Extract host type to host.nix

2021-10-04 13:23:40 -07:00
parent 2551908093
commit 2ea4f6be5a
9 changed files with 201 additions and 197 deletions
@@ -0,0 +1,180 @@
+{ lib, ... }:
+
+with lib;
+rec {
+  masterKeyOpts = { ... }: {
+    options = with types; {
+      key-path = mkOption {
+        type = str;
+        description = "Path of the host master key file, used to decrypt secrets.";
+      };
+
+      public-key = mkOption {
+        type = str;
+        description = "Public key used during deployment to decrypt secrets for the host.";
+      };
+    };
+  };
+
+  hostOpts = { hostname, ... }: {
+    options = with types; {
+      master-key = mkOption {
+        type = nullOr (submodule masterKeyOpts);
+        description = "Public key for the host master key, used by the host to decrypt secrets.";
+        default = null;
+      };
+
+      domain = mkOption {
+        type = str;
+        description =
+          "Primary domain to which the host belongs, in the form of a domain name.";
+        default = "fudo.org";
+      };
+
+      extra-domains = mkOption {
+        type = listOf str;
+        description = "Extra domain in which this host is reachable.";
+        default = [ ];
+      };
+
+      aliases = mkOption {
+        type = listOf str;
+        description =
+          "Host aliases used by the current host. Note this will be multiplied with extra-domains.";
+        default = [ ];
+      };
+
+      site = mkOption {
+        type = str;
+        description = "Site at which the host is located.";
+      };
+
+      local-networks = mkOption {
+        type = listOf str;
+        description =
+          "A list of networks to be considered trusted by this host.";
+        default = [ "127.0.0.0/8" ];
+      };
+
+      profile = mkOption {
+        type = listOf (enum ["desktop" "server" "laptop"]);
+        description =
+          "The profile to be applied to the host, determining what software is included.";
+      };
+
+      admin-email = mkOption {
+        type = nullOr str;
+        description = "Email for the administrator of this host.";
+        default = null;
+      };
+
+      local-users = mkOption {
+        type = listOf str;
+        description =
+          "List of users who should have local (i.e. login) access to the host.";
+        default = [ ];
+      };
+
+      description = mkOption {
+        type = str;
+        description = "Description of this host.";
+        default = "Another Fudo Host.";
+      };
+
+      local-admins = mkOption {
+        type = listOf str;
+        description =
+          "A list of users who should have admin access to this host.";
+        default = [ ];
+      };
+
+      local-groups = mkOption {
+        type = listOf str;
+        description = "List of groups which should exist on this host.";
+        default = [ ];
+      };
+
+      ssh-fingerprints = mkOption {
+        type = listOf str;
+        description = ''
+          A list of DNS SSHFP records for this host. Get with `ssh-keygen -r <hostname>`
+        '';
+        default = [ ];
+      };
+
+      rp = mkOption {
+        type = nullOr str;
+        description = "Responsible person.";
+        default = null;
+      };
+
+      tmp-on-tmpfs = mkOption {
+        type = bool;
+        description =
+          "Use tmpfs for /tmp. Great if you've got enough (>16G) RAM.";
+        default = true;
+      };
+
+      enable-gui = mkEnableOption "Install desktop GUI software.";
+
+      docker-server = mkEnableOption "Enable Docker on the current host.";
+
+      kerberos-services = mkOption {
+        type = listOf str;
+        description =
+          "List of services which should exist for this host, if it belongs to a realm.";
+        default = [ "ssh" "host" ];
+      };
+
+      ssh-pubkeys = mkOption {
+        type = listOf path;
+        description =
+          "SSH key files of the host.";
+        default = [];
+      };
+
+      build-pubkeys = mkOption {
+        type = listOf str;
+        description = "SSH public keys used to access the build server.";
+        default = [ ];
+      };
+
+      external-interfaces = mkOption {
+        type = listOf str;
+        description = "A list of interfaces on which to enable the firewall.";
+        default = [ ];
+      };
+
+      keytab-secret-file = mkOption {
+        type = nullOr str;
+        description = "Keytab from which to create a keytab secret.";
+        default = null;
+      };
+
+      keep-cool = mkOption {
+        type = bool;
+        description = "A host that tends to overheat. Try to keep it cooler.";
+        default = false;
+      };
+
+      nixos-system = mkOption {
+        type = bool;
+        description = "Whether the host is a NixOS system.";
+        default = true;
+      };
+
+      arch = mkOption {
+        type = str;
+        description = "System architecture of the system.";
+      };
+
+      machine-id = mkOption {
+        type = nullOr str;
+        description = "Machine id of the system. See: man machine-id.";
+        default = null;
+      };
+
+      android-dev = mkEnableOption "Enable ADB on the host.";
+    };
+  };
+}