nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Informis.land is functioning again.

Browse Source
This commit is contained in:
root@procul
2021-04-14 13:05:55 -05:00
parent 7e6c08b1ec
commit 145996cf38
10 changed files with 480 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/fudo/dns.nix
+43 -19
View File
@@ -26,18 +26,42 @@ let
type = submodule (import ../types/network-definition.nix);
description = "Definition of network to be served by local server.";
};
default-host = mkOption {
type = str;
description = "The host to which the domain should map by default.";
};
mx = mkOption {
type = listOf str;
description = "The hosts which act as the domain mail exchange.";
default = [];
};
gssapi-realm = mkOption {
type = nullOr str;
description = "The GSSAPI realm of this domain.";
default = null;
};
};
};
hostRecords = host: data:
join-lines
((optional (data.ipv4-address != null) "${host} IN A ${data.ipv4-address}")
++ (optional (data.ipv6-address != null)
"${host} IN AAAA ${data.ipv6-address}")
++ (map (sshfp: "${host} IN SSHFP ${sshfp}") data.ssh-fingerprints)
++ (optional (data.rp != null) "${host} IN RP ${data.rp}")
++ (optional (data.description != null)
"${host} IN TXT ${data.description}"));
networkHostOpts = import ../types/network-host.nix { inherit lib; };
hostRecords = hostname: nethost-data: let
# FIXME: RP doesn't work.
# generic-host-records = let
# host-data = if (hasAttr hostname config.fudo.hosts) then config.fudo.hosts.${hostname} else null;
# in
# if (host-data == null) then [] else (
# (map (sshfp: "${hostname} IN SSHFP ${sshfp}") host-data.ssh-fingerprints) ++ (optional (host-data.rp != null) "${hostname} IN RP ${host-data.rp}")
# );
sshfp-records = if (hasAttr hostname config.fudo.hosts) then (map (sshfp: "${hostname} IN SSHFP ${sshfp}") config.fudo.hosts.${hostname}.ssh-fingerprints) else [];
a-record = optional (nethost-data.ipv4-address != null) "${hostname} IN A ${nethost-data.ipv4-address}";
aaaa-record = optional (nethost-data.ipv6-address != null) "${hostname} IN AAAA ${nethost-data.ipv6-address}";
description-record = optional (nethost-data.description != null) "${hostname} IN TXT \"${nethost-data.description}\"";
in
join-lines (a-record ++ aaaa-record ++ description-record ++ sshfp-records);
makeSrvRecords = protocol: type: records:
join-lines (map (record:
@@ -58,7 +82,7 @@ let
nsRecords = domain: ns-hosts:
join-lines
(mapAttrsToList (host: _: "@ IN NS ${host}.${domain}.") ns-hosts);
(mapAttrsToList (host: _: "@ IN NS ${host}.${domain}.") ns-hosts);
in {
@@ -67,12 +91,11 @@ in {
# FIXME: This should allow for AAAA addresses too...
nameservers = mkOption {
type = attrsOf (submodule hostOpts);
type = attrsOf (submodule networkHostOpts);
description = "Map of domain nameserver FQDNs to IP.";
example = {
"ns1.domain.com" = {
ip-addresses = [ "1.1.1.1" ];
ipv6-addresses = [ ];
ipv4-address = "1.1.1.1";
description = "my fancy dns server";
};
};
@@ -101,8 +124,9 @@ in {
enable = true;
identity = cfg.identity;
interfaces = cfg.listen-ips;
zones = mapAttrs' (dom: dom-cfg:
nameValuePair "${dom}." {
zones = mapAttrs' (dom: dom-cfg: let
net-cfg = dom-cfg.network-definition;
in nameValuePair "${dom}." {
dnssec = dom-cfg.dnssec;
data = ''
@@ -132,10 +156,10 @@ in {
${dmarcRecord dom-cfg.dmarc-report-address}
${join-lines
(mapAttrsToList makeSrvProtocolRecords dom-cfg.srv-records)}
${join-lines (mapAttrsToList hostRecords dom-cfg.hosts)}
${join-lines (mapAttrsToList cnameRecord dom-cfg.aliases)}
${join-lines dom-cfg.extra-dns-records}
(mapAttrsToList makeSrvProtocolRecords net-cfg.srv-records)}
${join-lines (mapAttrsToList hostRecords net-cfg.hosts)}
${join-lines (mapAttrsToList cnameRecord net-cfg.aliases)}
${join-lines net-cfg.verbatim-dns-records}
'';
}) cfg.domains;
};
lib/fudo/git.nix
+16 -9
View File
@@ -93,7 +93,9 @@ in {
};
config = mkIf cfg.enable {
security.acme.certs.${cfg.hostname}.email = config.fudo.common.admin-email;
security.acme.certs.${cfg.hostname}.email = let
domain-name = config.fudo.hosts.${config.instance.hostname}.domain;
in config.fudo.domains.${domain-name}.admin-email;
services = {
gitea = {
@@ -114,14 +116,19 @@ in {
stateDir = toString cfg.state-dir;
rootUrl = "https://${cfg.hostname}/";
user = mkIf (cfg.user != null) cfg.user;
extraConfig = mkIf (cfg.ssh != null) ''
[server]
START_SSH_SERVER = true
SSH_DOMAIN = ${cfg.hostname}
SSH_PORT = ${toString cfg.ssh.listen-port}
SSH_LISTEN_PORT = ${toString cfg.ssh.listen-port}
SSH_LISTEN_HOST = ${cfg.ssh.listen-ip}
'';
ssh = {
enable = true;
clonePort = cfg.ssh.listen-port;
};
# settings = mkIf (cfg.ssh != null) {
# server = {
# START_SSH_SERVER = true;
# SSH_DOMAIN = cfg.hostname;
# SSH_PORT = cfg.ssh.listen-port;
# SSH_LISTEN_PORT = cfg.ssh.listen-port;
# SSH_LISTEN_HOST = cfg.ssh.listen-ip;
# };
# };
};
nginx = {
lib/fudo/mail.nix
+24 -17
View File
@@ -124,28 +124,35 @@ in {
Depending on the mail client used it might be necessary to change some mailbox's name.
'';
default = [
{
name = "Trash";
auto = "no";
default = {
Trash = {
auto = "create";
specialUse = "Trash";
}
{
name = "Junk";
auto = "subscribe";
autoexpunge = "30d";
};
Junk = {
auto = "create";
specialUse = "Junk";
}
{
name = "Drafts";
auto = "subscribe";
autoexpunge = "60d";
};
Drafts = {
auto = "create";
specialUse = "Drafts";
}
{
name = "Sent";
autoexpunge = "60d";
};
Sent = {
auto = "subscribe";
specialUse = "Sent";
}
];
};
Archive = {
auto = "no";
specialUse = "Archive";
};
Flagged = {
auto = "no";
specialUse = "Flagged";
};
};
};
debug = mkOption {
lib/fudo/postgres.nix
+10 -10
View File
@@ -245,17 +245,17 @@ in {
ensurePermissions = { "DATABASE ${database}" = "ALL PRIVILEGES"; };
}) opts.users)) cfg.databases)));
extraConfig = ''
krb_server_keyfile = '/etc/postgresql/private/postgres.keytab'
settings = {
krb_server_keyfile = "/etc/postgresql/private/postgres.keytab";
ssl = true
ssl_cert_file = '/etc/postgresql/cert.pem'
ssl_key_file = '/etc/postgresql/private/privkey.pem'
ssl = true;
ssl_cert_file = "/etc/postgresql/cert.pem";
ssl_key_file = "/etc/postgresql/private/privkey.pem";
unix_socket_directories = '${cfg.socket-directory}'
unix_socket_group = '${cfg.socket-group}'
unix_socket_permissions = 0777
'';
unix_socket_directories = cfg.socket-directory;
unix_socket_group = cfg.socket-group;
unix_socket_permissions = "0777";
};
authentication = lib.mkForce ''
${makeLocalUserPasswordEntries cfg.users}
@@ -318,7 +318,7 @@ in {
${usersAccessSql cfg.users}
'';
in ''
${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} ${pkgs.postgresql}/bin/psql --port ${
${pkgs.postgresql}/bin/psql --port ${
toString config.services.postgresql.port
} -d postgres -f ${extra-settings-sql}
${pkgs.coreutils}/bin/chgrp ${cfg.socket-group} ${cfg.socket-directory}/.s.PGSQL*
lib/fudo/secure-dns-proxy.nix
+33 -4
View File
@@ -46,20 +46,49 @@ in {
"List of networks with which this job is allowed to communicate.";
default = null;
};
user = mkOption {
type = str;
description = "User as which to run secure DNS proxy.";
default = "secure-dns-proxy";
};
group = mkOption {
type = str;
description = "Group as which to run secure DNS proxy.";
default = "secure-dns-proxy";
};
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [ dnsproxy ];
config = mkIf cfg.enable (let
upgrade-perms = cfg.listen-port <= 1024;
in {
users = mkIf upgrade-perms {
users = {
${cfg.user} = {
isSystemUser = true;
group = cfg.group;
};
};
groups = {
${cfg.group} = {
members = [ cfg.user ];
};
};
};
fudo.system.services.secure-dns-proxy = {
description = "DNS Proxy for secure DNS-over-HTTPS lookups.";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
privateNetwork = false;
requiredCapabilities = [ ];
requiredCapabilities = mkIf upgrade-perms [ "CAP_NET_BIND_SERVICE" ];
restartWhen = "always";
addressFamilies = [ "AF_INET" "AF_INET6" ];
networkWhitelist = cfg.allowed-networks;
user = mkIf upgrade-perms cfg.user;
group = mkIf upgrade-perms cfg.group;
execStart = let
upstreams = map (upstream: "-u ${upstream}") cfg.upstream-dns;
@@ -70,5 +99,5 @@ in {
toString cfg.listen-port
} ${upstream-line} ${listen-line} -b ${cfg.bootstrap-dns}";
};
};
});
}
lib/types/network-definition.nix
+1 -29
View File
@@ -31,35 +31,7 @@ let
};
};
networkHostOpts = { hostname, ... }: {
options = with types; {
hostname = mkOption {
type = str;
description =
"Hostname (which may map to a host in config.fudo.hosts).";
default = hostname;
};
ipv4-address = mkOption {
type = nullOr str;
description = "The V4 IP of a given host, if any.";
default = null;
};
ipv6-address = mkOption {
type = nullOr str;
description = "The V6 IP of a given host, if any.";
default = null;
};
mac-address = mkOption {
type = nullOr types.str;
description =
"The MAC address of a given host, if desired for IP reservation.";
default = null;
};
};
};
networkHostOpts = import ./network-host.nix { inherit lib; };
in {
options = with types; {
lib/types/network-host.nix
+32
View File
@@ -0,0 +1,32 @@
{ lib, ... }:
{ hostname, ... }:
with lib;
{
options = with types; {
ipv4-address = mkOption {
type = nullOr str;
description = "The V4 IP of a given host, if any.";
default = null;
};
ipv6-address = mkOption {
type = nullOr str;
description = "The V6 IP of a given host, if any.";
default = null;
};
mac-address = mkOption {
type = nullOr types.str;
description =
"The MAC address of a given host, if desired for IP reservation.";
default = null;
};
description = mkOption {
type = nullOr str;
description = "Description of the host.";
default = null;
};
};
}