341 lines
9.4 KiB
Nix
341 lines
9.4 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
hostname = "procul";
|
|
|
|
host-ipv4 = "172.86.179.18";
|
|
git-ipv4 = "172.86.179.19";
|
|
domain-name = config.fudo.hosts.${hostname}.domain;
|
|
domain = config.fudo.domains.${domain-name};
|
|
site-name = config.fudo.hosts.${hostname}.site;
|
|
site = config.fudo.sites.${site-name};
|
|
host-fqdn = "${hostname}.${domain-name}";
|
|
|
|
local-networks = domain.local-networks ++ site.local-networks;
|
|
|
|
local-packages = with pkgs; [ ldns.examples ];
|
|
|
|
host-secrets = config.fudo.secrets.host-secrets.procul;
|
|
|
|
passwd = pkgs.lib.fudo.passwd;
|
|
|
|
host-certs = config.fudo.acme.host-domains.${hostname};
|
|
|
|
grafana-database-password = pkgs.lib.passwd.stablerandom-passwd-file
|
|
"grafana-database-password-${hostname}"
|
|
"grafana-database-password-${hostname}-${config.instance.build-seed}";
|
|
|
|
in {
|
|
networking = {
|
|
dhcpcd.enable = false;
|
|
useDHCP = false;
|
|
|
|
enableIPv6 = true;
|
|
|
|
# FIXME: this isn't the right place
|
|
search = [ domain-name ];
|
|
nameservers = [ "127.0.0.1" ];
|
|
defaultGateway = site.gateway-v4;
|
|
|
|
interfaces = {
|
|
extif0 = {
|
|
ipv4.addresses = [
|
|
{
|
|
address = host-ipv4;
|
|
prefixLength = 29;
|
|
}
|
|
{
|
|
address = git-ipv4;
|
|
prefixLength = 29;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = local-packages;
|
|
|
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
|
|
security.acme.email = "viator@informis.land";
|
|
|
|
users = {
|
|
users = {
|
|
gituser = {
|
|
isSystemUser = true;
|
|
group = "nogroup";
|
|
};
|
|
};
|
|
groups = { acme = { members = [ "nginx" ]; }; };
|
|
};
|
|
|
|
informis = {
|
|
cl-gemini = {
|
|
enable = true;
|
|
|
|
hostname = "gemini.informis.land";
|
|
server-ip = host-ipv4;
|
|
document-root = "/srv/gemini/root";
|
|
textfiles-archive = "${pkgs.textfiles}";
|
|
slynk-port = 4005;
|
|
|
|
feeds = {
|
|
viator = {
|
|
title = "viator's phlog";
|
|
path = "/home/viator/gemini-public/feed/";
|
|
url = "gemini://informis.land/user/viator/feed/";
|
|
};
|
|
};
|
|
};
|
|
|
|
# services.chute = let
|
|
# secret-files = config.fudo.secrets.files.service-secrets.procul;
|
|
# in {
|
|
# enable = true;
|
|
# jabber-user = "niten@jabber.fudo.org";
|
|
# staging = {
|
|
# secret-file = secret-files."chute-staging.secret";
|
|
# passphrase-file = secret-files."chute-staging.passphrase";
|
|
# key-file = secret-files."chute-staging.key";
|
|
# };
|
|
# };
|
|
};
|
|
|
|
fudo = {
|
|
hosts.procul.external-interfaces = [ "extif0" ];
|
|
|
|
acme.host-domains.${hostname} = {
|
|
${host-fqdn} = {
|
|
admin-email = "admin@${domain-name}";
|
|
local-copies = {
|
|
postgresql = {
|
|
user = config.systemd.services.postgresql.serviceConfig.User;
|
|
dependent-services = [ "postgresql.service" ];
|
|
part-of = [ config.fudo.postgresql.systemd-target ];
|
|
};
|
|
};
|
|
};
|
|
|
|
# "imap.${domain-name}" = {
|
|
# admin-email = "admin@${domain-name}";
|
|
# local-copies.dovecot = {
|
|
# user = config.services.dovecot2.user;
|
|
# dependent-services = [ "dovecot2.service" ];
|
|
# };
|
|
# };
|
|
|
|
# "smtp.${domain-name}" = {
|
|
# admin-email = "admin@${domain-name}";
|
|
# local-copies.postfix = {
|
|
# user = config.services.postfix.user;
|
|
# dependent-services = [ "postfix.service" ];
|
|
# };
|
|
# };
|
|
};
|
|
|
|
secrets.host-secrets.procul = let files = config.fudo.secrets.files;
|
|
in {
|
|
# postgres-keytab = {
|
|
# source-file = files.service-keytabs.procul.postgres;
|
|
# target-file = "/srv/postgres/secure/postgres.keytab";
|
|
# user = "root";
|
|
# };
|
|
|
|
gitea-database-password = {
|
|
source-file = files.service-passwords.procul.gitea-database;
|
|
target-file = "/srv/gitea/secure/database.passwd";
|
|
user = config.fudo.git.user;
|
|
};
|
|
|
|
postgres-gitea-password = {
|
|
source-file = files.service-passwords.procul.gitea-database;
|
|
target-file = "/srv/postgres-users/database.passwd";
|
|
user = config.services.postgresql.superUser;
|
|
};
|
|
|
|
heimdal-master-key = {
|
|
source-file = files.realm-master-keys."INFORMIS.LAND";
|
|
target-file = "/run/heimdal/master-key";
|
|
user = config.fudo.auth.kdc.user;
|
|
};
|
|
|
|
chute-staging-credentials = {
|
|
source-file = files.service-secrets.procul."chute-staging.env";
|
|
target-file = "/run/chute/staging/credentials.env";
|
|
user = "root";
|
|
};
|
|
|
|
grafana-postgres-password = {
|
|
source-file = grafana-database-password;
|
|
target-file = "/run/metrics/grafana/db.passwd";
|
|
user = config.systemd.services.grafana.serviceConfig.User;
|
|
};
|
|
|
|
postgres-grafana-password = {
|
|
source-file = grafana-database-password;
|
|
target-file = "/run/postgres-users/grafana.passwd";
|
|
user = config.services.postgresql.superUser;
|
|
};
|
|
};
|
|
|
|
client.dns = {
|
|
ipv4 = true;
|
|
ipv6 = true;
|
|
user = "fudo-client";
|
|
external-interface = "extif0";
|
|
};
|
|
|
|
secure-dns-proxy = {
|
|
enable = true;
|
|
upstream-dns =
|
|
[ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
|
|
bootstrap-dns = "1.1.1.1";
|
|
listen-ips = [ "127.0.0.1" ];
|
|
listen-port = 53;
|
|
allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
|
|
};
|
|
|
|
services.mail-server = { state-directory = "/srv/mailserver"; };
|
|
|
|
# mail-server = {
|
|
# enable = true;
|
|
# debug = true;
|
|
|
|
# domain = domain-name;
|
|
# mail-hostname = "${host-fqdn}";
|
|
# monitoring = false;
|
|
# mail-user = "mailuser";
|
|
# mail-user-id = 525;
|
|
# mail-group = "mailgroup";
|
|
# clamav.enable = true;
|
|
# dkim.signing = true;
|
|
|
|
# dovecot = let
|
|
# cert-copy =
|
|
# host-certs."imap.${domain-name}".local-copies.dovecot;
|
|
# in {
|
|
# ssl-certificate = cert-copy.full-certificate;
|
|
# ssl-private-key = cert-copy.private-key;
|
|
# };
|
|
|
|
# postfix = let
|
|
# cert-copy =
|
|
# host-certs."smtp.${domain-name}".local-copies.postfix;
|
|
# in {
|
|
# ssl-certificate = cert-copy.full-certificate;
|
|
# ssl-private-key = cert-copy.private-key;
|
|
# };
|
|
|
|
# # This should NOT include the primary domain
|
|
# local-domains = [ host-fqdn "smtp.${domain-name}" ];
|
|
|
|
# mail-directory = "/srv/mailserver/mail";
|
|
# state-directory = "/srv/mailserver/state";
|
|
|
|
# trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];
|
|
|
|
# alias-users = {
|
|
# root = [ "niten" ];
|
|
# postmaster = [ "niten" ];
|
|
# hostmaster = [ "niten" ];
|
|
# webmaster = [ "niten" ];
|
|
# system = [ "niten" ];
|
|
# admin = [ "niten" ];
|
|
# dmarc-report = [ "niten" ];
|
|
# };
|
|
# };
|
|
|
|
services = {
|
|
auth = {
|
|
kerberos = {
|
|
state-directory = "/var/lib/kerberos";
|
|
master-key-file = host-secrets.heimdal-master-key.target-file;
|
|
};
|
|
ldap.state-directory = "/state/services/ldap";
|
|
};
|
|
dns.zones."informis.land" = {
|
|
enable = true;
|
|
default-host = host-ipv4;
|
|
};
|
|
postgresql = {
|
|
state-directory = "/state/services/postgresql";
|
|
keytab = config.fudo.secrets.files.service-keytabs.procul.postgres;
|
|
};
|
|
logging.loki.state-directory = "/state/services/loki";
|
|
metrics = {
|
|
prometheus.state-directory = "/state/services/prometheus";
|
|
grafana = {
|
|
state-directory = "/state/services/grafana";
|
|
database = {
|
|
user = "grafana";
|
|
password-file = host-secrets.grafana-postgres-password.target-file;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
postgresql = let
|
|
# cert-copy = host-certs.${host-fqdn}.local-copies.postgresql;
|
|
in {
|
|
# enable = true;
|
|
# ssl-certificate = cert-copy.full-certificate;
|
|
# ssl-private-key = cert-copy.private-key;
|
|
# keytab = host-secrets.postgres-keytab.target-file;
|
|
# local-networks = local-networks;
|
|
|
|
users = {
|
|
grafana = {
|
|
password-file = host-secrets.postgres-grafana-password.target-file;
|
|
databases.grafana = {
|
|
access = "CONNECT";
|
|
entity-access = {
|
|
"ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
|
|
# "SELECT,INSERT,UPDATE,DELETE";
|
|
"ALL SEQUENCES IN SCHEMA public" = "ALL PRIVILEGES";
|
|
# "SELECT, UPDATE";
|
|
};
|
|
};
|
|
};
|
|
|
|
gituser = {
|
|
password-file = host-secrets.postgres-gitea-password.target-file;
|
|
databases = {
|
|
git = {
|
|
access = "CONNECT";
|
|
entity-access = {
|
|
"ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
|
|
"ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
databases = {
|
|
grafana.users = config.instance.local-admins;
|
|
git.users = config.instance.local-admins;
|
|
};
|
|
};
|
|
|
|
git = {
|
|
enable = true;
|
|
hostname = "git.informis.land";
|
|
site-name = "informis git";
|
|
user = "gituser";
|
|
repository-dir = "/srv/git/repo";
|
|
state-dir = "/srv/git/state";
|
|
database = {
|
|
user = "gituser";
|
|
password-file = host-secrets.gitea-database-password.target-file;
|
|
hostname = "127.0.0.1";
|
|
name = "git";
|
|
};
|
|
ssh = {
|
|
listen-ip = host-ipv4;
|
|
listen-port = 2222;
|
|
};
|
|
};
|
|
};
|
|
}
|