Tons of changes, I guess?
This commit is contained in:
+112
-44
@@ -9,6 +9,7 @@ let
|
||||
domain = config.fudo.domains.${domain-name};
|
||||
host-fqdn = "${hostname}.${domain-name}";
|
||||
mail-hostname = "mail.fudo.org";
|
||||
mail-directory = "/srv/mail";
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.france;
|
||||
secret-files = config.fudo.secrets.files;
|
||||
@@ -37,14 +38,73 @@ in {
|
||||
config = {
|
||||
security.acme.email = "admin@fudo.org";
|
||||
|
||||
fudo = {
|
||||
fileSystems = {
|
||||
"/srv/archiva" = {
|
||||
fsType = "btrfs";
|
||||
label = "pool0";
|
||||
options = [ "noatime" "nodiratime" "noexec" "subvol=archiva" ];
|
||||
};
|
||||
|
||||
"/srv/grafana" = {
|
||||
fsType = "btrfs";
|
||||
label = "pool0";
|
||||
options = [ "noatime" "nodiratime" "noexec" "subvol=grafana" ];
|
||||
};
|
||||
|
||||
"/srv/gitlab" = {
|
||||
fsType = "btrfs";
|
||||
label = "pool0";
|
||||
options = [ "noatime" "nodiratime" "noexec" "subvol=grafana" ];
|
||||
};
|
||||
|
||||
${mail-directory} = {
|
||||
fsType = "btrfs";
|
||||
label = "pool0";
|
||||
options = [ "noatime" "nodiratime" "noexec" "subvol=mail" ];
|
||||
};
|
||||
};
|
||||
|
||||
users.users.archiva = {
|
||||
isSystemUser = true;
|
||||
group = "nogroup";
|
||||
};
|
||||
|
||||
virtualisation = {
|
||||
lxd.enable = true;
|
||||
|
||||
oci-containers = {
|
||||
backend = "docker";
|
||||
|
||||
containers = {
|
||||
archiva = {
|
||||
image = "xetusoss/archiva";
|
||||
autoStart = true;
|
||||
ports = [ "8001:8080/tcp" ];
|
||||
# Ugly: name-to-uid lookup fails.
|
||||
user = toString config.users.users.archiva.uid;
|
||||
volumes = [ "/srv/archiva:/archiva-data" ];
|
||||
environment = {
|
||||
# Not directly connected to the world anyway
|
||||
SSL_ENABLED = "false";
|
||||
PROXY_BASE_URL = "https://archiva.fudo.org/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
fudo = let
|
||||
backplane-dns-password-file = pkgs.lib.fudo.passwd.stablerandom-passwd-file
|
||||
"dns-service-backplane-passwd"
|
||||
"dns-service-backplane-passwd-${config.instance.build-seed}";
|
||||
in {
|
||||
hosts.france.external-interfaces = [ "extif0" ];
|
||||
|
||||
acme.host-domains.france."france.fudo.org" = {
|
||||
email = "admin@fudo.org";
|
||||
local-copies = {
|
||||
postgres = {
|
||||
user = config.services.postgresql.user;
|
||||
user = "postgres";
|
||||
};
|
||||
openldap = {
|
||||
user = config.services.openldap.user;
|
||||
@@ -56,26 +116,6 @@ in {
|
||||
ldap-user = config.services.openldap.user;
|
||||
ldap-group = config.services.openldap.group;
|
||||
in {
|
||||
ldap-ssl-certificate = {
|
||||
source-file = cfg.ssl-certificate;
|
||||
target-file = "/run/openldap/ssl-certificate.pem";
|
||||
user = ldap-user;
|
||||
group = ldap-group;
|
||||
permissions = "0444";
|
||||
};
|
||||
ldap-ssl-private-key = {
|
||||
source-file = cfg.ssl-private-key;
|
||||
target-file = "/run/openldap/ssl-private-key.pem";
|
||||
user = ldap-user;
|
||||
group = ldap-group;
|
||||
};
|
||||
ldap-ssl-ca-certificate = {
|
||||
source-file = cfg.ssl-ca-certificate;
|
||||
target-file = "/run/openldap/ssl-ca-certificate.pem";
|
||||
user = ldap-user;
|
||||
group = ldap-group;
|
||||
permissions = "0444";
|
||||
};
|
||||
ldap-keytab = {
|
||||
source-file = secret-files.service-keytabs.france.ldap;
|
||||
target-file = "/run/openldap/ldap.keytab";
|
||||
@@ -83,7 +123,8 @@ in {
|
||||
group = ldap-group;
|
||||
};
|
||||
ldap-root-passwd = {
|
||||
source-file = passwd.random-passwd-file;
|
||||
source-file =
|
||||
pkgs.lib.fudo.passwd.random-passwd-file "ldap-root-passwd" 20;
|
||||
target-file = "/run/openldap/root.passwd";
|
||||
user = ldap-user;
|
||||
group = ldap-group;
|
||||
@@ -91,7 +132,12 @@ in {
|
||||
postgres-keytab = {
|
||||
source-file = secret-files.service-keytabs.france.postgres;
|
||||
target-file = "/run/postgres/postgres.keytab";
|
||||
user = config.services.postgresql.user;
|
||||
user = "postgres"; # This is just plain hard-coded...
|
||||
};
|
||||
backplane-dns-password = {
|
||||
source-file = backplane-dns-password-file;
|
||||
target-file = "/run/backplane/dns/xmpp.passwd";
|
||||
user = config.fudo.backplane.dns.user;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -117,34 +163,34 @@ in {
|
||||
|
||||
kdc = {
|
||||
state-directory = "/state/kerberos";
|
||||
master-key-file = "";
|
||||
master-key-file = secret-files.realm-master-keys."FUDO.ORG";
|
||||
listen-ips = [ primary-ip "127.0.0.1" "127.0.1.1" "::1" ];
|
||||
};
|
||||
|
||||
jabber = {
|
||||
ldap-servers = [ "france.fudo.org" ];
|
||||
listen-ips = [ primary-ip ];
|
||||
};
|
||||
|
||||
backplane = {
|
||||
host-passwd-files = let
|
||||
hosts = attrNames config.fudo.hosts;
|
||||
in mapAttrs (hostname: hostOpts: hostOpts.backplane-password-file)
|
||||
config.fudo.hosts;
|
||||
service-passwd-files = genAttrs [ "dns" ]
|
||||
(service-name:
|
||||
lib.fudo.passwd.stablerandom-passwd-file
|
||||
"${service-name}-service-backplane-passwd"
|
||||
"${service-name}-service-backplane-passwd-${config.instance.build-seed}");
|
||||
backplane = {
|
||||
host-passwd-files = let
|
||||
hosts = attrNames config.fudo.hosts;
|
||||
in mapAttrs (hostname: hostOpts: hostOpts.backplane-password-file)
|
||||
config.fudo.hosts;
|
||||
service-passwd-files = {
|
||||
dns = backplane-dns-password-file;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
backplane-server = {
|
||||
listen-ips = [ primary-ip ];
|
||||
backplane-dns-password-file =
|
||||
secrets.backplane-dns-password.target-file;
|
||||
};
|
||||
|
||||
mail = {
|
||||
mail-directory = "/srv/mail/mailboxes";
|
||||
state-directory = "/srv/mail/var";
|
||||
mail-directory = "${mail-directory}/mailboxes";
|
||||
state-directory = "${mail-directory}/var";
|
||||
ldap-server-urls = [
|
||||
"ldap://france.fudo.org"
|
||||
];
|
||||
@@ -169,6 +215,18 @@ in {
|
||||
ssl-certificate = cert-copy.certificate;
|
||||
ssl-private-key = cert-copy.private-key;
|
||||
};
|
||||
|
||||
dns = {
|
||||
default-host = primary-ip;
|
||||
listen-ip = primary-ip;
|
||||
mail-hosts = [ "mail.fudo.org" ];
|
||||
};
|
||||
|
||||
chat = {
|
||||
chat-hostname = "chat.fudo.org";
|
||||
mail-server = "mail.fudo.org";
|
||||
database-host = "localhost";
|
||||
};
|
||||
};
|
||||
|
||||
minecraft-server = {
|
||||
@@ -181,8 +239,6 @@ in {
|
||||
};
|
||||
|
||||
networking = {
|
||||
useDHCP = false;
|
||||
|
||||
interfaces = {
|
||||
intif0 = {
|
||||
ipv4.addresses = [{
|
||||
@@ -196,10 +252,6 @@ in {
|
||||
address = primary-ip;
|
||||
prefixLength = 28;
|
||||
}
|
||||
{
|
||||
address = git-server-ip;
|
||||
prefixLength = 32;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
@@ -218,6 +270,22 @@ in {
|
||||
enableACME = true;
|
||||
locations."/".return = "301 https://webmail.fudo.org$request_uri";
|
||||
};
|
||||
|
||||
"archiva.fudo.org" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:8001";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-By $server_addr:$server_port;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -11,8 +11,6 @@ let
|
||||
concatGenAttrs = lst: f:
|
||||
foldr (a0: a1: a0 // a1) {} (map f lst);
|
||||
|
||||
passwd = import ../../../lib/passwd.nix { inherit lib; };
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
cfg = config.fudo.france;
|
||||
@@ -69,45 +67,47 @@ in {
|
||||
user = config.fudo.auth.kdc.user;
|
||||
};
|
||||
|
||||
auth = {
|
||||
ldap-server = {
|
||||
enable = true;
|
||||
base = "dc=fudo,dc=org";
|
||||
organization = "Fudo";
|
||||
rootpw-file = cfg.ldap.root-password-file;
|
||||
kerberos-host = fqdn;
|
||||
kerberos-keytab = cfg.ldap.keytab;
|
||||
ssl-certificate = cfg.ldap.ssl-certificate;
|
||||
ssl-private-key = cfg.ldap.ssl-private-key;
|
||||
ssl-ca-certificate = cfg.ldap.ssl-ca-certificate;
|
||||
# auth = {
|
||||
# ldap-server = {
|
||||
# enable = true;
|
||||
# base = "dc=fudo,dc=org";
|
||||
# organization = "Fudo";
|
||||
# rootpw-file = cfg.ldap.root-password-file;
|
||||
# kerberos-host = fqdn;
|
||||
# kerberos-keytab = cfg.ldap.keytab;
|
||||
# ssl-certificate = cfg.ldap.ssl-certificate;
|
||||
# ssl-private-key = cfg.ldap.ssl-private-key;
|
||||
# ssl-ca-certificate = cfg.ldap.ssl-ca-certificate;
|
||||
|
||||
listen-uris = [ "ldap:///" "ldaps:///" "ldapi:///" ];
|
||||
# listen-uris = [ "ldap:///" "ldaps:///" "ldapi:///" ];
|
||||
|
||||
users = config.fudo.users;
|
||||
groups = config.fudo.groups;
|
||||
system-users = config.fudo.system-users;
|
||||
};
|
||||
# users = config.fudo.users;
|
||||
# groups = config.fudo.groups;
|
||||
# system-users = config.fudo.system-users;
|
||||
|
||||
# TODO: let build hosts create keys?
|
||||
kdc = {
|
||||
enable = true;
|
||||
realm = config.fudo.domains.${domain-name}.gssapi-realm;
|
||||
state-directory = cfg.kdc.state-directory;
|
||||
master-key-file = secrets.kdc-master-key.target-file;
|
||||
acl = let
|
||||
admin-entries = concatGenAttrs
|
||||
config.instance.local-admins
|
||||
(admin: {
|
||||
"${admin}" = { perms = [ "add" "list" "change-password" ]; };
|
||||
"${admin}/root" = { perms = [ "all" ]; };
|
||||
});
|
||||
in {
|
||||
"host/*.fudo.org" = { perms = [ "add" ]; };
|
||||
"pam_migrate/*.fudo.org" = { perms = [ "add" "change-password" ]; };
|
||||
} // admin-entries;
|
||||
bind-addresses = cfg.kdc.listen-ips;
|
||||
};
|
||||
};
|
||||
# database-directory = "/state/openldap";
|
||||
# };
|
||||
|
||||
# # TODO: let build hosts create keys?
|
||||
# kdc = {
|
||||
# enable = true;
|
||||
# realm = config.fudo.domains.${domain-name}.gssapi-realm;
|
||||
# state-directory = cfg.kdc.state-directory;
|
||||
# master-key-file = secrets.kdc-master-key.target-file;
|
||||
# acl = let
|
||||
# admin-entries = concatGenAttrs
|
||||
# config.instance.local-admins
|
||||
# (admin: {
|
||||
# "${admin}" = { perms = [ "add" "list" "change-password" ]; };
|
||||
# "${admin}/root" = { perms = [ "all" ]; };
|
||||
# });
|
||||
# in {
|
||||
# "host/*.fudo.org" = { perms = [ "add" ]; };
|
||||
# "pam_migrate/*.fudo.org" = { perms = [ "add" "change-password" ]; };
|
||||
# } // admin-entries;
|
||||
# bind-addresses = cfg.kdc.listen-ips;
|
||||
# };
|
||||
# };o
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -10,14 +10,12 @@ let
|
||||
backplane-dns-user = "backplane-dns";
|
||||
|
||||
generate-role-passwd = role:
|
||||
lib.fudo.passwd.stablerandom-password-file
|
||||
pkgs.lib.fudo.passwd.stablerandom-passwd-file
|
||||
"backplane-${role}-password"
|
||||
"${hostname}-${domain}-${role}-password-${config.instance.build-timestamp}";
|
||||
"${hostname}-${domain}-${role}-password-${config.instance.build-seed}";
|
||||
|
||||
powerdns-password = generate-role-passwd "powerdns-db";
|
||||
|
||||
backplane-dns-xmpp-password = generate-role-passwd "backplane-dns-xmpp";
|
||||
|
||||
backplane-dns-db-password = generate-role-passwd "backplane-dns-db";
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.france;
|
||||
@@ -36,6 +34,11 @@ in {
|
||||
description = "List of IPv6s on which to listen for incoming backplane connections.";
|
||||
default = [];
|
||||
};
|
||||
|
||||
backplane-dns-password-file = mkOption {
|
||||
type = str;
|
||||
description = "Path to file containing the password for connecting to the XMPP backplane.";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
@@ -64,19 +67,13 @@ in {
|
||||
powerdns-password = {
|
||||
source-file = powerdns-password;
|
||||
target-file = "/run/backplane/dns/powerdns/db.passwd";
|
||||
user = config.fudo.backplane.dns.database.user;
|
||||
user = config.fudo.backplane.dns.powerdns.user;
|
||||
};
|
||||
|
||||
backplane-dns-db-password = {
|
||||
source-file = backplane-dns-db-password;
|
||||
target-file = "/run/backplane/dns/db.passwd";
|
||||
user = config.fudo.backplane.dns.backplane.user;
|
||||
};
|
||||
|
||||
backplane-dns-xmpp-password = {
|
||||
source-file = backplane-dns-db-password;
|
||||
target-file = "/run/backplane/dns/xmpp.passwd";
|
||||
user = config.fudo.backplane.dns.backplane.user;
|
||||
user = config.fudo.backplane.dns.user;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -98,7 +95,7 @@ in {
|
||||
};
|
||||
};
|
||||
${backplane-dns-user} = {
|
||||
password-file = secrets.backplane-dns-db-password;
|
||||
password-file = secrets.backplane-dns-db-password.target-file;
|
||||
databases = {
|
||||
backplane_dns = {
|
||||
access = "CONNECT";
|
||||
@@ -134,7 +131,7 @@ in {
|
||||
backplane = {
|
||||
host = "backplane.fudo.org";
|
||||
role = "service-dns";
|
||||
password-file = secrets.backplane-dns-xmpp-password.target-file;
|
||||
password-file = cfg.backplane-dns-password-file;
|
||||
database = {
|
||||
username = backplane-dns-user;
|
||||
database = backplane-dns-user;
|
||||
|
||||
@@ -0,0 +1,98 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
{
|
||||
options.fudo.france.chat = with types; {
|
||||
chat-hostname = mkOption {
|
||||
type = str;
|
||||
description = "Hostname of the chat server.";
|
||||
};
|
||||
|
||||
mail-server = mkOption {
|
||||
type = str;
|
||||
description = "Email server to use for communication.";
|
||||
};
|
||||
|
||||
database-host = mkOption {
|
||||
type = str;
|
||||
description = "Hostname of the database server.";
|
||||
};
|
||||
};
|
||||
|
||||
config = let
|
||||
hostname = config.instance.hostname;
|
||||
|
||||
cfg = config.fudo.france.chat;
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
in {
|
||||
fudo = {
|
||||
secrets.host-secrets.${hostname} = {
|
||||
mattermost-mail-password = {
|
||||
source-file = pkgs.lib.fudo.passwd.stablerandom-passwd-file
|
||||
"mattermost-mail-password"
|
||||
"${hostname}-mattermost-mail-password-${config.instance.build-seed}";
|
||||
target-file = "/run/chat/mattermost/mail.passwd";
|
||||
user = config.services.mattermost.user;
|
||||
};
|
||||
|
||||
mattermost-db-password = {
|
||||
source-file = pkgs.lib.fudo.passwd.stablerandom-passwd-file
|
||||
"mattermost-db-password"
|
||||
"${hostname}-mattermost-db-password-${config.instance.build-seed}";
|
||||
target-file = "/run/chat/mattermost/database.passwd";
|
||||
user = config.services.mattermost.user;
|
||||
};
|
||||
};
|
||||
|
||||
users.fudo-chat = {
|
||||
uid = 20001;
|
||||
primary-group = "fudo";
|
||||
common-name = "Fudo Chat";
|
||||
ldap-hashed-passwd =
|
||||
pkgs.lib.fudo.passwd.hash-ldap-passwd "mattermost-chat"
|
||||
secrets.mattermost-mail-password.source-file;
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
databases.mattermost.users =
|
||||
config.instance.local-admins;
|
||||
|
||||
users.mattermost = {
|
||||
password-file =
|
||||
secrets.mattermost-db-password.target-file;
|
||||
databases = {
|
||||
mattermost = {
|
||||
access = "CONNECT";
|
||||
entity-access = {
|
||||
"ALL TABLES IN SCHEMA public" =
|
||||
"SELECT,INSERT,UPDATE,DELETE";
|
||||
"ALL SEQUENCES IN SCHEMA public" =
|
||||
"SELECT,UPDATE";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
chat = {
|
||||
enable = true;
|
||||
|
||||
hostname = cfg.chat-hostname;
|
||||
site-name = "Fudo Chat";
|
||||
smtp = {
|
||||
server = cfg.mail-server;
|
||||
user = "fudo-chat";
|
||||
password-file = secrets.mattermost-mail-password.target-file;
|
||||
};
|
||||
database = {
|
||||
name = "mattermost";
|
||||
hostname = cfg.database-host;
|
||||
user = "mattermost";
|
||||
password-file = secrets.mattermost-db-password.target-file;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,88 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
hostname = config.instance.hostname;
|
||||
|
||||
cfg = config.fudo.france.dns;
|
||||
|
||||
in {
|
||||
options.fudo.france.dns = with types; {
|
||||
default-host = mkOption {
|
||||
type = str;
|
||||
description = "IP address to which the domain will map.";
|
||||
};
|
||||
|
||||
listen-ip = mkOption {
|
||||
type = str;
|
||||
description = "IP addresses on which to listen";
|
||||
};
|
||||
|
||||
listen-ipv6 = mkOption {
|
||||
type = nullOr str;
|
||||
description = "IPv6 addresses on which to listen";
|
||||
default = null;
|
||||
};
|
||||
|
||||
mail-hosts = mkOption {
|
||||
type = listOf str;
|
||||
description = "List of mail hosts for the MX records.";
|
||||
};
|
||||
};
|
||||
|
||||
config = let
|
||||
dom = config.instance.local-domain;
|
||||
dom-cfg = config.fudo.domains.${dom};
|
||||
in {
|
||||
fudo = {
|
||||
mail-server.alias-users.dmarc-report =
|
||||
map (admin: "${admin}@${dom}") dom-cfg.local-admins;
|
||||
|
||||
dns = {
|
||||
enable = true;
|
||||
|
||||
identity = "${hostname}.fudo.org";
|
||||
|
||||
listen-ips =
|
||||
[ cfg.listen-ip ] ++
|
||||
(optional (cfg.listen-ipv6 != null) cfg.listen-ipv6);
|
||||
|
||||
nameservers = {
|
||||
ns1 = {
|
||||
ipv4-address = cfg.listen-ip;
|
||||
ipv6-address = mkIf (cfg.listen-ipv6 != null) cfg.listen-ipv6;
|
||||
description = "Nameserver 1, france, in Winnipeg, MB, CA";
|
||||
};
|
||||
ns2 = {
|
||||
ipv4-address = "209.117.102.102";
|
||||
ipv6-address = "2001:470:1f16:40::2";
|
||||
description = "Nameserver 2, musashi, in Winnipeg, MB, CA";
|
||||
};
|
||||
ns3 = {
|
||||
ipv4-address = "104.131.53.95";
|
||||
ipv6-address = "2604:a880:800:10::8:7001";
|
||||
description =
|
||||
"Nameserver 3, ns2.henchmman21.net, in New York City, NY, US";
|
||||
};
|
||||
ns4 = {
|
||||
ipv4-address = "204.42.254.5";
|
||||
ipv6-address = "2001:418:3f4::5";
|
||||
description = "Nameserver 4, puck.nether.net, in Chicago, IL, US";
|
||||
};
|
||||
};
|
||||
|
||||
domains = let
|
||||
in {
|
||||
${dom} = {
|
||||
dnssec = true;
|
||||
default-host = cfg.default-host;
|
||||
gssapi-realm = dom-cfg.gssapi-realm;
|
||||
mx = cfg.mail-hosts;
|
||||
dmarc-report-address = "dmarc-report@${dom}";
|
||||
network-definition = import ../../networks/fudo.org.nix;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -46,7 +46,7 @@ in {
|
||||
|
||||
config.fudo = {
|
||||
secrets.host-secrets.${hostname}.git-database-password = {
|
||||
source-file = lib.fudo.passwd.stablerandom-passwd-file
|
||||
source-file = pkgs.lib.fudo.passwd.stablerandom-passwd-file
|
||||
"gitea-database-passwd"
|
||||
"${hostname}-gitea-database-passwd-${config.instance.build-seed}";
|
||||
target-file = "/var/gitea/database.passwd";
|
||||
@@ -55,7 +55,7 @@ in {
|
||||
|
||||
postgresql = {
|
||||
databases.fudo_git.users =
|
||||
config.instance.local_admins;
|
||||
config.instance.local-admins;
|
||||
|
||||
users.fudo_git = {
|
||||
password-file =
|
||||
|
||||
@@ -5,23 +5,23 @@ let
|
||||
hostname = config.instance.hostname;
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
cfg = config.fudo.france;
|
||||
cfg = config.fudo.france.jabber;
|
||||
|
||||
generate-auth-file = name: files: let
|
||||
make-entry = name: passwd-file:
|
||||
''("${name}" . "${readFile passwd-file}")'';
|
||||
entries = mapAttrsToList make-entry files;
|
||||
content = concatStringsSep "\n" entries;
|
||||
in writeText "${name}-backplane-auth.scm" "'(${content})'";
|
||||
in pkgs.writeText "${name}-backplane-auth.scm" "'(${content})";
|
||||
|
||||
host-auth-file = generate-auth-file "host" cfg.host-passwd-files;
|
||||
service-auth-file = generate-auth-filre "service" cfg.service-passwd-files;
|
||||
host-auth-file = generate-auth-file "host" cfg.backplane.host-passwd-files;
|
||||
service-auth-file = generate-auth-file "service" cfg.backplane.service-passwd-files;
|
||||
|
||||
ldap-password-file =
|
||||
lib.fudo.passwd.random-passwd-file "ejabberd-ldap-auth-user";
|
||||
pkgs.lib.fudo.passwd.random-passwd-file "ejabberd-ldap-auth-user" 30;
|
||||
|
||||
ldap-hashed-password =
|
||||
hash-ldap-passwd "ejabberd-ldap-hashed-passwd" ldap-password-file;
|
||||
pkgs.lib.fudo.passwd.hash-ldap-passwd "ejabberd-ldap-hashed-passwd" ldap-password-file;
|
||||
|
||||
in {
|
||||
options.fudo.france = with types; {
|
||||
@@ -41,28 +41,28 @@ in {
|
||||
type = listOf str;
|
||||
description = "IPs on which to listen for incoming connections.";
|
||||
};
|
||||
};
|
||||
|
||||
backplane = {
|
||||
host-passwd-files = mkOption {
|
||||
type = attrsOf str;
|
||||
description = "Map of hostname to password file, for backplane host authentication.";
|
||||
default = {};
|
||||
};
|
||||
backplane = {
|
||||
host-passwd-files = mkOption {
|
||||
type = attrsOf str;
|
||||
description = "Map of hostname to password file, for backplane host authentication.";
|
||||
default = {};
|
||||
};
|
||||
|
||||
service-passwd-files = mkOption {
|
||||
type = attrsOf str;
|
||||
description = "Map of service to password file, for backplane service authentication.";
|
||||
default = {};
|
||||
service-passwd-files = mkOption {
|
||||
type = attrsOf str;
|
||||
description = "Map of service to password file, for backplane service authentication.";
|
||||
default = {};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
fudo = {
|
||||
system-users.${cfg.jabber.ldap-user} = {
|
||||
system-users.${cfg.ldap-user} = {
|
||||
description = "ejabberd authentication user.";
|
||||
hashed-password = ldap-hashed-password;
|
||||
ldap-hashed-password = ldap-hashed-password;
|
||||
};
|
||||
|
||||
secrets.host-secrets.${hostname} = let
|
||||
@@ -88,7 +88,7 @@ in {
|
||||
jabber = {
|
||||
enable = true;
|
||||
|
||||
listen-ips = cfg.jabber.listen-ips;
|
||||
listen-ips = cfg.listen-ips;
|
||||
|
||||
environment = {
|
||||
FUDO_HOST_PASSWD_FILE = secrets.host-auth.target-file;
|
||||
@@ -103,9 +103,9 @@ in {
|
||||
"fudo.im" = {
|
||||
site-config = {
|
||||
auth_method = "ldap";
|
||||
ldap_servers = cfg.jabber.ldap-servers;
|
||||
ldap_servers = cfg.ldap-servers;
|
||||
ldap_port = 389;
|
||||
ldap_rootdn = "cn=${cfg.jabber.ldap-user},dc=fudo,dc=org";
|
||||
ldap_rootdn = "cn=${cfg.ldap-user},dc=fudo,dc=org";
|
||||
ldap_password = ''"LDAP_PASSWD"'';
|
||||
ldap_base = "ou=members,dc=fudo,dc=org";
|
||||
ldap_filter = "(objectClass=posixAccount)";
|
||||
|
||||
@@ -5,6 +5,8 @@ let
|
||||
hostname = config.instance.hostname;
|
||||
domain-name = config.instance.local-domain;
|
||||
|
||||
cfg = config.fudo.france.mail;
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
mail-reader-dn = "mail-auth-reader";
|
||||
@@ -26,35 +28,63 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
config.fudo = {
|
||||
system-users = {
|
||||
username = mail-reader-dn;
|
||||
config.fudo = let
|
||||
mail-reader-password =
|
||||
pkgs.lib.fudo.passwd.random-passwd-file "${mail-reader-dn}-ldap-password" 30;
|
||||
in {
|
||||
# This is used at build time...
|
||||
# secrets.host-secrets.${hostname}.mail-reader-passwd = {
|
||||
# source-file = ldap-password;
|
||||
# target-file = "/run/mail/${mail-reader-dn}-ldap.passwd";
|
||||
# user = config.services.dovecot2.user;
|
||||
# };
|
||||
|
||||
system-users.${mail-reader-dn} = {
|
||||
description = "Used by the mail server to connect to LDAP for auth.";
|
||||
ldap-hashed-password =
|
||||
pkgs.lib.fudo.passwd.hash-ldap-passwd
|
||||
secrets.mail-reader-passwd.target-file;
|
||||
"${mail-reader-dn}-hashed"
|
||||
mail-reader-password;
|
||||
};
|
||||
|
||||
mail-server = {
|
||||
mail-server = let
|
||||
mail-hostname = "mail.${domain-name}";
|
||||
mail-ssl-dir = config.security.acme.certs.${mail-hostname}.directory;
|
||||
ssl-certificate = "${mail-ssl-dir}/cert.pem";
|
||||
ssl-private-key = "${mail-ssl-dir}/key.pem";
|
||||
in {
|
||||
enableContainer = true;
|
||||
monitoring = true;
|
||||
|
||||
domain = domain-name;
|
||||
mail-hostname = "mail.${domain-name}";
|
||||
|
||||
trusted-networks = config.instance.local-networks;
|
||||
|
||||
dovecot = {
|
||||
ldap = {
|
||||
reader-dn = "cn=${mail-reader-dn},${config.fudo.auth.ldap.base}";
|
||||
reader-password-file = secrets.mail-reader-passwd.target-file;
|
||||
reader-dn = "cn=${mail-reader-dn},${config.fudo.authentication.base}";
|
||||
reader-password-file = mail-reader-password;
|
||||
server-urls = cfg.ldap-server-urls;
|
||||
};
|
||||
};
|
||||
|
||||
user-aliases = let
|
||||
aliased-users = filterAttrs
|
||||
(username: userOpts: length userOpts.email-aliases > 0)
|
||||
config.fudo.users;
|
||||
in mapAttrs (username: userOpts: userOpts.email-aliases) aliased-users;
|
||||
|
||||
state-directory = cfg.state-directory;
|
||||
mail-directory = cfg.mail-directory;
|
||||
|
||||
clamav.enable = true;
|
||||
dkim.signing = true;
|
||||
|
||||
ssl = {
|
||||
certificate = ssl-certificate;
|
||||
private-key = ssl-private-key;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -4,6 +4,7 @@ with lib;
|
||||
let
|
||||
hostname = config.instance.hostname;
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
cfg = config.fudo.france.postgresql;
|
||||
in {
|
||||
options.fudo.france.postgresql = with types; {
|
||||
ssl-certificate = mkOption {
|
||||
|
||||
@@ -8,11 +8,10 @@ let
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
static = config.fudo.static;
|
||||
# TODO: what should go here?
|
||||
static = ../../../static;
|
||||
|
||||
mail-hostname = config.france.webmail.mail-server;
|
||||
|
||||
db-host = config.france.webmail.database.hostname;
|
||||
cfg = config.fudo.france.webmail;
|
||||
|
||||
db-passwd = pkgs.lib.fudo.passwd.random-passwd-file "webmail" 40;
|
||||
|
||||
@@ -39,12 +38,12 @@ in {
|
||||
"webmail.fudo.link" = {
|
||||
title = "Fudo Link Webmail";
|
||||
favicon = "${static}/fudo.link/favicon.ico";
|
||||
mail-server = mail-hostname;
|
||||
mail-server = cfg.mail-server;
|
||||
domain = "fudo.link";
|
||||
edit-mode = "Plain";
|
||||
layout-mode = "bottom";
|
||||
database = {
|
||||
hostname = db-host;
|
||||
hostname = cfg.database.hostname;
|
||||
password-file = db-passwd;
|
||||
};
|
||||
};
|
||||
@@ -52,11 +51,11 @@ in {
|
||||
"webmail.test.fudo.org" = {
|
||||
title = "Fudo Webmail";
|
||||
favicon = "${static}/fudo.org/favicon.ico";
|
||||
mail-server = mail-hostname;
|
||||
mail-server = cfg.mail-server;
|
||||
domain = "fudo.org";
|
||||
edit-mode = "Plain";
|
||||
database = {
|
||||
hostname = db-host;
|
||||
hostname = cfg.database.hostname;
|
||||
password-file = db-passwd;
|
||||
};
|
||||
};
|
||||
@@ -64,11 +63,11 @@ in {
|
||||
"webmail.fudo.org" = {
|
||||
title = "Fudo Webmail";
|
||||
favicon = "${static}/fudo.org/favicon.ico";
|
||||
mail-server = mail-hostname;
|
||||
mail-server = cfg.mail-server;
|
||||
domain = "fudo.org";
|
||||
edit-mode = "Plain";
|
||||
database = {
|
||||
hostname = db-host;
|
||||
hostname = cfg.database.hostname;
|
||||
password-file = db-passwd;
|
||||
};
|
||||
};
|
||||
@@ -76,10 +75,10 @@ in {
|
||||
"webmail.test.selby.ca" = {
|
||||
title = "Selby Webmail";
|
||||
favicon = "${static}/selby.ca/favicon.ico";
|
||||
mail-server = mail-hostname;
|
||||
mail-server = cfg.mail-server;
|
||||
domain = "selby.ca";
|
||||
database = {
|
||||
hostname = db-host;
|
||||
hostname = cfg.database.hostname;
|
||||
password-file = db-passwd;
|
||||
};
|
||||
};
|
||||
@@ -87,10 +86,10 @@ in {
|
||||
"webmail.selby.ca" = {
|
||||
title = "Selby Webmail";
|
||||
favicon = "${static}/selby.ca/favicon.ico";
|
||||
mail-server = mail-hostname;
|
||||
mail-server = cfg.mail-server;
|
||||
domain = "selby.ca";
|
||||
database = {
|
||||
hostname = db-host;
|
||||
hostname = cfg.database.hostname;
|
||||
password-file = db-passwd;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -0,0 +1,233 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
hostname = "legatus";
|
||||
host-ipv4 = "91.229.23.204";
|
||||
domain-name = config.fudo.hosts.${hostname}.domain;
|
||||
domain = config.fudo.domains.${domain-name};
|
||||
site-name = config.fudo.hosts.${hostname}.site;
|
||||
site = config.fudo.sites.${site-name};
|
||||
host-fqdn = "${hostname}.${domain-name}";
|
||||
|
||||
local-packages = with pkgs; [ ldns.examples ];
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
in {
|
||||
networking = {
|
||||
enableIPv6 = true;
|
||||
|
||||
nameservers = [ "1.1.1.1" ];
|
||||
defaultGateway = {
|
||||
address = site.gateway-v4;
|
||||
interface = "extif0";
|
||||
};
|
||||
|
||||
interfaces.extif0.ipv4.addresses = [{
|
||||
address = host-ipv4;
|
||||
prefixLength = 24;
|
||||
}];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"L /etc/adjtime - - - - /state/etc/adjtime"
|
||||
];
|
||||
|
||||
environment.systemPackages = local-packages;
|
||||
|
||||
# networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
# informis.cl-gemini = {
|
||||
# enable = true;
|
||||
|
||||
# hostname = "gemini.informis.land";
|
||||
# server-ip = host-ipv4;
|
||||
# document-root = "/srv/gemini/root";
|
||||
# textfiles-archive = "${pkgs.textfiles}";
|
||||
# slynk-port = 4005;
|
||||
|
||||
# feeds = {
|
||||
# viator = {
|
||||
# title = "viator's phlog";
|
||||
# path = "/home/viator/gemini-public/feed/";
|
||||
# url = "gemini://informis.land/user/viator/feed/";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
|
||||
fudo = {
|
||||
hosts.legatus.external-interfaces = [ "extif0" ];
|
||||
|
||||
# secrets.host-secrets.procul = let
|
||||
# files = config.fudo.secrets.files;
|
||||
# in {
|
||||
# postgres-keytab = {
|
||||
# source-file = files.service-keytabs.procul.postgres;
|
||||
# target-file = "/srv/postgres/secure/postgres.keytab";
|
||||
# user = "root";
|
||||
# };
|
||||
|
||||
# gitea-database-password = {
|
||||
# source-file = files.service-passwords.procul.gitea-database;
|
||||
# target-file = "/srv/gitea/secure/database.passwd";
|
||||
# user = config.fudo.git.user;
|
||||
# };
|
||||
# };
|
||||
|
||||
# client.dns = {
|
||||
# enable = true;
|
||||
# ipv4 = true;
|
||||
# ipv6 = true;
|
||||
# user = "fudo-client";
|
||||
# external-interface = "extif0";
|
||||
# };
|
||||
|
||||
# auth.kdc = {
|
||||
# enable = true;
|
||||
# realm = "INFORMIS.LAND";
|
||||
# bind-addresses = [ host-ipv4 "127.0.0.1" ];
|
||||
# acl = {
|
||||
# "niten" = { perms = [ "add" "change-password" "list" ]; };
|
||||
# "*/root" = { perms = [ "all" ]; };
|
||||
# };
|
||||
# };
|
||||
|
||||
# secure-dns-proxy = {
|
||||
# enable = true;
|
||||
# upstream-dns =
|
||||
# [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
|
||||
# bootstrap-dns = "1.1.1.1";
|
||||
# listen-ips = [ "127.0.0.1" ];
|
||||
# listen-port = 53;
|
||||
# allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
|
||||
# };
|
||||
|
||||
# dns = {
|
||||
# enable = true;
|
||||
# identity = "procul.informis.land";
|
||||
# nameservers = {
|
||||
# ns1 = {
|
||||
# ipv4-address = host-ipv4;
|
||||
# description = "Primary Informis Nameserver";
|
||||
# };
|
||||
# ns2 = {
|
||||
# ipv4-address = host-ipv4;
|
||||
# description = "Secondary Informis Nameserver";
|
||||
# };
|
||||
# };
|
||||
|
||||
# listen-ips = [ host-ipv4 ];
|
||||
|
||||
# domains = {
|
||||
# "informis.land" = {
|
||||
# dnssec = true;
|
||||
# default-host = host-ipv4;
|
||||
# gssapi-realm = "INFORMIS.LAND";
|
||||
# mx = [ "smtp.informis.land" ];
|
||||
# network-definition = config.fudo.networks."informis.land";
|
||||
# dmarc-report-address = "dmarc-report@informis.land";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
|
||||
# mail-server = {
|
||||
# enable = true;
|
||||
# debug = true;
|
||||
|
||||
# domain = domain-name;
|
||||
# mail-hostname = "${host-fqdn}";
|
||||
# monitoring = false;
|
||||
# mail-user = "mailuser";
|
||||
# mail-user-id = 525;
|
||||
# mail-group = "mailgroup";
|
||||
# clamav.enable = true;
|
||||
# dkim.signing = true;
|
||||
|
||||
# dovecot = {
|
||||
# ssl-certificate = acme-certificate "imap.${domain-name}";
|
||||
# ssl-private-key = acme-private-key "imap.${domain-name}";
|
||||
# };
|
||||
|
||||
# postfix = {
|
||||
# ssl-certificate = acme-certificate "smtp.${domain-name}";
|
||||
# ssl-private-key = acme-private-key "smtp.${domain-name}";
|
||||
# };
|
||||
|
||||
# # This should NOT include the primary domain
|
||||
# local-domains = [ host-fqdn "smtp.${domain-name}" ];
|
||||
|
||||
# mail-directory = "/srv/mailserver/mail";
|
||||
# state-directory = "/srv/mailserver/state";
|
||||
|
||||
# trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];
|
||||
|
||||
# alias-users = {
|
||||
# root = [ "niten" ];
|
||||
# postmaster = [ "niten" ];
|
||||
# hostmaster = [ "niten" ];
|
||||
# webmaster = [ "niten" ];
|
||||
# system = [ "niten" ];
|
||||
# admin = [ "niten" ];
|
||||
# dmarc-report = [ "niten" ];
|
||||
# };
|
||||
# };
|
||||
|
||||
# postgresql = {
|
||||
# enable = true;
|
||||
# ssl-certificate = (acme-certificate host-fqdn);
|
||||
# ssl-private-key = (acme-private-key host-fqdn);
|
||||
# keytab = secrets.postgres-keytab.target-file;
|
||||
# local-networks = local-networks;
|
||||
|
||||
# users = {
|
||||
# gituser = {
|
||||
# password-file =
|
||||
# secrets.gitea-database-password.target-file;
|
||||
# databases = {
|
||||
# git = {
|
||||
# access = "CONNECT";
|
||||
# entity-access = {
|
||||
# "ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
|
||||
# "ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
|
||||
# databases = { git = { users = [ "niten" ]; }; };
|
||||
# };
|
||||
|
||||
# git = {
|
||||
# enable = true;
|
||||
# hostname = "git.informis.land";
|
||||
# site-name = "informis git";
|
||||
# user = "gituser";
|
||||
# repository-dir = /srv/git/repo;
|
||||
# state-dir = /srv/git/state;
|
||||
# database = {
|
||||
# user = "gituser";
|
||||
# password-file =
|
||||
# secrets.gitea-database-password.target-file;
|
||||
# hostname = "127.0.0.1";
|
||||
# name = "git";
|
||||
# };
|
||||
# ssh = {
|
||||
# listen-ip = host-ipv4;
|
||||
# listen-port = 2222;
|
||||
# };
|
||||
# };
|
||||
|
||||
# acme = {
|
||||
# enable = true;
|
||||
# admin-address = "admin@${domain-name}";
|
||||
# hostnames = [
|
||||
# "informis.land"
|
||||
# "imap.informis.land"
|
||||
# "smtp.informis.land"
|
||||
# "gemini.informis.land"
|
||||
# ];
|
||||
# };
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
}
|
||||
@@ -50,11 +50,12 @@ in {
|
||||
];
|
||||
};
|
||||
|
||||
fudo.ipfs = {
|
||||
enable = true;
|
||||
users = [ "niten" ];
|
||||
api-address = "/ip4/0.0.0.0/tcp/5001";
|
||||
};
|
||||
## Until I can figure out how to use one common host API, forget this
|
||||
# fudo.ipfs = {
|
||||
# enable = true;
|
||||
# users = [ "niten" ];
|
||||
# api-address = "/ip4/0.0.0.0/tcp/5001";
|
||||
# };
|
||||
|
||||
virtualisation = {
|
||||
libvirtd = {
|
||||
|
||||
@@ -164,7 +164,7 @@ in {
|
||||
debug = true;
|
||||
|
||||
domain = domain-name;
|
||||
hostname = "${host-fqdn}";
|
||||
mail-hostname = "${host-fqdn}";
|
||||
monitoring = false;
|
||||
mail-user = "mailuser";
|
||||
mail-user-id = 525;
|
||||
|
||||
Reference in New Issue
Block a user