nixos-config/config/host-config/procul.nix

283 lines
7.2 KiB
Nix

{ config, lib, pkgs, ... }:
with lib;
let
hostname = "procul";
host-ipv4 = "172.86.179.18";
git-ipv4 = "172.86.179.19";
domain-name = config.fudo.hosts.${hostname}.domain;
domain = config.fudo.domains.${domain-name};
site-name = config.fudo.hosts.${hostname}.site;
site = config.fudo.sites.${site-name};
host-fqdn = "${hostname}.${domain-name}";
local-networks =
domain.local-networks ++ site.local-networks;
local-packages = with pkgs; [ ldns.examples ];
host-secrets = config.fudo.secrets.host-secrets.procul;
passwd = pkgs.lib.fudo.passwd;
host-certs = config.fudo.acme.host-domains.${hostname};
in {
networking = {
dhcpcd.enable = false;
useDHCP = false;
enableIPv6 = true;
# FIXME: this isn't the right place
search = [ domain-name ];
nameservers = [ "127.0.0.1" ];
defaultGateway = site.gateway-v4;
interfaces = {
extif0 = {
ipv4.addresses = [
{
address = host-ipv4;
prefixLength = 29;
}
{
address = git-ipv4;
prefixLength = 29;
}
];
};
};
};
environment.systemPackages = local-packages;
networking.firewall.allowedTCPPorts = [ 80 443 ];
users = {
users = {
gituser = {
isSystemUser = true;
group = "nogroup";
};
};
groups = { acme = { members = [ "nginx" ]; }; };
};
informis = {
cl-gemini = {
enable = true;
hostname = "gemini.informis.land";
server-ip = host-ipv4;
document-root = "/srv/gemini/root";
textfiles-archive = "${pkgs.textfiles}";
slynk-port = 4005;
feeds = {
viator = {
title = "viator's phlog";
path = "/home/viator/gemini-public/feed/";
url = "gemini://informis.land/user/viator/feed/";
};
};
};
services.chute = let
secret-files = config.fudo.secrets.files.service-secrets.procul;
in {
enable = true;
jabber-user = "niten@jabber.fudo.org";
staging = {
secret-file = secret-files."chute-staging.secret";
passphrase-file = secret-files."chute-staging.passphrase";
key-file = secret-files."chute-staging.key";
};
};
};
fudo = {
hosts.procul.external-interfaces = [ "extif0" ];
acme.host-domains.${hostname} = {
${host-fqdn} = {
admin-email = "admin@${domain-name}";
local-copies = {
postgresql = {
user = config.systemd.services.postgresql.serviceConfig.User;
dependent-services = [ "postgresql.service" ];
part-of = [ config.fudo.postgresql.systemd-target ];
};
};
};
"imap.${domain-name}" = {
admin-email = "admin@${domain-name}";
local-copies.dovecot = {
user = config.services.dovecot2.user;
dependent-services = [ "dovecot2.service" ];
};
};
"smtp.${domain-name}" = {
admin-email = "admin@${domain-name}";
local-copies.postfix = {
user = config.services.postfix.user;
dependent-services = [ "postfix.service" ];
};
};
};
secrets.host-secrets.procul = let
files = config.fudo.secrets.files;
in {
postgres-keytab = {
source-file = files.service-keytabs.procul.postgres;
target-file = "/srv/postgres/secure/postgres.keytab";
user = "root";
};
gitea-database-password = {
source-file = files.service-passwords.procul.gitea-database;
target-file = "/srv/gitea/secure/database.passwd";
user = config.fudo.git.user;
};
heimdal-master-key = {
source-file = files.realm-master-keys."INFORMIS.LAND";
target-file = "/run/heimdal/master-key";
user = config.fudo.auth.kdc.user;
};
chute-staging-credentials = {
source-file = files.service-secrets.procul."chute-staging.env";
target-file = "/run/chute/staging/credentials.env";
user = "root";
};
};
client.dns = {
ipv4 = true;
ipv6 = true;
user = "fudo-client";
external-interface = "extif0";
};
services = {
auth = {
kerberos = {
state-directory = "/var/lib/kerberos";
master-key-file = host-secrets.heimdal-master-key.target-file;
};
};
};
secure-dns-proxy = {
enable = true;
upstream-dns =
[ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
bootstrap-dns = "1.1.1.1";
listen-ips = [ "127.0.0.1" ];
listen-port = 53;
allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
};
mail-server = {
enable = true;
debug = true;
domain = domain-name;
mail-hostname = "${host-fqdn}";
monitoring = false;
mail-user = "mailuser";
mail-user-id = 525;
mail-group = "mailgroup";
clamav.enable = true;
dkim.signing = true;
dovecot = let
cert-copy =
host-certs."imap.${domain-name}".local-copies.dovecot;
in {
ssl-certificate = cert-copy.full-certificate;
ssl-private-key = cert-copy.private-key;
};
postfix = let
cert-copy =
host-certs."smtp.${domain-name}".local-copies.postfix;
in {
ssl-certificate = cert-copy.full-certificate;
ssl-private-key = cert-copy.private-key;
};
# This should NOT include the primary domain
local-domains = [ host-fqdn "smtp.${domain-name}" ];
mail-directory = "/srv/mailserver/mail";
state-directory = "/srv/mailserver/state";
trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];
alias-users = {
root = [ "niten" ];
postmaster = [ "niten" ];
hostmaster = [ "niten" ];
webmaster = [ "niten" ];
system = [ "niten" ];
admin = [ "niten" ];
dmarc-report = [ "niten" ];
};
};
postgresql = let
cert-copy = host-certs.${host-fqdn}.local-copies.postgresql;
in {
enable = true;
ssl-certificate = cert-copy.full-certificate;
ssl-private-key = cert-copy.private-key;
keytab = host-secrets.postgres-keytab.target-file;
local-networks = local-networks;
users = {
gituser = {
password-file =
host-secrets.gitea-database-password.target-file;
databases = {
git = {
access = "CONNECT";
entity-access = {
"ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
"ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
};
};
};
};
};
databases = { git = { users = [ "niten" ]; }; };
};
git = {
enable = true;
hostname = "git.informis.land";
site-name = "informis git";
user = "gituser";
repository-dir = "/srv/git/repo";
state-dir = "/srv/git/state";
database = {
user = "gituser";
password-file =
host-secrets.gitea-database-password.target-file;
hostname = "127.0.0.1";
name = "git";
};
ssh = {
listen-ip = host-ipv4;
listen-port = 2222;
};
};
};
}