];
|
|
defaultGateway = {
|
|
address = site.gateway-v4;
|
|
interface = "extif0";
|
|
};
|
|
|
|
interfaces.extif0.ipv4.addresses = [{
|
|
address = host-ipv4;
|
|
prefixLength = 24;
|
|
}];
|
|
};
|
|
|
|
security.acme.email = "admin@legatus.fudo.org";
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"L /etc/adjtime - - - - /state/etc/adjtime"
|
|
];
|
|
|
|
environment.systemPackages = local-packages;
|
|
|
|
# networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
|
|
# informis.cl-gemini = {
|
|
# enable = true;
|
|
|
|
# hostname = "gemini.informis.land";
|
|
# server-ip = host-ipv4;
|
|
# document-root = "/srv/gemini/root";
|
|
# textfiles-archive = "${pkgs.textfiles}";
|
|
# slynk-port = 4005;
|
|
|
|
# feeds = {
|
|
# viator = {
|
|
# title = "viator's phlog";
|
|
# path = "/home/viator/gemini-public/feed/";
|
|
# url = "gemini://informis.land/user/viator/feed/";
|
|
# };
|
|
# };
|
|
# };
|
|
|
|
fudo = {
|
|
hosts.legatus.external-interfaces = [ "extif0" ];
|
|
|
|
services = {
|
|
auth = {
|
|
ldap.state-directory = "/state/auth/ldap";
|
|
kerberos = {
|
|
state-directory = "/state/auth/kerberos";
|
|
master-key-file = host-secrets.heimdal-master-key.target-file;
|
|
ipropd-keytab = host-secrets.heimdal-ipropd-keytab.target-file;
|
|
};
|
|
};
|
|
};
|
|
|
|
secrets.host-secrets.legatus = let
|
|
files = config.fudo.secrets.files;
|
|
in {
|
|
# postgres-keytab = {
|
|
# source-file = files.service-keytabs.procul.postgres;
|
|
# target-file = "/srv/postgres/secure/postgres.keytab";
|
|
# user = "root";
|
|
# };
|
|
|
|
# gitea-database-password = {
|
|
# source-file = files.service-passwords.procul.gitea-database;
|
|
# target-file = "/srv/gitea/secure/database.passwd";
|
|
# user = config.fudo.git.user;
|
|
# };
|
|
|
|
heimdal-master-key = {
|
|
source-file = files.realm-master-keys."FUDO.ORG";
|
|
target-file = "/run/heimdal/master-key";
|
|
user = config.fudo.auth.kdc.user;
|
|
};
|
|
|
|
heimdal-ipropd-keytab = {
|
|
source-file = files.service-keytabs.legatus.ipropd;
|
|
target-file = "/run/heimdal/ipropd.keytab";
|
|
user = config.fudo.auth.kdc.user;
|
|
};
|
|
};
|
|
|
|
client.dns = {
|
|
ipv4 = true;
|
|
ipv6 = true;
|
|
user = "fudo-client";
|
|
external-interface = "extif0";
|
|
};
|
|
|
|
# auth.kdc = {
|
|
# enable = true;
|
|
# realm = "FUDO.ORG";
|
|
# bind-addresses = [ host-ipv4 "127.0.0.1" ];
|
|
# master-key-file =
|
|
# secrets.heimdal-master-key.target-file;
|
|
# state-directory = "/state/kerberos";
|
|
# slave-config = {
|
|
# master-host = "france";
|
|
# ipropd-keytab = secrets.ipropd-keytab.target-file;
|
|
# };
|
|
# };
|
|
|
|
secure-dns-proxy = {
|
|
enable = true;
|
|
upstream-dns =
|
|
[ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
|
|
bootstrap-dns = "1.1.1.1";
|
|
listen-ips = [ "127.0.0.1" ];
|
|
listen-port = 53;
|
|
allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
|
|
};
|
|
|
|
dns.state-directory = "/state/nsd";
|
|
};
|
|
}
|