nixos-config/config/host-config/legatus.nix

{ config, lib, pkgs, ... }:

with lib;
let
  hostname = "legatus";
  host-ipv4 = "91.229.23.204";
  domain-name = config.fudo.hosts.${hostname}.domain;
  domain = config.fudo.domains.${domain-name};
  site-name = config.fudo.hosts.${hostname}.site;
  site = config.fudo.sites.${site-name};

  local-packages = with pkgs; [ ldns.examples ];

  secrets = config.fudo.secrets.host-secrets.${hostname};

in {
  networking = {
    enableIPv6 = true;

    nameservers = [ "1.1.1.1" ];
    defaultGateway = {
      address = site.gateway-v4;
      interface = "extif0";
    };

    interfaces.extif0.ipv4.addresses = [{
      address = host-ipv4;
      prefixLength = 24;
    }];
  };

  systemd.tmpfiles.rules = [
    "L /etc/adjtime - - - - /state/etc/adjtime"
  ];

  environment.systemPackages = local-packages;

  # networking.firewall.allowedTCPPorts = [ 80 443 ];

  # informis.cl-gemini = {
  #   enable = true;

  #   hostname = "gemini.informis.land";
  #   server-ip = host-ipv4;
  #   document-root = "/srv/gemini/root";
  #   textfiles-archive = "${pkgs.textfiles}";
  #   slynk-port = 4005;

  #   feeds = {
  #     viator = {
  #       title = "viator's phlog";
  #       path = "/home/viator/gemini-public/feed/";
  #       url = "gemini://informis.land/user/viator/feed/";
  #     };
  #   };
  # };

  fudo =  {
    hosts.legatus.external-interfaces = [ "extif0" ];
    secrets.host-secrets.legatus = let
      files = config.fudo.secrets.files;
    in {
      # postgres-keytab = {
      #   source-file = files.service-keytabs.procul.postgres;
      #   target-file = "/srv/postgres/secure/postgres.keytab";
      #   user = "root";
      # };

      # gitea-database-password = {
      #   source-file = files.service-passwords.procul.gitea-database;
      #   target-file = "/srv/gitea/secure/database.passwd";
      #   user = config.fudo.git.user;
      # };

      heimdal-master-key = {
        source-file = files.realm-master-keys."FUDO.ORG";
        target-file = "/run/heimdal/master-key";
        user = config.fudo.auth.kdc.user;
      };

      ipropd-keytab = {
        source-file = files.service-keytabs.legatus.ipropd;
        target-file = "/run/heimdal/ipropd.keytab";
        user = config.fudo.auth.kdc.user;
      };
    };

    client.dns = {
      ipv4 = true;
      ipv6 = true;
      user = "fudo-client";
      external-interface = "extif0";
    };

    auth.kdc = {
      enable = true;
      realm = "FUDO.ORG";
      bind-addresses = [ host-ipv4 "127.0.0.1" ];
      master-key-file =
        secrets.heimdal-master-key.target-file;
      state-directory = "/state/kerberos";
      slave-config = {
       master-host = "france";
        ipropd-keytab = secrets.ipropd-keytab.target-file;
      };
    };

    secure-dns-proxy = {
      enable = true;
      upstream-dns =
        [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
      bootstrap-dns = "1.1.1.1";
      listen-ips = [ "127.0.0.1" ];
      listen-port = 53;
      allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
    };

    dns.state-directory = "/state/nsd";

    # mail-server = {
    #   enable = true;
    #   debug = true;

    #   domain = domain-name;
    #   mail-hostname = "${host-fqdn}";
    #   monitoring = false;
    #   mail-user = "mailuser";
    #   mail-user-id = 525;
    #   mail-group = "mailgroup";
    #   clamav.enable = true;
    #   dkim.signing = true;

    #   dovecot = {
    #     ssl-certificate = acme-certificate "imap.${domain-name}";
    #     ssl-private-key = acme-private-key "imap.${domain-name}";
    #   };

    #   postfix = {
    #     ssl-certificate = acme-certificate "smtp.${domain-name}";
    #     ssl-private-key = acme-private-key "smtp.${domain-name}";
    #   };

    #   # This should NOT include the primary domain
    #   local-domains = [ host-fqdn "smtp.${domain-name}" ];

    #   mail-directory = "/srv/mailserver/mail";
    #   state-directory = "/srv/mailserver/state";

    #   trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];

    #   alias-users = {
    #     root = [ "niten" ];
    #     postmaster = [ "niten" ];
    #     hostmaster = [ "niten" ];
    #     webmaster = [ "niten" ];
    #     system = [ "niten" ];
    #     admin = [ "niten" ];
    #     dmarc-report = [ "niten" ];
    #   };
    # };

    # postgresql = {
    #   enable = true;
    #   ssl-certificate = (acme-certificate host-fqdn);
    #   ssl-private-key = (acme-private-key host-fqdn);
    #   keytab = secrets.postgres-keytab.target-file;
    #   local-networks = local-networks;

    #   users = {
    #     gituser = {
    #       password-file =
    #         secrets.gitea-database-password.target-file;
    #       databases = {
    #         git = {
    #           access = "CONNECT";
    #           entity-access = {
    #             "ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
    #             "ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
    #           };
    #         };
    #       };
    #     };
    #   };

    #   databases = { git = { users = [ "niten" ]; }; };
    # };

    # git = {
    #   enable = true;
    #   hostname = "git.informis.land";
    #   site-name = "informis git";
    #   user = "gituser";
    #   repository-dir = /srv/git/repo;
    #   state-dir = /srv/git/state;
    #   database = {
    #     user = "gituser";
    #     password-file =
    #       secrets.gitea-database-password.target-file;
    #     hostname = "127.0.0.1";
    #     name = "git";
    #   };
    #   ssh = {
    #     listen-ip = host-ipv4;
    #     listen-port = 2222;
    #   };
    # };
  };
}