nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Partway to getting France back in the fold. Stuck on ACME certs.

Browse Source
This commit is contained in:
niten
2021-10-28 09:32:35 -07:00
parent 81aae5cd8d
commit 08766dfeb6
37 changed files with 1399 additions and 441 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/domains.nix
+2 -2
View File
@@ -13,7 +13,7 @@
};
"sea.fudo.org" = {
local-networks = [ "10.0.0.0/24" ];
local-networks = [ "10.0.0.0/16" ];
local-users = [ "niten" "reaper" "xiaoxuan" "ken" ];
local-groups = [ "fudo" "selby" "admin" ];
@@ -23,7 +23,7 @@
};
"rus.selby.ca" = {
local-networks = [ "10.0.0.0/24" ];
local-networks = [ "10.0.0.0/16" ];
local-users = [
"niten"
config/hardware/zbox.nix
+59 -11
View File
@@ -1,27 +1,59 @@
{ config, lib, pkgs, ... }:
{
{
boot = {
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
initrd = {
availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" ];
availableKernelModules =
[ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
kernelModules = [ ];
};
kernelModules = [ "kvm-intel" ];
kernelPackages = pkgs.linuxPackages_latest;
extraModulePackages = [ ];
};
fileSystems."/" = {
device = "/dev/disk/by-label/zbox-root";
fsType = "btrfs";
};
system.stateVersion = "21.05";
fileSystems."/boot" = {
device = "/dev/disk/by-label/BOOT";
fsType = "vfat";
fileSystems = {
"/" = {
device = "zbox-root";
fsType = "tmpfs";
options = [ "mode=755" ];
};
"/boot" = {
device = "/dev/disk/by-label/ZBOX-BOOT";
fsType = "vfat";
options = [ "noexec" "noatime" "nodiratime" ];
};
"/state" = {
device = "/dev/disk/by-label/zbox-data";
fsType = "btrfs";
options = [ "noatime" "nodiratime" "compress=zstd" "noexec" "subvol=@state" ];
};
"/nix" = {
device = "/dev/disk/by-label/zbox-data";
fsType = "btrfs";
options = [ "noatime" "nodiratime" "compress=zstd" "subvol=@nix" ];
};
"/var/log" = {
device = "/dev/disk/by-label/zbox-data";
fsType = "btrfs";
options = [ "noatime" "nodiratime" "compress=zstd" "noexec" "subvol=@logs" ];
};
"/home" = {
device = "/dev/disk/by-label/zbox-data";
fsType = "btrfs";
options = [ "noatime" "nodiratime" "compress=zstd" "noexec" "subvol=@home" ];
};
};
swapDevices = [{ device = "/dev/disk/by-label/zbox-swap"; }];
@@ -34,14 +66,23 @@
opengl = {
driSupport = true;
driSupport32Bit = true;
# extraPackages32 = with pkgs.i686Linux; [ libva ];
extraPackages = with pkgs; [
rocm-opencl-icd
rocm-opencl-runtime
amdvlk
driversi686Linux.amdvlk
];
setLdLibraryPath = true;
};
pulseaudio = {
support32Bit = true;
package = pkgs.pulseaudioFull;
};
enableRedistributableFirmware = true;
enableAllFirmware = true;
};
networking = {
@@ -64,4 +105,11 @@
nix.maxJobs = lib.mkDefault 8;
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
systemd.targets = {
sleep.enable = false;
suspend.enable = false;
hibernate.enable = false;
hybrid-sleep.enable = false;
};
}
config/host-config/clunk.nix
+1 -1
View File
@@ -65,7 +65,7 @@ in {
useDHCP = false;
ipv4.addresses = [{
address = primary-ip;
prefixLength = 22;
prefixLength = 16;
}];
};
};
config/host-config/france.nix
+35 -104
View File
@@ -1,5 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
let
primary-ip = "208.81.3.117";
git-server-ip = "208.81.3.118";
@@ -9,131 +10,61 @@ let
host-fqdn = "${hostname}.${domain-name}";
mail-hostname = "mail.fudo.org";
france-secrets = config.fudo.secrets.host-secrets.france;
acme-private-key = hostname: "/var/lib/acme/${hostname}/key.pem";
acme-certificate = hostname: "/var/lib/acme/${hostname}/fullchain.pem";
in {
imports = [ ./france/postgresql.nix ];
imports = let
is-regular-file = filename: type: type == "regular" || type == "link";
regular-files = path:
attrNames (filterAttrs is-regular-file (builtins.readDir path));
is-nix-file = filename: (builtins.match "^(.+)\.nix$" filename) != null;
nix-files = path:
map
(file: path + "/${file}")
(filter is-nix-file (regular-files path));
in nix-files ./france;
config = {
fudo = {
auth = {
ldap = {
enable = true;
base = "dc=fudo,dc=org";
organization = "Fudo";
rootpw-file = "FIXME";
kerberos-host = host-fqdn;
kerberos-keytab = "FIXME";
sslCert = "FIXME";
sslKey = "FIXME";
sslCaCert = "FIXME";
listen-uris = [ "ldap:///" "ldaps:///" "ldapi:///" ];
users = config.fudo.users;
groups = config.fudo.groups;
system-users = config.fudo.system-users;
};
kdc = let realm = "FUDO.ORG";
in {
enable = true;
database-path = "FIXME";
realm = realm;
mkey-file = "FIXME";
acl = [
{
principal = "pam_migrate/*.fudo.org@${realm}";
access = "add";
}
{
principal = "host/*.fudo.org@${realm}";
access = "add";
}
] ++ (concatMap (user: [
{
principal = "${user}@${realm}";
access = "add,list,modify";
}
{
principal = "${user}/root@${realm}";
access = "all";
}
]) domain.admin-users);
bind-addresses = [ primary-ip "127.0.0.1" "127.0.1.1" "::1" ];
};
};
prometheus = {
enable = true;
hostname = "metrics.fudo.org";
service-discovery-dns = let dns-root = "_metrics._tcp.fudo.org";
in {
node = [ "node.${dns-root}" ];
postfix = [ "postfix.${dns-root}" ];
dovecot = [ "dovecot.${dns-root}" ];
rspamd = [ "rspamd.${dns-root}" ];
};
};
postgresql = {
enable = true;
# FIXME: ssl-private-key && ssl certificate
keytab = "/srv/postgres/secure/postgres.keytab";
local-networks = getHostLocalNetworks hostname;
admin-users = domain.admin-users;
};
hosts.france.external-interfaces = [ "extif0" ];
client.dns = {
enable = true;
ipv4 = true;
ipv6 = true;
user = "FIXME";
user = "fudo-client";
external-interface = "extif0";
password-file = "FIXME";
};
mail-server = domain.mail-config // {
enableContainer = true;
monitoring = true;
hostname = mail-hostname;
state-directory = "FIXME";
mail-directory = "FIXME";
dovecot.ldap = {
reader-dn = "FIXME";
reader-password = "FIXME";
server-urls = [ "FIXME" ];
france = {
mail = {
mail-directory = "/state/mail-server/mail";
state-directory = "/state/mail-server/var";
ldap-server-urls = [
"ldap://france.fudo.org"
];
};
clamav.enable = true;
dkim.signing = true;
};
git = {
enable = true;
hostname = "git.fudo.org";
site-name = "Fudo Git";
user = "FIXME";
database = {
user = "FIXME";
password-file = "FIXME";
hostname = "127.0.0.1";
name = "FIXME";
webmail = {
# TODO: this is not using the database!
mail-server = mail-hostname;
database.hostname = "localhost";
};
repository-dir = "FIXME";
state-dir = "FIXME";
ssh = {
listen-ip = git-server-ip;
listen-port = 22;
git = {
repository-directory = "/state/gitea/repo";
state-directory = "/state/gitea/state";
ssh.listen-ip = git-server-ip;
};
};
minecraft-server = {
enable = true;
package = pkgs.minecraft-current;
data-dir = "FIXME";
data-dir = "/state/minecraft/selbyland";
world-name = "selbyland";
motd = "Welcome to the Selby Minecraft server.";
};
config/host-config/france/auth.nix
+117
View File
@@ -0,0 +1,117 @@
{ config, lib, pkgs, ... }:
with lib;
let
hostname = config.instance.hostname;
domain-name = config.instance.local-domain;
site-name = config.instance.local-site;
fqdn = "${hostname}.${domain-name}";
secrets = config.fudo.secrets.host-secrets.france;
# same as genAttr, but takes back attrsets and merges them
concatGenAttrs = lst: f:
foldr (a0: a1: a0 // a1) {} (map f lst);
in {
options.france = with types; {
ldap = {
ssl-certificate = mkOption {
type = path;
description = "SSL certificate to use for the LDAP server.";
};
ssl-private-key = mkOption {
type = path;
description = "SSL private key to use for the LDAP server.";
};
ssl-ca-certificate = mkOption {
type = path;
description = "SSL certificate authority to use for the LDAP server.";
};
};
kdc = {
state-directory = mkOption {
type = str;
description = "Path at which to store kerberos state.";
};
master-key-file = mkOption {
type = str;
description = "Heimdal database master key file.";
};
};
};
config = {
fudo = {
secrets.host-secrets.${hostname} = {
ldap-ssl-certificate = {
source-file = cfg.ssl-certificate;
target-file = "/var/run/ldap/ssl-certificate.pem";
user = config.services.openldap.user;
group = config.services.openldap.group;
permissions = "0444";
};
ldap-ssl-private-key = {
source-file = cfg.ssl-private-key;
target-file = "/var/run/ldap/ssl-private-key.pem";
user = config.services.openldap.user;
group = config.services.openldap.group;
permissions = "0400";
};
ldap-ssl-ca-certificate = {
source-file = cfg.ssl-ca-certificate;
target-file = "/var/run/ldap/ssl-ca-certificate.pem";
user = config.services.openldap.user;
group = config.services.openldap.group;
permissions = "0400";
};
};
auth = {
ldap = {
enable = true;
base = "dc=fudo,dc=org";
organization = "Fudo";
rootpw-file = secrets.ldap-root-passwd;
kerberos-host = fqdn;
kerberos-keytab = secrets.ldap-keytab;
sslCert =
secrets.ldap-ssl-certificate.target-file;
sslKey =
secrets.ldap-ssl-private-key.target-file;
sslCACert =
secrets.ldap-ssl-ca-certificate.target-file;
listen-uris = [ "ldap:///" "ldaps:///" "ldapi:///" ];
users = config.fudo.users;
groups = config.fudo.groups;
system-users = config.fudo.system-users;
};
# TODO: let build hosts create keys?
kdc = {
enable = true;
realm = config.domains.${domain-name}.gssapi-realm;
state-directory = cfg.state-directory;
master-key-file = cfg.master-key-file;
acl = let
admin-entries = concatGenAttrs
config.instance.local-admins
(admin: {
"${admin}" = { perms = [ "add" "list" "change-password" ]; };
"${admin}/root" = { perms = [ "all" ]; };
});
in {
"host/*.fudo.org" = { perms = [ "add" ]; };
"pam_migrate/*.fudo.org" = { perms = [ "add" "change-password" ]; };
} // admin-entries;
bind-addresses = [ primary-ip "127.0.0.1" "127.0.1.1" "::1" ];
};
};
};
};
}
config/host-config/france/git.nix
+87
View File
@@ -0,0 +1,87 @@
{ config, lib, pkgs, ... }:
with lib;
let
hostname = config.instance.hostname;
domain-name = config.instance.local-domain;
secrets = config.fudo.secrets.host-secrets.${hostname};
sshOpts = { ... }: {
options = {
listen-ip = mkOption {
type = str;
description = "IP address on which to listen for SSH connections.";
};
listen-port = mkOption {
type = str;
description = "Port on which to listen for SSH connections.";
default = 22;
};
};
};
in {
options.france.git = with types; {
repository-directory = mkOption {
type = str;
description = "Path to store git repositories.";
};
state-directory = mkOption {
type = str;
description = "Path to store git server state.";
};
database-host = mkOption {
type = str;
description = "PostGreSQL database host.";
};
ssh = mkOption {
type = submodule sshOpts;
description = "Git SSH listen options.";
};
};
config.fudo = {
postgresql = {
databases.fudo_git.users =
config.instance.local_admins;
users.fudo_git = {
password-file =
secrets.git-database-password.target-file;
databases = {
fudo_git = {
access = "CONNECT";
entity-access = {
"ALL TABLES IN SCHEMA public" =
"SELECT,INSERT,UPDATE,DELETE";
"ALL SEQUENCES IN SCHEMA public" =
"SELECT, UPDATE";
};
};
};
};
};
git = {
enable = true;
hostname = "git.${domain-name}";
site-name = "Fudo Git";
user = "git-fudo";
repository-dir = cfg.repository-directory;
state-dir = cfg.state-directory;
database = {
user = "fudo_git";
password-file =
secrets.git-database-password.target-file;
hostname = cfg.database-host;
name = "fudo_git";
};
ssh = {
listen-ip = cfg.ssh.listen-ip;
listen-port = cfg.ssh.listen-port;
};
};
};
}
config/host-config/france/jabber.nix
+110
View File
@@ -0,0 +1,110 @@
{ config, lib, pkgs, ... }:
with lib;
let
hostname = config.instance.hostname;
secrets = config.fudo.secrets.host-secrets.${hostname};
in {
config = {
fudo = {
jabber = {
enable = true;
secret-files = {
LDAP_PASSWORD = secrets.jabber-ldap-password.target-file;
};
sites = {
"fudo.im" = {
site-config = {
auth_method = "ldap";
ldap_servers = [ "auth.fudo.org" ];
ldap_port = 389;
ldap_rootdn = "cn=jabber,dc=fudo,dc=org";
ldap_password = ''"LDAP_PASSWD"'';
ldap_base = "ou=members,dc=fudo,dc=org";
ldap_filter = "(objectClass=posixAccount)";
ldap_uids = { uid = "%u"; };
modules = {
mod_adhoc = {};
mod_announce = {};
mod_avatar = {};
mod_blocking = {};
mod_caps = {};
mod_carboncopy = {};
mod_client_state = {};
mod_configure = {};
mod_disco = {};
mod_fail2ban = {};
mod_last = {};
mod_offline = {
access_max_user_messages = 5000;
};
mod_ping = {};
mod_privacy = {};
mod_private = {};
mod_pubsub = {
access_createnode = "pubsub_createnode";
ignore_pep_from_offline = true;
last_item_cache = false;
plugins = [
"flat"
"pep"
];
};
mod_roster = {};
mod_stream_mgmt = {};
mod_time = {};
mod_vcard = {
search = false;
};
mod_vcard_xupdate = {};
mod_version = {};
};
};
};
"backplane.fudo.org" = {
site-config = {
auth_method = "external";
extauth_program = "${pkgs.guile}/bin/guile -s ${backplane-auth}";
extauth_pool_size = 3;
auth_use_cache = true;
modules = {
mod_adhoc = {};
mod_caps = {};
mod_carboncopy = {};
mod_client_state = {};
mod_configure = {};
mod_disco = {};
mod_fail2ban = {};
mod_last = {};
mod_offline = {
access_max_user_messages = 5000;
};
mod_ping = {};
mod_pubsub = {
access_createnode = "pubsub_createnode";
ignore_pep_from_offline = true;
last_item_cache = false;
plugins = [
"flat"
"pep"
];
};
mod_roster = {};
mod_stream_mgmt = {};
mod_time = {};
mod_version = {};
};
};
};
};
};
};
};
}
config/host-config/france/mail-server.nix
+57
View File
@@ -0,0 +1,57 @@
{ config, lib, pkgs, ... }:
with lib;
let
hostname = config.instance.hostname;
domain-name = config.instance.local-domain;
secrets = config.fudo.secrets.host-secrets.${hostname};
mail-reader-dn = "mail-auth-reader";
in {
options.france.mail = with types; {
mail-directory = mkOption {
type = str;
description = "Directory to contain user maildirs.";
};
state-directory = mkOption {
type = str;
description = "Directory to contain mail-server state.";
};
ldap-server-urls = mkOption {
type = listOf str;
description = "List of LDAP server URLs.";
};
};
config.fudo = {
system-users = {
username = mail-reader-dn;
description = "Used by the mail server to connect to LDAP for auth.";
ldap-hashed-password =
pkgs.lib.fudo.passwd.hash-ldap-passwd
secrets.mail-reader-passwd.target-file;
};
mail-server = {
enableContainer = true;
monitoring = true;
hostname = "mail.${domain-name}";
state-directory = cfg.state-directory;
mail-directory = cfg.mail-directory;
dovecot.ldap = {
reader-dn = "cn=mail-reader-dn,${config.fudo.auth.ldap.base}";
reader-password-file = secrets.mail-reader-passwd.target-file;
server-urls = cfg.ldap-server-urls;
};
clamav.enable = true;
dkim.signing = true;
};
};
}
config/host-config/france/monitoring.nix
+19
View File
@@ -0,0 +1,19 @@
{ config, lib, pkgs, ... }:
with lib;
let
domain-name = config.instance.local-domain;
in {
config.fudo.prometheus = {
enable = true;
hostname = "metrics.${domain-name}";
service-discovery-dns = let
srv-dns = "_metrics._tcp.${domain-name}";
in {
node = [ "node.${srv-dns}" ];
postfix = [ "postfix.${srv-dns}" ];
dovecot = [ "dovecot.${srv-dns}" ];
rspamd = [ "rspamd.${srv-dns}" ];
};
};
}
config/host-config/france/postgres.nix
+18
View File
@@ -0,0 +1,18 @@
{ config, lib, pkgs, ... }:
with lib;
let
hostname = config.instance.hostname;
secrets = config.fudo.secrets.host-secrets.${hostname};
in {
config.fudo.postgresql = {
enable = true;
local-networks = config.instance.local-networks;
admin-users = config.instance.admin-users;
ssl-private-key = secrets.postgres-ssl-key;
ssl-certificate = secrets.postgres-ssl-certificate;
keytab = secrets.postgres-keytab.target-file;
};
}
config/host-config/france/webmail.nix
+100
View File
@@ -0,0 +1,100 @@
{ config, lib, pkgs, ... }:
with lib;
let
hostname = config.instance.hostname;
domain-name = config.instance.local-domain;
site-name = config.instance.local-site;
secrets = config.fudo.secrets.host-secrets.${hostname};
static = config.fudo.static;
mail-hostname = config.france.webmail.mail-server;
db-host = config.france.webmail.database.hostname;
db-passwd = pkgs.lib.fudo.passwd.random-passwd-file "webmail" 40;
in {
options.france.webmail = with types; {
mail-server = mkOption {
type = str;
description = "Mail server to use for webmail.";
};
database = {
hostname = mkOption {
type = str;
description = "PostgreSQL server.";
};
};
};
config.fudo = {
webmail = {
enable = true;
sites = {
"webmail.fudo.link" = {
title = "Fudo Link Webmail";
favicon = "${static}/fudo.link/favicon.ico";
mail-server = mail-hostname;
domain = "fudo.link";
edit-mode = "Plain";
layout-mode = "bottom";
database = {
hostname = db-host;
password-file = db-passwd;
};
};
"webmail.test.fudo.org" = {
title = "Fudo Webmail";
favicon = "${static}/fudo.org/favicon.ico";
mail-server = mail-hostname;
domain = "fudo.org";
edit-mode = "Plain";
database = {
hostname = db-host;
password-file = db-passwd;
};
};
"webmail.fudo.org" = {
title = "Fudo Webmail";
favicon = "${static}/fudo.org/favicon.ico";
mail-server = mail-hostname;
domain = "fudo.org";
edit-mode = "Plain";
database = {
hostname = db-host;
password-file = db-passwd;
};
};
"webmail.test.selby.ca" = {
title = "Selby Webmail";
favicon = "${static}/selby.ca/favicon.ico";
mail-server = mail-hostname;
domain = "selby.ca";
database = {
hostname = db-host;
password-file = db-passwd;
};
};
"webmail.selby.ca" = {
title = "Selby Webmail";
favicon = "${static}/selby.ca/favicon.ico";
mail-server = mail-hostname;
domain = "selby.ca";
database = {
hostname = db-host;
password-file = db-passwd;
};
};
};
};
};
}
config/host-config/limina.nix
+1 -1
View File
@@ -22,7 +22,7 @@ in {
useDHCP = false;
ipv4.addresses = [{
address = primary-ip;
prefixLength = 22;
prefixLength = 16;
}];
};
intif1 = { useDHCP = false; };
config/host-config/nostromo.nix
+6 -20
View File
@@ -22,25 +22,6 @@ in {
# Hopefully this'll help with NFS...
boot.kernelModules = [ "rpcsec_gss_krb5" ];
fudo.hosts.nostromo.encrypted-filesystems.sea-store = {
encrypted-device = "/dev/nostromo-store/locked";
key-path = "/run/keys/sea-store";
filesystem-type = "btrfs";
options = [ "noatime" "nodiratime" "compress=zstd" "noexec" ];
mountpoints = {
"/export/documents" = {
options = [ "subvol=@documents" ];
group = "sea-documents";
users = [ "niten" ];
};
"/export/downloads" = {
options = [ "subvol=@downloads" ];
group = "sea-downloads";
users = [ "niten" ];
};
};
};
services.nfs = {
# See lib/fudo/users.nix for the user@REALM -> user mapping
server = {
@@ -50,6 +31,7 @@ in {
exportList = [
"/export/documents 10.0.0.0/24(rw,sync,no_root_squash,no_subtree_check,fsid=10,sec=krb5p)"
"/export/downloads 10.0.0.0/24(rw,sync,no_root_squash,no_subtree_check,fsid=11,sec=krb5i)"
"/export/projects 10.0.0.0/24(rw,sync,no_root_squash,no_subtree_check,fsid=11,sec=krb5p)"
];
in ''
${concatStringsSep "\n" exportList}
@@ -61,7 +43,11 @@ in {
# Don't start on boot
wantedBy = mkForce [ "sea-store.target" ];
# Only start after filesystem mounts are available
after = [ "export-documents.mount" "export-downloads.mount" ];
after = [
"export-documents.mount"
"export-downloads.mount"
"export-projects.mount"
];
};
fudo.ipfs = {
config/host-config/plato.nix
+1 -1
View File
@@ -16,7 +16,7 @@ in {
useDHCP = false;
ipv4.addresses = [{
address = primary-ip;
prefixLength = 22;
prefixLength = 16;
}];
};
};
config/host-config/procul.nix
+79 -18
View File
@@ -5,12 +5,14 @@ let
hostname = "procul";
host-ipv4 = "172.86.179.18";
git-ipv4 = "172.86.179.19";
domain = config.fudo.hosts.${hostname}.domain;
site = config.fudo.hosts.${hostname}.site;
host-fqdn = "${hostname}.${domain}";
domain-name = config.fudo.hosts.${hostname}.domain;
domain = config.fudo.domains.${domain-name};
site-name = config.fudo.hosts.${hostname}.site;
site = config.fudo.sites.${site-name};
host-fqdn = "${hostname}.${domain-name}";
local-networks = config.fudo.domains.${domain}.local-networks
++ config.fudo.sites.${site}.local-networks;
local-networks =
domain.local-networks ++ site.local-networks;
acme-private-key = hostname: "/var/lib/acme/${hostname}/key.pem";
acme-certificate = hostname: "/var/lib/acme/${hostname}/fullchain.pem";
@@ -18,6 +20,8 @@ let
local-packages = with pkgs; [ ldns.examples ];
secrets = config.fudo.secrets.host-secrets.procul;
in {
networking = {
dhcpcd.enable = false;
@@ -26,9 +30,9 @@ in {
enableIPv6 = true;
# FIXME: this isn't the right place
search = [ domain ];
search = [ domain-name ];
nameservers = [ "127.0.0.1" ];
defaultGateway = "172.86.179.17";
defaultGateway = site.gateway-v4;
interfaces = {
extif0 = {
@@ -81,6 +85,64 @@ in {
fudo = {
hosts.procul.external-interfaces = [ "extif0" ];
jabber = {
enable = true;
secret-files = {
SECRET = secrets.jabber-ldap-password.traget-file;
};
sites."informis.land" = {
site-config = {
auth_method = "ldap";
ldap_servers = [ "auth.fudo.org" ];
ldap_port = 636;
ldap_rootdn = "cn=jabber,dc=fudo,dc=org";
ldap_password = ''"LDAP_PASSWD"'';
ldap_base = "ou=members,dc=fudo,dc=org";
ldap_filter = "(objectClass=posixAccount)";
ldap_uids = { uid = "%u"; };
modules = {
mod_adhoc = {};
mod_announce = {};
mod_avatar = {};
mod_blocking = {};
mod_caps = {};
mod_carboncopy = {};
mod_client_state = {};
mod_configure = {};
mod_disco = {};
mod_fail2ban = {};
mod_last = {};
mod_offline = {
access_max_user_messages = 5000;
};
mod_ping = {};
mod_privacy = {};
mod_private = {};
mod_pubsub = {
access_createnode = "pubsub_createnode";
ignore_pep_from_offline = true;
last_item_cache = false;
plugins = [
"flat"
"pep"
];
};
mod_roster = {};
mod_stream_mgmt = {};
mod_time = {};
mod_vcard = {
search = false;
};
mod_vcard_xupdate = {};
mod_version = {};
};
};
};
};
secrets.host-secrets.procul = let
secrets = config.fudo.secrets.files;
in {
@@ -157,7 +219,7 @@ in {
enable = true;
debug = true;
domain = domain;
domain = domain-name;
hostname = "${host-fqdn}";
monitoring = false;
mail-user = "mailuser";
@@ -167,17 +229,17 @@ in {
dkim.signing = true;
dovecot = {
ssl-certificate = acme-certificate "imap.${domain}";
ssl-private-key = acme-private-key "imap.${domain}";
ssl-certificate = acme-certificate "imap.${domain-name}";
ssl-private-key = acme-private-key "imap.${domain-name}";
};
postfix = {
ssl-certificate = acme-certificate "smtp.${domain}";
ssl-private-key = acme-private-key "smtp.${domain}";
ssl-certificate = acme-certificate "smtp.${domain-name}";
ssl-private-key = acme-private-key "smtp.${domain-name}";
};
# This should NOT include the primary domain
local-domains = [ host-fqdn "smtp.${domain}" ];
local-domains = [ host-fqdn "smtp.${domain-name}" ];
mail-directory = "/srv/mailserver/mail";
state-directory = "/srv/mailserver/state";
@@ -199,14 +261,13 @@ in {
enable = true;
ssl-certificate = (acme-certificate host-fqdn);
ssl-private-key = (acme-private-key host-fqdn);
keytab =
config.fudo.secrets.host-secrets.procul.postgres-keytab.target-file;
keytab = secrets.postgres-keytab.target-file;
local-networks = local-networks;
users = {
gituser = {
password-file =
config.fudo.secrets.host-secrets.procul.gitea-database-password.target-file;
secrets.gitea-database-password.target-file;
databases = {
git = {
access = "CONNECT";
@@ -232,7 +293,7 @@ in {
database = {
user = "gituser";
password-file =
config.fudo.secrets.host-secrets.procul.gitea-database-password.target-file;
secrets.gitea-database-password.target-file;
hostname = "127.0.0.1";
name = "git";
};
@@ -244,7 +305,7 @@ in {
acme = {
enable = true;
admin-address = "admin@${domain}";
admin-address = "admin@${domain-name}";
hostnames = [
"informis.land"
"imap.informis.land"
config/host-config/socrates.nix
+1 -1
View File
@@ -17,7 +17,7 @@ in {
interfaces.intif0 = {
ipv4.addresses = [{
address = primary-ip;
prefixLength = 22;
prefixLength = 16;
}];
};
};
config/host-config/spark.nix
+14 -12
View File
@@ -1,19 +1,21 @@
{ config, lib, pkgs, ... }:
{
fudo.slynk.enable = true;
config = {
fudo.slynk.enable = true;
networking = {
interfaces = {
extif0 = { useDHCP = true; };
networking = {
interfaces = {
extif0 = { useDHCP = true; };
};
};
i18n.inputMethod = {
enabled = "fcitx5";
fcitx5.addons = with pkgs; [
fcitx5-chinese-addons
fcitx5-rime
];
};
};
i18n.inputMethod = {
enabled = "fcitx5";
fcitx5.addons = with pkgs; [
fcitx5-chinese-addons
fcitx5-rime
];
};
}
config/host-config/zbox.nix
+14 -14
View File
@@ -1,22 +1,22 @@
{ config, lib, pkgs, ... }:
{
system.stateVersion = "20.09";
config = {
fudo.slynk.enable = true;
# TODO: remove?
nixpkgs.config.permittedInsecurePackages = [
"openssh-with-gssapi-8.4p1" # CVE-2021-28041
];
environment.systemPackages = with pkgs; [ opencv-java ];
fudo.slynk.enable = true;
environment.systemPackages = with pkgs; [ opencv-java ];
networking = {
useDHCP = false;
interfaces = {
eno1.useDHCP = false;
intif0 = { useDHCP = true; };
networking = {
useDHCP = false;
interfaces.intif0.useDHCP = true;
};
i18n.inputMethod = {
enabled = "fcitx5";
fcitx5.addons = with pkgs; [
fcitx5-chinese-addons
fcitx5-rime
];
};
};
}
config/hosts/france.nix
+14 -10
View File
@@ -1,20 +1,24 @@
{
description = "Primary fudo.org server.";
docker-server = true;
# ssh-fingerprints = [
# "1 1 1b6d62dafae9ebc59169dfb4ef828582a5450d94"
# "1 2 079e7a57873542541095bf3d2f97b7350bb457d027b423a6fb56f7f6aa84ac80"
# "4 1 c95a198f504a589fc62893a95424b12f0b24732d"
# "4 2 3e7dad879d6cab7f7fb6769e156d7988d0c01281618d03b793834eea2f09bc96"
# ];
rp = "admin";
admin-email = "admin@fudo.org";
domain = "fudo.org";
site = "portage";
profile = "server";
# ssh-pubkey =
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1COad5NSK3mi66WK5uWf79NLMf5rk350kvJGsEdDmn";
arch = "x86_64-linux";
# Just to stop this evaluating for now
nixos-system = false;
machine-id = "d33245603a854e48ba90002639e063f8";
nixos-system = true;
master-key = {
public-key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMQyRAJQpFaBanQKdu3SWCu0mjqSdF7WC1WNdKdQ1edQ";
key-path = "/state/master-key/ed25519-key";
};
initrd-network = {
ip = "208.81.3.117";
interface = "enp4s0f0";
keypair = {
public-key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOAooY0j3xhs3PS5vFDXya1ljjo7fFXT98HDICVa3yBl";
private-key-file = "/state/ssh/initrd/ssh_ed25519_key";
};
};
}
config/hosts/nostromo.nix
+23
View File
@@ -22,4 +22,27 @@
key-path = "/state/master-key/key";
};
# initrd-ip = "10.0.5.10";
encrypted-filesystems.sea-store = {
encrypted-device = "/dev/nostromo-store/locked";
key-path = "/run/keys/sea-store";
filesystem-type = "btrfs";
options = [ "noatime" "nodiratime" "compress=zstd" "noexec" ];
mountpoints = {
"/export/documents" = {
options = [ "subvol=@documents" ];
group = "sea-documents";
users = [ "niten" ];
};
"/export/downloads" = {
options = [ "subvol=@downloads" ];
group = "sea-downloads";
users = [ "niten" ];
};
"/export/projects" = {
options = [ "subvol=@projects" ];
group = "sea-projects";
users = [ "niten" ];
};
};
};
}
config/networks/fudo.org.nix
-2
View File
@@ -1,5 +1,3 @@
{ config, lib, ... }:
{
mx = [ "mail.fudo.org" ];
config/site-config/seattle.nix
+43 -32
View File
@@ -37,44 +37,55 @@ in {
fsType = "nfs4";
options = [ "comment=systemd.automount" ];
};
"/net/documents" = {
device = "sea-store.${local-domain}:/export/documents";
fsType = "nfs";
options = [
"nfsvers=4.2"
"comment=systemd.automount"
"sec=krb5p"
# "noauto" ?
];
device = "sea-store.sea.fudo.org:/export/documents";
fsType = "nfs4";
options = [ "comment=systemd.automount" "sec=krb5p" ];
};
"/net/downloads" = {
device = "sea-store.${local-domain}:/export/downloads";
fsType = "nfs";
options = [
"nfsvers=4.2"
"comment=systemd.automount"
"sec=krb5i"
# "noauto" ?
];
device = "sea-store.sea.fudo.org:/export/downloads";
fsType = "nfs4";
options = [ "comment=systemd.automount" "sec=krb5i" ];
};
"/net/projects" = {
device = "sea-store.sea.fudo.org:/export/projects";
fsType = "nfs4";
options = [ "comment=systemd.automount" "sec=krb5p" ];
};
};
# systemd.mounts = [
# {
# what = "sea-store.sea.fudo.org:/export/documents";
# where = "/net/documents";
# type = "nfs4";
# options = "sec=krb5p";
# description = "sea-store documents on encrypted filesysem.";
# }
# {
# what = "sea-store.sea.fudo.org:/export/downloads";
# where = "/net/downloads";
# type = "nfs4";
# options = "sec=krb5i";
# description = "sea-store downloads on encrypted filesysem.";
# }
# ];
systemd = {
tmpfiles.rules = [
"d /net/documents - root sea-documents - -"
"d /net/downloads - root sea-downloads - -"
"d /net/projects - root sea-projects - -"
];
# mounts = [
# {
# what = "sea-store.sea.fudo.org:/export/documents";
# where = "/net/documents";
# type = "nfs4";
# options = "sec=krb5p";
# description = "sea-store documents on encrypted filesysem.";
# }
# {
# what = "sea-store.sea.fudo.org:/export/downloads";
# where = "/net/downloads";
# type = "nfs4";
# options = "sec=krb5i";
# description = "sea-store downloads on encrypted filesysem.";
# }
# {
# what = "sea-store.sea.fudo.org:/export/projects";
# where = "/net/projects";
# type = "nfs4";
# options = "sec=krb5p";
# description = "sea-store projects on encrypted filesysem.";
# }
# ];
};
services.printing = {
enable = true;
config/sites.nix
+18 -41
View File
@@ -8,58 +8,34 @@
network = "10.0.0.0/16";
dynamic-network = "10.0.100.0/24";
timezone = "America/Los_Angeles";
gateway-host = "nostromo";
deploy-pubkeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPwh522lvafTJYA0X2uFdP7Ws+Um1f8gZsARK1Y5nMzf6ZcWBF1jplTOKUVSOl4isMWni0Tu0TnX4zqCcgocWUVbwIwXSIRYqdiCPvVOH+/Ibc97n1/dYxk5JPMtbrsEw6/gWZxVg0qwe0J3dQWldEMiDY7iWhlrmIr7YL+Y3PUd7DOwp3PbfWfNyzTfE1kXcz5YvTeN+txFhbbXT0oS2R2wtc1vYXFZ/KbNstjqd+i8jszAq3ZkbbwL3aNR0RO4n8+GoIILGw8Ya4eP7D6+mYk608IhAoxpGyMrUch2TC2uvOK3rd/rw1hsTxf4AKjAZbrfd/FJaYru9ZeoLjD4bRGMdVp56F1m7pLvRiWRK62pV2Q/fjx+4KjHUrgyPd601eUIP0ayS/Rfuq8ijLpBJgO5/Y/6mFus/kjZIfRR9dXfLM67IMpyEzEITYrc/R2sedWf+YHxSh6eguAZ/kLzioar1nHLR7Wzgeu0tgWkD78WQGjpXGoefAz3xHeBg3Et0="
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDGVez4of30f+j0cWKj5kYCKeFjyNsYvG9UbOMxF5hImD2lP5MSbFBv31gFgHjx3yCG4zQRZlpuyU5uWo0qIwe9N84/LcZcB9WrWKZXDmuof7zPFy0J+Hj+LVLDQI/mVXHNwkMhBMHpPrdwA05EYDAYCYklWT4cSByu10pHtST+olF8i+A+UQgUzgNZzdJVeiYZv6MBDTYsJWptGeDUkl2B0Es3gtbGYcCCfnyS3RC7DIXlDo3NBbAr7WaHY2MBbT+R/+jicn9E3IY3NCM5jENxqmvHy9MDsxEEYgFNm7IDwq4V1VRUWy277YsvRbmEaHb+osOA5u1VNN4z3UftOZcSZgR5C/vR71cENXoPt1YQpCzu7i38ojtvL+tDVEKT7sIovrQw8q1sszNlW2nXh8RSPiIq5TMnrV73MP0egKcr9n3tfxwi1BIkLjvfom/02BkTK9R9v+VMNhYU1YwROhORCiMIgoxUGiUvtH8u38JGr7E0hhMoAjCE5k80WPUivl0="
];
build-servers = {
nostromo = {
max-jobs = 4;
speed-factor = 2;
};
lambda = {
max-jobs = 4;
speed-factor = 2;
};
};
enable-distributed-builds = false;
keytab-path = "/state/secrets/kerberos";
build-key-path = "/state/secrets/build-keys";
# FIXME: good idea?
# network-mounts = {
# "/mnt/documents" = {
# device = "whitedwarf:/volume1/Documents";
# fsType = "nfs4";
# build-servers = {
# nostromo = {
# max-jobs = 4;
# speed-factor = 2;
# };
# "/mnt/downloads" = {
# device = "whitedwarf:/volume1/Downloads";
# fsType = "nfs4";
# };
# "/mnt/music" = {
# device = "doraemon:/volume1/Music";
# fsType = "nfs4";
# };
# "/mnt/video" = {
# device = "doraemon:/volume1/Video";
# fsType = "nfs4";
# };
# "/mnt/cargo_video" = {
# device = "cargo:/volume1/video";
# fsType = "nfs4";
# };
# "/mnt/photo" = {
# device = "cargo:/volume1/pictures";
# fsType = "nfs4";
# lambda = {
# max-jobs = 4;
# speed-factor = 2;
# };
# };
enable-distributed-builds = false;
mail-server = "mail.fudo.org";
};
portage = {
gateway-v4 = "208.81.3.113";
network = "208.81.3.112/28";
nameservers = [ "1.1.1.1" "208.81.7.14" "2606:4700:4700::1111" ];
nameservers = [ "208.81.7.14" "1.1.1.1" ];
timezone = "America/Winnipeg";
deploy-pubkeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPwh522lvafTJYA0X2uFdP7Ws+Um1f8gZsARK1Y5nMzf6ZcWBF1jplTOKUVSOl4isMWni0Tu0TnX4zqCcgocWUVbwIwXSIRYqdiCPvVOH+/Ibc97n1/dYxk5JPMtbrsEw6/gWZxVg0qwe0J3dQWldEMiDY7iWhlrmIr7YL+Y3PUd7DOwp3PbfWfNyzTfE1kXcz5YvTeN+txFhbbXT0oS2R2wtc1vYXFZ/KbNstjqd+i8jszAq3ZkbbwL3aNR0RO4n8+GoIILGw8Ya4eP7D6+mYk608IhAoxpGyMrUch2TC2uvOK3rd/rw1hsTxf4AKjAZbrfd/FJaYru9ZeoLjD4bRGMdVp56F1m7pLvRiWRK62pV2Q/fjx+4KjHUrgyPd601eUIP0ayS/Rfuq8ijLpBJgO5/Y/6mFus/kjZIfRR9dXfLM67IMpyEzEITYrc/R2sedWf+YHxSh6eguAZ/kLzioar1nHLR7Wzgeu0tgWkD78WQGjpXGoefAz3xHeBg3Et0="
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDGVez4of30f+j0cWKj5kYCKeFjyNsYvG9UbOMxF5hImD2lP5MSbFBv31gFgHjx3yCG4zQRZlpuyU5uWo0qIwe9N84/LcZcB9WrWKZXDmuof7zPFy0J+Hj+LVLDQI/mVXHNwkMhBMHpPrdwA05EYDAYCYklWT4cSByu10pHtST+olF8i+A+UQgUzgNZzdJVeiYZv6MBDTYsJWptGeDUkl2B0Es3gtbGYcCCfnyS3RC7DIXlDo3NBbAr7WaHY2MBbT+R/+jicn9E3IY3NCM5jENxqmvHy9MDsxEEYgFNm7IDwq4V1VRUWy277YsvRbmEaHb+osOA5u1VNN4z3UftOZcSZgR5C/vR71cENXoPt1YQpCzu7i38ojtvL+tDVEKT7sIovrQw8q1sszNlW2nXh8RSPiIq5TMnrV73MP0egKcr9n3tfxwi1BIkLjvfom/02BkTK9R9v+VMNhYU1YwROhORCiMIgoxUGiUvtH8u38JGr7E0hhMoAjCE5k80WPUivl0="
];
mail-server = "mail.fudo.org";
};
russell = {
@@ -69,18 +45,19 @@
dynamic-network = "10.0.1.0/24";
timezone = "America/Winnipeg";
gateway-host = "clunk";
mail-server = "mail.fudo.org";
};
joes-datacenter-0 = {
gateway-v4 = "172.86.179.17";
network = "172.86.179.17/29";
nameservers = [ "1.1.1.1" "2606:4700:4700::1111" ];
timezone = "America/Winnipeg";
deploy-pubkeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPwh522lvafTJYA0X2uFdP7Ws+Um1f8gZsARK1Y5nMzf6ZcWBF1jplTOKUVSOl4isMWni0Tu0TnX4zqCcgocWUVbwIwXSIRYqdiCPvVOH+/Ibc97n1/dYxk5JPMtbrsEw6/gWZxVg0qwe0J3dQWldEMiDY7iWhlrmIr7YL+Y3PUd7DOwp3PbfWfNyzTfE1kXcz5YvTeN+txFhbbXT0oS2R2wtc1vYXFZ/KbNstjqd+i8jszAq3ZkbbwL3aNR0RO4n8+GoIILGw8Ya4eP7D6+mYk608IhAoxpGyMrUch2TC2uvOK3rd/rw1hsTxf4AKjAZbrfd/FJaYru9ZeoLjD4bRGMdVp56F1m7pLvRiWRK62pV2Q/fjx+4KjHUrgyPd601eUIP0ayS/Rfuq8ijLpBJgO5/Y/6mFus/kjZIfRR9dXfLM67IMpyEzEITYrc/R2sedWf+YHxSh6eguAZ/kLzioar1nHLR7Wzgeu0tgWkD78WQGjpXGoefAz3xHeBg3Et0="
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDGVez4of30f+j0cWKj5kYCKeFjyNsYvG9UbOMxF5hImD2lP5MSbFBv31gFgHjx3yCG4zQRZlpuyU5uWo0qIwe9N84/LcZcB9WrWKZXDmuof7zPFy0J+Hj+LVLDQI/mVXHNwkMhBMHpPrdwA05EYDAYCYklWT4cSByu10pHtST+olF8i+A+UQgUzgNZzdJVeiYZv6MBDTYsJWptGeDUkl2B0Es3gtbGYcCCfnyS3RC7DIXlDo3NBbAr7WaHY2MBbT+R/+jicn9E3IY3NCM5jENxqmvHy9MDsxEEYgFNm7IDwq4V1VRUWy277YsvRbmEaHb+osOA5u1VNN4z3UftOZcSZgR5C/vR71cENXoPt1YQpCzu7i38ojtvL+tDVEKT7sIovrQw8q1sszNlW2nXh8RSPiIq5TMnrV73MP0egKcr9n3tfxwi1BIkLjvfom/02BkTK9R9v+VMNhYU1YwROhORCiMIgoxUGiUvtH8u38JGr7E0hhMoAjCE5k80WPUivl0="
];
keytab-path = "/state/secrets/kerberos";
build-key-path = "/state/secrets/build-keys";
mail-server = "mail.informis.land";
};
};
}