140 lines
4.0 KiB
Nix
140 lines
4.0 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
mapOptional = f: val: if (val != null) then (f val) else null;
|
|
|
|
host = import ../types/host.nix { inherit lib; };
|
|
|
|
in {
|
|
options.fudo.hosts = with types;
|
|
mkOption {
|
|
type = attrsOf (submodule host.hostOpts);
|
|
description = "Host configurations for all hosts known to the system.";
|
|
default = { };
|
|
};
|
|
|
|
config = let
|
|
hostname = config.instance.hostname;
|
|
host-cfg = config.fudo.hosts.${hostname};
|
|
site-name = host-cfg.site;
|
|
site = config.fudo.sites.${site-name};
|
|
domain-name = host-cfg.domain;
|
|
domain = config.fudo.domains.${domain-name};
|
|
has-build-servers = (length (attrNames site.build-servers)) > 0;
|
|
has-build-keys = (length host-cfg.build-pubkeys) > 0;
|
|
|
|
in {
|
|
networking = {
|
|
hostName = config.instance.hostname;
|
|
domain = domain-name;
|
|
nameservers = site.nameservers;
|
|
# This will cause a loop on the gateway itself
|
|
#defaultGateway = site.gateway-v4;
|
|
#defaultGateway6 = site.gateway-v6;
|
|
|
|
firewall = {
|
|
enable = (length host-cfg.external-interfaces) > 0;
|
|
allowedTCPPorts = [ 22 ];
|
|
};
|
|
|
|
hostId = mkIf (host-cfg.machine-id != null)
|
|
(substring 0 8 host-cfg.machine-id);
|
|
};
|
|
|
|
# NixOS generates a stupid hosts file, just force it
|
|
environment.etc = {
|
|
hosts = let
|
|
host-entries = mapAttrsToList
|
|
(ip: hostnames: "${ip} ${concatStringsSep " " hostnames}")
|
|
config.fudo.system.hostfile-entries;
|
|
in mkForce {
|
|
text = ''
|
|
127.0.0.1 ${hostname}.${domain-name} ${hostname} localhost
|
|
127.0.0.2 ${hostname} localhost
|
|
::1 ${hostname}.${domain-name} ${hostname} localhost
|
|
${concatStringsSep "\n" host-entries}
|
|
'';
|
|
user = "root";
|
|
group = "root";
|
|
mode = "0444";
|
|
};
|
|
|
|
machine-id = mkIf (host-cfg.machine-id != null) {
|
|
text = host-cfg.machine-id;
|
|
user = "root";
|
|
group = "root";
|
|
mode = "0444";
|
|
};
|
|
|
|
current-system-packages.text = with builtins; let
|
|
packages = map (p: "${p.name}")
|
|
config.environment.systemPackages;
|
|
sorted-unique = sort lessThan (unique packages);
|
|
in concatStringsSep "\n" sorted-unique;
|
|
};
|
|
|
|
time.timeZone = site.timezone;
|
|
|
|
krb5.libdefaults.default_realm = domain.gssapi-realm;
|
|
|
|
services.cron.mailto = domain.admin-email;
|
|
|
|
environment.systemPackages = with pkgs;
|
|
mkIf (host-cfg.docker-server) [ docker nix-prefetch-docker ];
|
|
|
|
virtualisation.docker = mkIf (host-cfg.docker-server) {
|
|
enable = true;
|
|
enableOnBoot = true;
|
|
autoPrune.enable = true;
|
|
};
|
|
|
|
fudo = let
|
|
try-attr = attr: set: if (hasAttr attr set) then set.${attr} else null;
|
|
|
|
files = config.fudo.secrets.files;
|
|
|
|
keytab-file = try-attr hostname files.host-keytabs;
|
|
|
|
build-private-key-file =
|
|
mapOptional
|
|
(keypair: keypair.private-key)
|
|
(try-attr hostname files.build-keypairs);
|
|
|
|
backplane-passwd-source = try-attr hostname files.backplane-passwords;
|
|
|
|
backplane-passwd-target = "/var/run/backplane/passwd";
|
|
in {
|
|
secrets.host-secrets.${hostname} = {
|
|
host-keytab = mkIf (keytab-file != null) {
|
|
source-file = keytab-file;
|
|
target-file = "/etc/krb5.keytab";
|
|
user = "root";
|
|
};
|
|
|
|
build-private-key = mkIf (build-private-key-file != null) {
|
|
source-file = build-private-key-file;
|
|
target-file = "/var/run/nix-build/host.key";
|
|
user = "root";
|
|
};
|
|
|
|
backplane-passwd = mkIf (backplane-passwd-source != null) {
|
|
source-file = backplane-passwd-source;
|
|
target-file = backplane-passwd-target;
|
|
user = config.fudo.client.dns.user;
|
|
};
|
|
};
|
|
|
|
client.dns.password-file = mkIf (backplane-passwd-source != null)
|
|
backplane-passwd-target;
|
|
};
|
|
|
|
programs.adb.enable = host-cfg.android-dev;
|
|
users.groups.adbusers = mkIf host-cfg.android-dev {
|
|
members = config.instance.local-admins;
|
|
};
|
|
|
|
boot.tmpOnTmpfs = host-cfg.tmp-on-tmpfs;
|
|
};
|
|
}
|