111 lines
2.9 KiB
Nix
111 lines
2.9 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
primary-ip = "208.81.3.116";
|
|
dns-ip = "208.81.3.120";
|
|
hostname = config.instance.hostname;
|
|
host = config.fudo.hosts."${hostname}";
|
|
domainName = host.domain;
|
|
site = config.fudo.sites."${host.site}";
|
|
hostFqdn = "${hostname}.${domainName}";
|
|
hostSecrets = config.fudo.secrets.host-secrets."${hostname}";
|
|
in {
|
|
config = {
|
|
networking = {
|
|
enableIPv6 = true;
|
|
nameservers = [ "1.1.1.1" ];
|
|
defaultGateway = {
|
|
interface = "extif0";
|
|
address = site.gateway-v4;
|
|
};
|
|
interfaces = {
|
|
extif0 = {
|
|
ipv4.addresses = [{
|
|
address = primary-ip;
|
|
prefixLength = 28;
|
|
}];
|
|
};
|
|
dnsif0 = {
|
|
ipv4.addresses = [{
|
|
address = dns-ip;
|
|
prefixLength = 32;
|
|
}];
|
|
};
|
|
};
|
|
firewall = {
|
|
enable = false;
|
|
interfaces.podman0.allowedUDPPorts = [ 53 ];
|
|
};
|
|
};
|
|
|
|
systemd = {
|
|
tmpfiles.rules = [
|
|
"L /etc/adjtime - - - - /state/etc/adjtime"
|
|
"d /state/services 0555 - - - -"
|
|
];
|
|
|
|
services.fudo-mail-sync = {
|
|
path = with pkgs; [ rsync openssh ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = pkgs.writeShellScript "fudo-mail-sync.sh" ''
|
|
ssh-add ~/.ssh/id_ed25519
|
|
rsync -avz france.fudo.org:/srv/mail/mailboxes/ /state/services/mail/mail/
|
|
chown 5025:5025 -R /state/services/mail/mail
|
|
chmod go-rwx -R /state/services/mail/mail
|
|
'';
|
|
};
|
|
};
|
|
|
|
timers.fudo-mail-sync = {
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "3h";
|
|
OnUnitActiveSec = "3h";
|
|
Unit = "fudo-mail-sync.service";
|
|
};
|
|
};
|
|
};
|
|
|
|
security.acme.defaults.email = "admin@fudo.org";
|
|
|
|
virtualisation = {
|
|
podman = {
|
|
enable = true;
|
|
autoPrune.enable = true;
|
|
dockerSocket.enable = true;
|
|
defaultNetwork.settings.dns_enabled = true;
|
|
};
|
|
oci-containers.backend = "podman";
|
|
arion.backend = "podman-socket";
|
|
};
|
|
|
|
fudo = {
|
|
client.dns = {
|
|
ipv4 = true;
|
|
ipv6 = true;
|
|
user = "fudo-client";
|
|
external-interface = "extif0";
|
|
};
|
|
|
|
mail.state-directory = "/state/services/mail";
|
|
|
|
nsd.zones."fudo.org".outgoingInterface = "extif0";
|
|
|
|
services = {
|
|
auth = {
|
|
kerberos.state-directory = "/state/services/kerberos";
|
|
ldap.state-directory = "/state/services/ldap";
|
|
};
|
|
authoritative-dns.state-directory = "/state/services/dns";
|
|
jabber.state-directory = "/state/services/jabber";
|
|
metrics = {
|
|
prometheus.state-directory = "/state/services/prometheus";
|
|
grafana.state-directory = "/state/services/grafana";
|
|
};
|
|
logging.loki.state-directory = "/state/services/loki";
|
|
};
|
|
};
|
|
};
|
|
}
|