115 lines
2.8 KiB
Nix
115 lines
2.8 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
hostname = "legatus";
|
|
host-ipv4 = "190.2.136.47";
|
|
domain-name = config.fudo.hosts.${hostname}.domain;
|
|
domain = config.fudo.domains.${domain-name};
|
|
site-name = config.fudo.hosts.${hostname}.site;
|
|
site = config.fudo.sites.${site-name};
|
|
|
|
local-packages = with pkgs; [ ldns.examples ];
|
|
|
|
host-secrets = config.fudo.secrets.host-secrets.${hostname};
|
|
|
|
in {
|
|
networking = {
|
|
enableIPv6 = true;
|
|
|
|
nameservers = [ "1.1.1.1" ];
|
|
defaultGateway = {
|
|
address = site.gateway-v4;
|
|
interface = "extif0";
|
|
};
|
|
|
|
interfaces.extif0.ipv4.addresses = [{
|
|
address = host-ipv4;
|
|
prefixLength = 24;
|
|
}];
|
|
};
|
|
|
|
# Getting errors due to running VMs
|
|
boot.kernel.sysctl."fs.inotify.max_user_instances" = 512;
|
|
|
|
security.acme.defaults.email = "admin@legatus.fudo.org";
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"L /etc/adjtime - - - - /state/etc/adjtime"
|
|
"d /state/services/podman/volumes 0700 root root - -"
|
|
"d /state/services/acme 0755 acme acme - -"
|
|
];
|
|
|
|
fileSystems = {
|
|
"/var/lib/acme" = {
|
|
device = "/state/services/acme";
|
|
options = [ "bind" ];
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = local-packages;
|
|
|
|
# informis.cl-gemini = {
|
|
# enable = true;
|
|
|
|
# hostname = "gemini.fudo.org";
|
|
# server-ip = host-ipv4;
|
|
# document-root = "/state/gemini/root";
|
|
# # textfiles-archive = "${pkgs.textfiles}";
|
|
# slynk-port = 4005;
|
|
# };
|
|
|
|
services = {
|
|
mastodonContainer.state-directory = "/state/services/mastodon";
|
|
authentikContainer.state-directory = "/state/services/authentik";
|
|
nextcloudContainer.state-directory = "/state/services/nextcloud";
|
|
};
|
|
|
|
virtualisation = {
|
|
arion.backend = "podman-socket";
|
|
podman = {
|
|
enable = true;
|
|
dockerSocket.enable = true;
|
|
autoPrune.enable = true;
|
|
defaultNetwork.settings.dns_enabled = true;
|
|
};
|
|
};
|
|
|
|
fudo = {
|
|
hosts.legatus.external-interfaces = [ "extif0" ];
|
|
|
|
services = {
|
|
auth = {
|
|
ldap.state-directory = "/state/services/ldap";
|
|
kerberos.state-directory = "/state/services/heimdal-kdc";
|
|
};
|
|
|
|
chat = {
|
|
state-directory = "/state/services/chat";
|
|
external-interface = "extif0";
|
|
};
|
|
|
|
nexus.dns-server.listen-addresses = [ host-ipv4 ];
|
|
};
|
|
|
|
client.dns = {
|
|
ipv4 = true;
|
|
ipv6 = true;
|
|
user = "fudo-client";
|
|
external-interface = "extif0";
|
|
};
|
|
|
|
secure-dns-proxy = {
|
|
enable = true;
|
|
upstream-dns =
|
|
[ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
|
|
bootstrap-dns = "1.1.1.1";
|
|
listen-ips = [ "127.0.0.1" ];
|
|
listen-port = 53;
|
|
allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
|
|
};
|
|
|
|
dns.state-directory = "/state/nsd";
|
|
};
|
|
}
|