nixos-config/config/host-config/germany.nix

{ config, lib, pkgs, ... }:

with pkgs.lib;
let
  primary-ip = "208.81.3.116";
  hostname = config.instance.hostname;
  host = config.fudo.hosts."${hostname}";
  domainName = host.domain;
  domain = config.fudo.domains."${domainName}";
  site = config.fudo.sites."${host.site}";
  hostFqdn = "${hostname}.${domainName}";
  hostSecrets = config.fudo.secrets.host-secrets."${hostname}";

in {
  config = {
    networking = {
      enableIPv6 = false;
      useDHCP = false;
      nameservers = [ "1.1.1.1" ];
      defaultGateway = {
        interface = "enp5s0f0";
        address = site.gateway-v4;
      };
      interfaces = {
        enp5s0f0 = {
          ipv4.addresses = [{
            address = primary-ip;
            prefixLength = 28;
          }];
        };
      };
      firewall = {
        enable = false;
        interfaces."podman[0-9]+".allowedUDPPorts = [ 53 ];
      };
    };

    systemd = {
      tmpfiles.rules = [
        "L /etc/adjtime - - - - /state/etc/adjtime"
        "d /state/services 0555 - - - -"
      ];

      services = {
        # This has been failing because NS keys aren't available yet
        "container@nameserver" = {
          after = [ "fudo-secrets.target" ];
          requires = [ "fudo-secrets.target" ];
        };

        "lemmy" = {
          after = [ "postgresql.service" ];
          requires = [ "postgresql.service" ];
        };

        fudo-mail-sync = {
          path = with pkgs; [ rsync openssh ];
          serviceConfig = {
            Type = "oneshot";
            ExecStart = pkgs.writeShellScript "fudo-mail-sync.sh" ''
              ssh-add ~/.ssh/id_ed25519
              rsync -avz france.fudo.org:/srv/mail/mailboxes/ /state/services/mail/mail/
              chown 5025:5025 -R /state/services/mail/mail
              chmod go-rwx -R /state/services/mail/mail
            '';
          };
        };

        webmail-init = {
          after = [ "fudo-secrets.target" ];
          requires = [ "fudo-secrets.target" ];
        };
      };

      timers.fudo-mail-sync = {
        wantedBy = [ "timers.target" ];
        timerConfig = {
          OnBootSec = "3h";
          OnUnitActiveSec = "3h";
          Unit = "fudo-mail-sync.service";
        };
      };
    };

    security.acme.defaults.email = "admin@fudo.org";

    virtualisation = {
      podman = {
        enable = true;
        autoPrune.enable = true;
        dockerSocket.enable = true;
        dockerCompat = true;
        defaultNetwork.settings = {
          dns_enabled = true;
          network_dns_servers = [ "1.1.1.1" "8.8.4.4" ];
        };
      };
      oci-containers.backend = "podman";
      arion.backend = "podman-socket";
    };

    services = {
      lemmyContainer.state-directory = "/state/services/lemmy-container";
      mastodonContainer.streaming-processes = 6;
      nextcloudContainer = {
        state-directory = "/state/services/nextcloud";
        store-directory = "/store/nextcloud";
      };
      immichContainer = {
        state-directory = "/state/services/immich";
        store-directory = "/store/immich";
      };
      nginx = {
        enable = true;
        commonHttpConfig = ''
          log_format with_response_time '$remote_addr - $remote_user [$time_local] '
                       '"$request" $status $body_bytes_sent '
                       '"$http_referer" "$http_user_agent" '
                       '"$request_time" "$upstream_response_time"';
          access_log /var/log/nginx/access.log with_response_time;
        '';
        recommendedTlsSettings = true;
        recommendedGzipSettings = true;
        recommendedOptimisation = true;
        recommendedProxySettings = true;
      };
    };

    fudo = {
      client.dns = {
        ipv4 = true;
        ipv6 = true;
        user = "fudo-client";
        external-interface = "enp5s0f0";
      };

      mail.state-directory = "/state/services/mail";

      nsd.zones."fudo.org".outgoingInterface = "enp5s0f0";

      # Necessary because germany isn't the default yet
      postgresql = {
        enable = true;
        state-directory = "/state/services/postgresql";
      };

      webmail.state-directory = "/state/services/webmail";

      services = {
        auth = {
          kerberos.state-directory = "/state/services/kerberos";
          ldap.state-directory = "/state/services/ldap";
        };
        authoritative-dns.state-directory = "/state/services/dns";
        gitea-container = {
          networking.interface = "enp5s0f0";
          state-directory = "/state/services/gitea-container";
        };
        jabber.state-directory = "/state/services/jabber";
        logging.loki.state-directory = "/state/services/loki";
        mail-server.state-directory = "/state/services/mail";
        metrics = {
          prometheus.state-directory = "/state/services/prometheus";
          grafana.state-directory = "/state/services/grafana";
        };
        nexus.dns-server.listen-addresses = [ primary-ip ];
        postgresql = {
          state-directory = "/state/services/postgresql";
          keytab = extractFudoKeytab {
            realm = domain.gssapi-realm;
            principals = [ "postgres/${hostFqdn}" ];
          };
        };
        matrix.state-directory = "/state/services/matrix";
      };
    };
  };
}