nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Working refactored (on a test server)

Browse Source
This commit is contained in:
Root
2021-02-25 20:45:50 +00:00
parent 372cf5fc6a
commit 42e01b0840
31 changed files with 400 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/default.nix
+7
View File
@@ -1,6 +1,8 @@
{ lib, config, pkgs, ... }:
with lib; {
lib = lib // { fudo = import ./lib/fudolib.nix { }; };
imports = [
./instance.nix
@@ -10,9 +12,11 @@ with lib; {
./fudo/chat.nix
./fudo/client/dns.nix
./fudo/dns.nix
./fudo/domains.nix
./fudo/garbage-collector.nix
./fudo/git.nix
./fudo/grafana.nix
./fudo/hosts.nix
./fudo/ipfs.nix
./fudo/kdc.nix
./fudo/ldap.nix
@@ -26,10 +30,13 @@ with lib; {
./fudo/postgres.nix
./fudo/prometheus.nix
./fudo/secure-dns-proxy.nix
./fudo/sites.nix
./fudo/slynk.nix
./fudo/system.nix
./fudo/users.nix
./fudo/vpn.nix
./fudo/webmail.nix
./fudo/wireless-networks.nix
./informis/cl-gemini.nix
];
lib/fudo/domains.nix
+7
View File
@@ -1,5 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
let
domainOpts = { domain, ... }: {
options = {
@@ -30,6 +31,12 @@ let
default = [ ];
};
local-groups = mkOption {
type = with types; listOf str;
description = "List of groups which should exist within this domain.";
default = [ ];
};
admin-email = mkOption {
type = types.str;
description = "Email for the administrator of this domain.";
lib/fudo/hosts.nix
+26 -4
View File
@@ -17,6 +17,11 @@ let
default = "fudo.org";
};
site = mkOption {
type = types.str;
description = "Site at which the host is located.";
};
local-networks = mkOption {
type = with types; listof str;
description =
@@ -51,6 +56,12 @@ let
default = [ ];
};
description = mkOption {
type = types.str;
description = "Description of this host.";
default = "Another Fudo Host.";
};
local-admins = mkOption {
type = with types; listOf str;
description =
@@ -58,6 +69,17 @@ let
default = [ ];
};
local-groups = mkOption {
type = with types; listOf str;
description = "List of groups which should exist on this host.";
default = [ ];
};
hardware-config = mkOption {
type = types.str;
description = "Path to the hardware configuration for this host.";
};
enable-gui = mkEnableOption "Install desktop GUI software.";
docker-server = mkEnableOption "Enable Docker on the current host.";
@@ -75,7 +97,7 @@ in {
hostname = config.instance.hostname;
host-cfg = config.fudo.hosts.${hostname};
site-name = host-cfg.site;
site = config.fudo.site.${site-name};
site = config.fudo.sites.${site-name};
domain-name = host-cfg.domain;
domain = config.fudo.domain.${domain-name};
@@ -96,12 +118,12 @@ in {
services.cron.mailto = domain.admin-email;
environment.systemPackages = with pkgs;
mkIf (cfg.docker-server) [ docker nix-prefetch-docker ];
mkIf (host-cfg.docker-server) [ docker nix-prefetch-docker ];
virtualisation.docker = mkIf (cfg.docker-server) {
virtualisation.docker = mkIf (host-cfg.docker-server) {
enable = true;
enableOnBoot = true;
autoprune.enable = true;
autoPrune.enable = true;
};
};
}
lib/fudo/ldap.nix
+3 -2
View File
@@ -3,7 +3,7 @@
with lib;
let
cfg = config.fudo.auth.server;
cfg = config.fudo.auth.ldap-server;
ldapSystemUserOpts = { name, ... }: {
options = {
@@ -172,7 +172,7 @@ in {
options = {
fudo = {
auth = {
server = {
ldap-server = {
enable = mkEnableOption "Fudo Authentication";
kerberos-host = mkOption {
@@ -297,6 +297,7 @@ in {
mode = "0400";
user = "openldap";
group = "openldap";
# FIXME: take arguments!
text = ''
mech_list: gssapi external
keytab: /etc/ldap/ldap.keytab
lib/fudo/sites.nix
+26 -1
View File
@@ -1,5 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
let
siteOpts = { site, ... }: {
options = {
@@ -27,6 +28,24 @@ let
default = null;
};
local-groups = mkOption {
type = with types; listOf str;
description = "List of groups which should exist at this site.";
default = [ ];
};
local-users = mkOption {
type = with types; listOf str;
description = "List of users which should exist on all hosts at this site.";
default = [ ];
};
local-admins = mkOption {
type = with types; listOf str;
description = "List of admin users which should exist on all hosts at this site.";
default = [ ];
};
enable-monitoring =
mkEnableOption "Enable site-wide monitoring with prometheus.";
@@ -35,12 +54,18 @@ let
description = "List of nameservers to be used by hosts at this site.";
default = [ ];
};
timezone = mkOption {
type = types.str;
description = "Timezone of the site.";
example = "America/Winnipeg";
};
};
};
in {
options.fudo.sites = mkOption {
type = with types; attrsOf (submodule domainOpts);
type = with types; attrsOf (submodule siteOpts);
description = "Site configurations for all sites known to the system.";
default = { };
};
lib/fudo/users.nix
+38 -28
View File
@@ -2,8 +2,6 @@
with lib;
let
cfg = config.fudo.users;
systemUserOpts = { username, ... }: {
options = {
username = mkOption {
@@ -33,7 +31,7 @@ let
default = username;
};
uidNumber = mkOption {
uid = mkOption {
type = types.int;
description = "Unique UID number for the user.";
};
@@ -86,8 +84,9 @@ let
};
home-directory = mkOption {
type = types.str;
type = with types; nullOr str;
description = "Default home directory for the given user.";
default = null;
};
};
};
@@ -111,13 +110,19 @@ let
description = "A list of users who are members of the current group.";
};
gidNumber = mkOption {
gid = mkOption {
type = types.int;
description = "GID number of the group.";
};
};
};
list-includes = list: el: isNull (findFirst (this: this == el) null list);
filterExistingUsers = users: group-members:
let user-list = attrNames users;
in filter (username: list-includes user-list username) group-members;
in {
options.fudo = {
users = mkOption {
@@ -140,27 +145,28 @@ in {
};
config = let
local-host = config.fudo.common.hostname;
local-domain = config.fudo.common.domain;
local-host = config.instance.hostname;
local-domain = config.fudo.hosts.${local-host}.domain;
local-site = config.fudo.hosts.${local-host}.site;
local-user-list = config.fudo.hosts."${local-host}".local-users;
host-user-list = config.fudo.hosts."${local-host}".local-users;
domain-user-list = config.fudo.domains."${local-domain}".local-users;
local-users = getAttrs (local-user-list ++ domain-user-list) cfg.users;
local-users = getAttrs (host-user-list ++ domain-user-list) config.fudo.users;
local-group-list = config.fudo.hosts."${local-host}".local-groups;
host-admin-list = config.fudo.hosts."${local-host}".local-admins;
domain-admin-list = config.fudo.domains."${local-domain}".local-admins;
site-admin-list = config.fudo.sites."${local-site}".local-admins;
local-admins = host-admin-list ++ domain-admin-list ++ site-admin-list;
host-group-list = config.fudo.hosts."${local-host}".local-groups;
domain-group-list = config.fudo.domains."${local-domain}".local-groups;
local-groups = getAttrs (local-group-list ++ domain-group-list) cfg.groups;
site-group-list = config.fudo.sites."${local-site}".local-groups;
local-groups = getAttrs (host-group-list ++ domain-group-list ++ site-group-list) config.fudo.groups;
in {
fudo.auth.ldap = let
fudo.auth.ldap-server = let
ldapUsers = (filterAttrs
(username: userOpts: userOpts.ldap-hashed-password != null)) cfg.users;
list-includes = list: el: isNull (findFirst (this: this == el) list null);
filterExistingUsers = users: group-members:
let user-list = attrNames users;
in filter (username: list-includes user-list username) users;
(username: userOpts: userOpts.ldap-hashed-password != null)) config.fudo.users;
in {
users = mapAttrs (username: userOpts: {
@@ -174,31 +180,35 @@ in {
gid = groupOpts.gid-number;
description = groupOpts.description;
members = filterExistingUsers ldapUsers groupOpts.members;
}) cfg.groups;
}) config.fudo.groups;
system-users = mapAttrs (username: userOpts: {
description = userOpts.description;
hashed-password = userOpts.ldap-hashed-passwd;
}) cfg.system-users;
}) config.fudo.system-users;
};
users = {
users = mapAttrs (username: userOpts: {
isNormalUser = true;
uid = userOpts.uidNumber;
uid = userOpts.uid;
createHome = true;
description = userOpts.common-name;
group = userOpts.primary-group;
home = userOpts.home;
home = if (userOpts.home-directory != null) then userOpts.home-directory else "/home/${userOpts.primary-group}/${username}";
hashedPassword = userOpts.login-hashed-passwd;
openssh.authorizedKeys.keys = userOpts.ssh-authorized-keys;
}) local-users;
groups = mapAttrs (groupname: groupOpts: {
gid = groupOpts.gidNumber;
description = groupOpts.description;
members = filterExistingUsers localUsers groupOpts.members;
}) local-groups;
groups = (mapAttrs (groupname: groupOpts: {
gid = groupOpts.gid;
members = filterExistingUsers local-users groupOpts.members;
}) local-groups) //
{
wheel = {
members = local-admins;
};
};
};
home-manager.users = let
lib/fudo/wireless-networks.nix
+2 -2
View File
@@ -18,14 +18,14 @@ let
};
in {
option.fudo.wireless-networks = mkOption {
options.fudo.wireless-networks = mkOption {
type = with types; listOf (submodule networkOpts);
description = "A map of wireless networks to attributes (including key).";
default = { };
};
config = {
wireless.networks =
networking.wireless.networks =
mapAttrs (network: networkOpts: { psk = networkOpts.key; })
config.fudo.wireless-networks;
};
lib/instance.nix
+1
View File
@@ -1,5 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
{
options.instance = {
hostname = mkOption {