Move profiles from ./profile-config to ./profile
This commit is contained in:
@@ -8,6 +8,7 @@
|
||||
./groups.nix
|
||||
./hosts.nix
|
||||
./networks.nix
|
||||
./profile.nix
|
||||
./sites.nix
|
||||
./users.nix
|
||||
./wireless-networks.nix
|
||||
|
||||
@@ -49,7 +49,7 @@
|
||||
|
||||
hardware.bluetooth.enable = false;
|
||||
|
||||
network = {
|
||||
networking = {
|
||||
macvlans = {
|
||||
intif0 = {
|
||||
interface = "enp4s0f1";
|
||||
|
||||
+138
-24
@@ -10,10 +10,17 @@ let
|
||||
host-fqdn = "${hostname}.${domain-name}";
|
||||
mail-hostname = "mail.fudo.org";
|
||||
|
||||
france-secrets = config.fudo.secrets.host-secrets.france;
|
||||
secrets = config.fudo.secrets.host-secrets.france;
|
||||
secret-files = config.fudo.secrets.files;
|
||||
|
||||
acme-private-key = hostname: "/var/lib/acme/${hostname}/key.pem";
|
||||
acme-certificate = hostname: "/var/lib/acme/${hostname}/fullchain.pem";
|
||||
letsencrypt-full-chain = name: chain: pkgs.stdenv.mkDerivation {
|
||||
name = "${name}-letsencrypt-full-chain.pem";
|
||||
phases = "installPhase";
|
||||
installPhase = ''
|
||||
cat ${chain} > $out
|
||||
cat ${pkgs.letsencrypt-ca}/ca.pem >> $out
|
||||
'';
|
||||
};
|
||||
|
||||
in {
|
||||
imports = let
|
||||
@@ -28,9 +35,66 @@ in {
|
||||
in nix-files ./france;
|
||||
|
||||
config = {
|
||||
security.acme.email = "admin@fudo.org";
|
||||
|
||||
fudo = {
|
||||
hosts.france.external-interfaces = [ "extif0" ];
|
||||
|
||||
acme.host-domains.france."france.fudo.org" = {
|
||||
email = "admin@fudo.org";
|
||||
local-copies = {
|
||||
postgres = {
|
||||
user = config.services.postgresql.user;
|
||||
};
|
||||
openldap = {
|
||||
user = config.services.openldap.user;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
secrets.host-secrets.${hostname} = let
|
||||
ldap-user = config.services.openldap.user;
|
||||
ldap-group = config.services.openldap.group;
|
||||
in {
|
||||
ldap-ssl-certificate = {
|
||||
source-file = cfg.ssl-certificate;
|
||||
target-file = "/run/openldap/ssl-certificate.pem";
|
||||
user = ldap-user;
|
||||
group = ldap-group;
|
||||
permissions = "0444";
|
||||
};
|
||||
ldap-ssl-private-key = {
|
||||
source-file = cfg.ssl-private-key;
|
||||
target-file = "/run/openldap/ssl-private-key.pem";
|
||||
user = ldap-user;
|
||||
group = ldap-group;
|
||||
};
|
||||
ldap-ssl-ca-certificate = {
|
||||
source-file = cfg.ssl-ca-certificate;
|
||||
target-file = "/run/openldap/ssl-ca-certificate.pem";
|
||||
user = ldap-user;
|
||||
group = ldap-group;
|
||||
permissions = "0444";
|
||||
};
|
||||
ldap-keytab = {
|
||||
source-file = secret-files.service-keytabs.france.ldap;
|
||||
target-file = "/run/openldap/ldap.keytab";
|
||||
user = ldap-user;
|
||||
group = ldap-group;
|
||||
};
|
||||
ldap-root-passwd = {
|
||||
source-file = passwd.random-passwd-file;
|
||||
target-file = "/run/openldap/root.passwd";
|
||||
user = ldap-user;
|
||||
group = ldap-group;
|
||||
};
|
||||
postgres-keytab = {
|
||||
source-file = secret-files.service-keytabs.france.postgres;
|
||||
target-file = "/run/postgres/postgres.keytab";
|
||||
user = config.services.postgresql.user;
|
||||
};
|
||||
};
|
||||
|
||||
client.dns = {
|
||||
enable = true;
|
||||
ipv4 = true;
|
||||
@@ -40,16 +104,53 @@ in {
|
||||
};
|
||||
|
||||
france = {
|
||||
ldap = let
|
||||
cert-copy = config.fudo.acme.host-domains.france."france.fudo.org".local-copies.openldap;
|
||||
chain = "${letsencrypt-full-chain "openldap-france" cert-copy.chain}";
|
||||
in {
|
||||
ssl-certificate = cert-copy.certificate;
|
||||
ssl-private-key = cert-copy.private-key;
|
||||
ssl-ca-certificate = chain;
|
||||
keytab = secrets.ldap-keytab.target-file;
|
||||
root-password-file = secrets.ldap-root-passwd.target-file;
|
||||
};
|
||||
|
||||
kdc = {
|
||||
state-directory = "/state/kerberos";
|
||||
master-key-file = "";
|
||||
listen-ips = [ primary-ip "127.0.0.1" "127.0.1.1" "::1" ];
|
||||
};
|
||||
|
||||
jabber = {
|
||||
ldap-servers = [ "france.fudo.org" ];
|
||||
listen-ips = [ primary-ip ];
|
||||
};
|
||||
|
||||
backplane = {
|
||||
host-passwd-files = let
|
||||
hosts = attrNames config.fudo.hosts;
|
||||
in mapAttrs (hostname: hostOpts: hostOpts.backplane-password-file)
|
||||
config.fudo.hosts;
|
||||
service-passwd-files = genAttrs [ "dns" ]
|
||||
(service-name:
|
||||
lib.fudo.passwd.stablerandom-passwd-file
|
||||
"${service-name}-service-backplane-passwd"
|
||||
"${service-name}-service-backplane-passwd-${config.instance.build-seed}");
|
||||
};
|
||||
|
||||
backplane-server = {
|
||||
listen-ips = [ primary-ip ];
|
||||
};
|
||||
|
||||
mail = {
|
||||
mail-directory = "/state/mail-server/mail";
|
||||
state-directory = "/state/mail-server/var";
|
||||
mail-directory = "/srv/mail/mailboxes";
|
||||
state-directory = "/srv/mail/var";
|
||||
ldap-server-urls = [
|
||||
"ldap://france.fudo.org"
|
||||
];
|
||||
};
|
||||
|
||||
webmail = {
|
||||
# TODO: this is not using the database!
|
||||
mail-server = mail-hostname;
|
||||
database.hostname = "localhost";
|
||||
};
|
||||
@@ -58,6 +159,15 @@ in {
|
||||
repository-directory = "/state/gitea/repo";
|
||||
state-directory = "/state/gitea/state";
|
||||
ssh.listen-ip = git-server-ip;
|
||||
database-host = "localhost";
|
||||
};
|
||||
|
||||
postgresql = let
|
||||
cert-copy = config.fudo.acme.host-domains.france."france.fudo.org".local-copies.postgres;
|
||||
in {
|
||||
keytab = secrets.postgres-keytab.target-file;
|
||||
ssl-certificate = cert-copy.certificate;
|
||||
ssl-private-key = cert-copy.private-key;
|
||||
};
|
||||
};
|
||||
|
||||
@@ -71,23 +181,27 @@ in {
|
||||
};
|
||||
|
||||
networking = {
|
||||
intif0 = {
|
||||
ipv4.addresses = [{
|
||||
address = "192.168.11.1";
|
||||
prefixLength = 24;
|
||||
}];
|
||||
};
|
||||
extif0 = {
|
||||
ipv4.addresses = [
|
||||
{
|
||||
address = primary-ip;
|
||||
prefixLength = 28;
|
||||
}
|
||||
{
|
||||
address = git-server-ip;
|
||||
prefixLength = 32;
|
||||
}
|
||||
];
|
||||
useDHCP = false;
|
||||
|
||||
interfaces = {
|
||||
intif0 = {
|
||||
ipv4.addresses = [{
|
||||
address = "192.168.11.1";
|
||||
prefixLength = 24;
|
||||
}];
|
||||
};
|
||||
extif0 = {
|
||||
ipv4.addresses = [
|
||||
{
|
||||
address = primary-ip;
|
||||
prefixLength = 28;
|
||||
}
|
||||
{
|
||||
address = git-server-ip;
|
||||
prefixLength = 32;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -95,7 +209,7 @@ in {
|
||||
nginx = {
|
||||
enable = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisations = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedProxySettings = true;
|
||||
|
||||
|
||||
@@ -7,83 +7,79 @@ let
|
||||
site-name = config.instance.local-site;
|
||||
fqdn = "${hostname}.${domain-name}";
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.france;
|
||||
|
||||
# same as genAttr, but takes back attrsets and merges them
|
||||
concatGenAttrs = lst: f:
|
||||
foldr (a0: a1: a0 // a1) {} (map f lst);
|
||||
|
||||
passwd = import ../../../lib/passwd.nix { inherit lib; };
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
cfg = config.fudo.france;
|
||||
|
||||
in {
|
||||
options.france = with types; {
|
||||
options.fudo.france = with types; {
|
||||
ldap = {
|
||||
ssl-certificate = mkOption {
|
||||
type = path;
|
||||
type = str;
|
||||
description = "SSL certificate to use for the LDAP server.";
|
||||
};
|
||||
ssl-private-key = mkOption {
|
||||
type = path;
|
||||
type = str;
|
||||
description = "SSL private key to use for the LDAP server.";
|
||||
};
|
||||
ssl-ca-certificate = mkOption {
|
||||
type = path;
|
||||
type = str;
|
||||
description = "SSL certificate authority to use for the LDAP server.";
|
||||
};
|
||||
keytab = mkOption {
|
||||
type = str;
|
||||
description = "Path to the LDAP service keytab.";
|
||||
};
|
||||
root-password-file = mkOption {
|
||||
type = str;
|
||||
description = "Path to the file containing the LDAP root password.";
|
||||
};
|
||||
};
|
||||
|
||||
kdc = {
|
||||
state-directory = mkOption {
|
||||
type = str;
|
||||
description = "Path at which to store kerberos state.";
|
||||
default = "/state/kerberos";
|
||||
};
|
||||
|
||||
master-key-file = mkOption {
|
||||
type = str;
|
||||
description = "Heimdal database master key file.";
|
||||
};
|
||||
|
||||
listen-ips = mkOption {
|
||||
type = listOf str;
|
||||
description = "IP addresses on which to listen for connections.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
fudo = {
|
||||
secrets.host-secrets.${hostname} = {
|
||||
ldap-ssl-certificate = {
|
||||
source-file = cfg.ssl-certificate;
|
||||
target-file = "/var/run/ldap/ssl-certificate.pem";
|
||||
user = config.services.openldap.user;
|
||||
group = config.services.openldap.group;
|
||||
permissions = "0444";
|
||||
};
|
||||
ldap-ssl-private-key = {
|
||||
source-file = cfg.ssl-private-key;
|
||||
target-file = "/var/run/ldap/ssl-private-key.pem";
|
||||
user = config.services.openldap.user;
|
||||
group = config.services.openldap.group;
|
||||
permissions = "0400";
|
||||
};
|
||||
ldap-ssl-ca-certificate = {
|
||||
source-file = cfg.ssl-ca-certificate;
|
||||
target-file = "/var/run/ldap/ssl-ca-certificate.pem";
|
||||
user = config.services.openldap.user;
|
||||
group = config.services.openldap.group;
|
||||
permissions = "0400";
|
||||
};
|
||||
secrets.host-secrets.${hostname}.kdc-master-key = {
|
||||
source-file = cfg.kdc.master-key-file;
|
||||
target-file = "/run/kerberos/kdc/master.key";
|
||||
user = config.fudo.auth.kdc.user;
|
||||
};
|
||||
|
||||
auth = {
|
||||
ldap = {
|
||||
ldap-server = {
|
||||
enable = true;
|
||||
base = "dc=fudo,dc=org";
|
||||
organization = "Fudo";
|
||||
rootpw-file = secrets.ldap-root-passwd;
|
||||
rootpw-file = cfg.ldap.root-password-file;
|
||||
kerberos-host = fqdn;
|
||||
kerberos-keytab = secrets.ldap-keytab;
|
||||
|
||||
sslCert =
|
||||
secrets.ldap-ssl-certificate.target-file;
|
||||
sslKey =
|
||||
secrets.ldap-ssl-private-key.target-file;
|
||||
sslCACert =
|
||||
secrets.ldap-ssl-ca-certificate.target-file;
|
||||
kerberos-keytab = cfg.ldap.keytab;
|
||||
ssl-certificate = cfg.ldap.ssl-certificate;
|
||||
ssl-private-key = cfg.ldap.ssl-private-key;
|
||||
ssl-ca-certificate = cfg.ldap.ssl-ca-certificate;
|
||||
|
||||
listen-uris = [ "ldap:///" "ldaps:///" "ldapi:///" ];
|
||||
|
||||
@@ -95,9 +91,9 @@ in {
|
||||
# TODO: let build hosts create keys?
|
||||
kdc = {
|
||||
enable = true;
|
||||
realm = config.domains.${domain-name}.gssapi-realm;
|
||||
state-directory = cfg.state-directory;
|
||||
master-key-file = cfg.master-key-file;
|
||||
realm = config.fudo.domains.${domain-name}.gssapi-realm;
|
||||
state-directory = cfg.kdc.state-directory;
|
||||
master-key-file = secrets.kdc-master-key.target-file;
|
||||
acl = let
|
||||
admin-entries = concatGenAttrs
|
||||
config.instance.local-admins
|
||||
@@ -109,7 +105,7 @@ in {
|
||||
"host/*.fudo.org" = { perms = [ "add" ]; };
|
||||
"pam_migrate/*.fudo.org" = { perms = [ "add" "change-password" ]; };
|
||||
} // admin-entries;
|
||||
bind-addresses = [ primary-ip "127.0.0.1" "127.0.1.1" "::1" ];
|
||||
bind-addresses = cfg.kdc.listen-ips;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -0,0 +1,148 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
hostname = config.instance.hostname;
|
||||
timestamp = config.instance.build-timestamp;
|
||||
domain = config.instance.local-domain;
|
||||
|
||||
powerdns-user = "backplane-powerdns";
|
||||
backplane-dns-user = "backplane-dns";
|
||||
|
||||
generate-role-passwd = role:
|
||||
lib.fudo.passwd.stablerandom-password-file
|
||||
"backplane-${role}-password"
|
||||
"${hostname}-${domain}-${role}-password-${config.instance.build-timestamp}";
|
||||
|
||||
powerdns-password = generate-role-passwd "powerdns-db";
|
||||
|
||||
backplane-dns-xmpp-password = generate-role-passwd "backplane-dns-xmpp";
|
||||
|
||||
backplane-dns-db-password = generate-role-passwd "backplane-dns-db";
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.france;
|
||||
|
||||
cfg = config.fudo.france.backplane-server;
|
||||
|
||||
in {
|
||||
options.fudo.france.backplane-server = with types; {
|
||||
listen-ips = mkOption {
|
||||
type = listOf str;
|
||||
description = "List of IPs on which to listen for incoming backplane connections.";
|
||||
};
|
||||
|
||||
listen-ipv6s = mkOption {
|
||||
type = listOf str;
|
||||
description = "List of IPv6s on which to listen for incoming backplane connections.";
|
||||
default = [];
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
users = {
|
||||
users = {
|
||||
${powerdns-user} = {
|
||||
isSystemUser = true;
|
||||
};
|
||||
${backplane-dns-user} = {
|
||||
isSystemUser = true;
|
||||
};
|
||||
};
|
||||
|
||||
groups = {
|
||||
${powerdns-user} = {
|
||||
members = [ powerdns-user ];
|
||||
};
|
||||
${backplane-dns-user} = {
|
||||
members = [ backplane-dns-user ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
fudo = {
|
||||
secrets.host-secrets.france = {
|
||||
powerdns-password = {
|
||||
source-file = powerdns-password;
|
||||
target-file = "/run/backplane/dns/powerdns/db.passwd";
|
||||
user = config.fudo.backplane.dns.database.user;
|
||||
};
|
||||
|
||||
backplane-dns-db-password = {
|
||||
source-file = backplane-dns-db-password;
|
||||
target-file = "/run/backplane/dns/db.passwd";
|
||||
user = config.fudo.backplane.dns.backplane.user;
|
||||
};
|
||||
|
||||
backplane-dns-xmpp-password = {
|
||||
source-file = backplane-dns-db-password;
|
||||
target-file = "/run/backplane/dns/xmpp.passwd";
|
||||
user = config.fudo.backplane.dns.backplane.user;
|
||||
};
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
required-services = [ "fudo-passwords.target" ];
|
||||
|
||||
users = {
|
||||
${powerdns-user} = {
|
||||
password-file = secrets.powerdns-password.target-file;
|
||||
databases = {
|
||||
backplane_dns = {
|
||||
access = "CONNECT";
|
||||
entity-access = {
|
||||
"ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
|
||||
"ALL SEQUENCES IN SCHEMA public" = "SELECT,UPDATE";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
${backplane-dns-user} = {
|
||||
password-file = secrets.backplane-dns-db-password;
|
||||
databases = {
|
||||
backplane_dns = {
|
||||
access = "CONNECT";
|
||||
entity-access = {
|
||||
"ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
|
||||
"ALL SEQUENCES IN SCHEMA public" = "SELECT,UPDATE";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
databases = {
|
||||
backplane_dns = {
|
||||
users = ["niten"];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
backplane.dns = {
|
||||
enable = true;
|
||||
listen-v4-addresses = cfg.listen-ips;
|
||||
listen-v6-addresses = cfg.listen-ipv6s;
|
||||
user = backplane-dns-user;
|
||||
group = backplane-dns-user;
|
||||
database = {
|
||||
username = powerdns-user;
|
||||
database = "backplane_dns";
|
||||
# Uses an IP to avoid cyclical dependency...
|
||||
host = "127.0.0.1";
|
||||
password-file = secrets.powerdns-password.target-file;
|
||||
};
|
||||
backplane = {
|
||||
host = "backplane.fudo.org";
|
||||
role = "service-dns";
|
||||
password-file = secrets.backplane-dns-xmpp-password.target-file;
|
||||
database = {
|
||||
username = backplane-dns-user;
|
||||
database = backplane-dns-user;
|
||||
host = "127.0.0.1";
|
||||
password-file = secrets.backplane-dns-db-password.target-file;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -7,14 +7,16 @@ let
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
cfg = config.fudo.france.git;
|
||||
|
||||
sshOpts = { ... }: {
|
||||
options = {
|
||||
options = with types; {
|
||||
listen-ip = mkOption {
|
||||
type = str;
|
||||
description = "IP address on which to listen for SSH connections.";
|
||||
};
|
||||
listen-port = mkOption {
|
||||
type = str;
|
||||
type = port;
|
||||
description = "Port on which to listen for SSH connections.";
|
||||
default = 22;
|
||||
};
|
||||
@@ -23,7 +25,7 @@ let
|
||||
|
||||
|
||||
in {
|
||||
options.france.git = with types; {
|
||||
options.fudo.france.git = with types; {
|
||||
repository-directory = mkOption {
|
||||
type = str;
|
||||
description = "Path to store git repositories.";
|
||||
@@ -43,6 +45,14 @@ in {
|
||||
};
|
||||
|
||||
config.fudo = {
|
||||
secrets.host-secrets.${hostname}.git-database-password = {
|
||||
source-file = lib.fudo.passwd.stablerandom-passwd-file
|
||||
"gitea-database-passwd"
|
||||
"${hostname}-gitea-database-passwd-${config.instance.build-seed}";
|
||||
target-file = "/var/gitea/database.passwd";
|
||||
user = config.services.gitea.user;
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
databases.fudo_git.users =
|
||||
config.instance.local_admins;
|
||||
|
||||
@@ -4,24 +4,108 @@ with lib;
|
||||
let
|
||||
hostname = config.instance.hostname;
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
|
||||
cfg = config.fudo.france;
|
||||
|
||||
generate-auth-file = name: files: let
|
||||
make-entry = name: passwd-file:
|
||||
''("${name}" . "${readFile passwd-file}")'';
|
||||
entries = mapAttrsToList make-entry files;
|
||||
content = concatStringsSep "\n" entries;
|
||||
in writeText "${name}-backplane-auth.scm" "'(${content})'";
|
||||
|
||||
host-auth-file = generate-auth-file "host" cfg.host-passwd-files;
|
||||
service-auth-file = generate-auth-filre "service" cfg.service-passwd-files;
|
||||
|
||||
ldap-password-file =
|
||||
lib.fudo.passwd.random-passwd-file "ejabberd-ldap-auth-user";
|
||||
|
||||
ldap-hashed-password =
|
||||
hash-ldap-passwd "ejabberd-ldap-hashed-passwd" ldap-password-file;
|
||||
|
||||
in {
|
||||
options.fudo.france = with types; {
|
||||
jabber = {
|
||||
ldap-user = mkOption {
|
||||
type = str;
|
||||
description = "System user as which to authenticate to LDAP.";
|
||||
default = "ejabberd";
|
||||
};
|
||||
|
||||
ldap-servers = mkOption {
|
||||
type = listOf str;
|
||||
description = "LDAP servers to use for user authentication.";
|
||||
};
|
||||
|
||||
listen-ips = mkOption {
|
||||
type = listOf str;
|
||||
description = "IPs on which to listen for incoming connections.";
|
||||
};
|
||||
};
|
||||
|
||||
backplane = {
|
||||
host-passwd-files = mkOption {
|
||||
type = attrsOf str;
|
||||
description = "Map of hostname to password file, for backplane host authentication.";
|
||||
default = {};
|
||||
};
|
||||
|
||||
service-passwd-files = mkOption {
|
||||
type = attrsOf str;
|
||||
description = "Map of service to password file, for backplane service authentication.";
|
||||
default = {};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
fudo = {
|
||||
system-users.${cfg.jabber.ldap-user} = {
|
||||
description = "ejabberd authentication user.";
|
||||
hashed-password = ldap-hashed-password;
|
||||
};
|
||||
|
||||
secrets.host-secrets.${hostname} = let
|
||||
user = config.services.ejabberd.user;
|
||||
in {
|
||||
host-auth = {
|
||||
source-file = host-auth-file;
|
||||
target-file = "/run/backplane/host-auth-file.scm";
|
||||
user = user;
|
||||
};
|
||||
service-auth = {
|
||||
source-file = service-auth-file;
|
||||
target-file = "/run/backplane/service-auth-file.scm";
|
||||
user = user;
|
||||
};
|
||||
ldap-password = {
|
||||
source-file = ldap-password-file;
|
||||
target-file = "/run/ejabberd/ldap.passwd";
|
||||
user = user;
|
||||
};
|
||||
};
|
||||
|
||||
jabber = {
|
||||
enable = true;
|
||||
|
||||
listen-ips = cfg.jabber.listen-ips;
|
||||
|
||||
environment = {
|
||||
FUDO_HOST_PASSWD_FILE = secrets.host-auth.target-file;
|
||||
FUDO_SERVICE_PASSWD_FILE = secrets.service-auth.target-file;
|
||||
};
|
||||
|
||||
secret-files = {
|
||||
LDAP_PASSWORD = secrets.jabber-ldap-password.target-file;
|
||||
LDAP_PASSWORD = secrets.ldap-password.target-file;
|
||||
};
|
||||
|
||||
sites = {
|
||||
"fudo.im" = {
|
||||
site-config = {
|
||||
auth_method = "ldap";
|
||||
ldap_servers = [ "auth.fudo.org" ];
|
||||
ldap_servers = cfg.jabber.ldap-servers;
|
||||
ldap_port = 389;
|
||||
ldap_rootdn = "cn=jabber,dc=fudo,dc=org";
|
||||
ldap_rootdn = "cn=${cfg.jabber.ldap-user},dc=fudo,dc=org";
|
||||
ldap_password = ''"LDAP_PASSWD"'';
|
||||
ldap_base = "ou=members,dc=fudo,dc=org";
|
||||
ldap_filter = "(objectClass=posixAccount)";
|
||||
@@ -69,7 +153,7 @@ in {
|
||||
"backplane.fudo.org" = {
|
||||
site-config = {
|
||||
auth_method = "external";
|
||||
extauth_program = "${pkgs.guile}/bin/guile -s ${backplane-auth}";
|
||||
extauth_program = "${pkgs.guile}/bin/guile -s ${pkgs.backplane-auth}/backplane-auth.scm";
|
||||
extauth_pool_size = 3;
|
||||
auth_use_cache = true;
|
||||
|
||||
@@ -100,7 +184,6 @@ in {
|
||||
mod_time = {};
|
||||
mod_version = {};
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -9,7 +9,7 @@ let
|
||||
|
||||
mail-reader-dn = "mail-auth-reader";
|
||||
in {
|
||||
options.france.mail = with types; {
|
||||
options.fudo.france.mail = with types; {
|
||||
mail-directory = mkOption {
|
||||
type = str;
|
||||
description = "Directory to contain user maildirs.";
|
||||
@@ -39,17 +39,20 @@ in {
|
||||
enableContainer = true;
|
||||
monitoring = true;
|
||||
|
||||
hostname = "mail.${domain-name}";
|
||||
domain = domain-name;
|
||||
mail-hostname = "mail.${domain-name}";
|
||||
|
||||
dovecot = {
|
||||
ldap = {
|
||||
reader-dn = "cn=${mail-reader-dn},${config.fudo.auth.ldap.base}";
|
||||
reader-password-file = secrets.mail-reader-passwd.target-file;
|
||||
server-urls = cfg.ldap-server-urls;
|
||||
};
|
||||
};
|
||||
|
||||
state-directory = cfg.state-directory;
|
||||
mail-directory = cfg.mail-directory;
|
||||
|
||||
dovecot.ldap = {
|
||||
reader-dn = "cn=mail-reader-dn,${config.fudo.auth.ldap.base}";
|
||||
reader-password-file = secrets.mail-reader-passwd.target-file;
|
||||
server-urls = cfg.ldap-server-urls;
|
||||
};
|
||||
|
||||
clamav.enable = true;
|
||||
dkim.signing = true;
|
||||
};
|
||||
|
||||
@@ -5,14 +5,28 @@ let
|
||||
hostname = config.instance.hostname;
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
in {
|
||||
options.fudo.france.postgresql = with types; {
|
||||
ssl-certificate = mkOption {
|
||||
type = str;
|
||||
description = "SSL certificate to use for the LDAP server.";
|
||||
};
|
||||
ssl-private-key = mkOption {
|
||||
type = str;
|
||||
description = "SSL private key to use for the LDAP server.";
|
||||
};
|
||||
keytab = mkOption {
|
||||
type = path;
|
||||
description = "Postgres service keytab.";
|
||||
};
|
||||
};
|
||||
|
||||
config.fudo.postgresql = {
|
||||
enable = true;
|
||||
|
||||
local-networks = config.instance.local-networks;
|
||||
admin-users = config.instance.admin-users;
|
||||
|
||||
ssl-private-key = secrets.postgres-ssl-key;
|
||||
ssl-certificate = secrets.postgres-ssl-certificate;
|
||||
keytab = secrets.postgres-keytab.target-file;
|
||||
ssl-private-key = cfg.ssl-private-key;
|
||||
ssl-certificate = cfg.ssl-certificate;
|
||||
keytab = cfg.keytab;
|
||||
};
|
||||
}
|
||||
|
||||
@@ -17,7 +17,7 @@ let
|
||||
db-passwd = pkgs.lib.fudo.passwd.random-passwd-file "webmail" 40;
|
||||
|
||||
in {
|
||||
options.france.webmail = with types; {
|
||||
options.fudo.france.webmail = with types; {
|
||||
mail-server = mkOption {
|
||||
type = str;
|
||||
description = "Mail server to use for webmail.";
|
||||
|
||||
@@ -22,6 +22,8 @@ let
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.procul;
|
||||
|
||||
passwd = pkgs.lib.fudo.passwd;
|
||||
|
||||
in {
|
||||
networking = {
|
||||
dhcpcd.enable = false;
|
||||
@@ -85,75 +87,17 @@ in {
|
||||
fudo = {
|
||||
hosts.procul.external-interfaces = [ "extif0" ];
|
||||
|
||||
jabber = {
|
||||
enable = true;
|
||||
|
||||
secret-files = {
|
||||
SECRET = secrets.jabber-ldap-password.traget-file;
|
||||
};
|
||||
|
||||
sites."informis.land" = {
|
||||
site-config = {
|
||||
auth_method = "ldap";
|
||||
ldap_servers = [ "auth.fudo.org" ];
|
||||
ldap_port = 636;
|
||||
ldap_rootdn = "cn=jabber,dc=fudo,dc=org";
|
||||
ldap_password = ''"LDAP_PASSWD"'';
|
||||
ldap_base = "ou=members,dc=fudo,dc=org";
|
||||
ldap_filter = "(objectClass=posixAccount)";
|
||||
ldap_uids = { uid = "%u"; };
|
||||
|
||||
modules = {
|
||||
mod_adhoc = {};
|
||||
mod_announce = {};
|
||||
mod_avatar = {};
|
||||
mod_blocking = {};
|
||||
mod_caps = {};
|
||||
mod_carboncopy = {};
|
||||
mod_client_state = {};
|
||||
mod_configure = {};
|
||||
mod_disco = {};
|
||||
mod_fail2ban = {};
|
||||
mod_last = {};
|
||||
mod_offline = {
|
||||
access_max_user_messages = 5000;
|
||||
};
|
||||
mod_ping = {};
|
||||
mod_privacy = {};
|
||||
mod_private = {};
|
||||
mod_pubsub = {
|
||||
access_createnode = "pubsub_createnode";
|
||||
ignore_pep_from_offline = true;
|
||||
last_item_cache = false;
|
||||
plugins = [
|
||||
"flat"
|
||||
"pep"
|
||||
];
|
||||
};
|
||||
mod_roster = {};
|
||||
mod_stream_mgmt = {};
|
||||
mod_time = {};
|
||||
mod_vcard = {
|
||||
search = false;
|
||||
};
|
||||
mod_vcard_xupdate = {};
|
||||
mod_version = {};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
secrets.host-secrets.procul = let
|
||||
secrets = config.fudo.secrets.files;
|
||||
files = config.fudo.secrets.files;
|
||||
in {
|
||||
postgres-keytab = {
|
||||
source-file = secrets.service-keytabs.procul.postgres;
|
||||
source-file = files.service-keytabs.procul.postgres;
|
||||
target-file = "/srv/postgres/secure/postgres.keytab";
|
||||
user = "root";
|
||||
};
|
||||
|
||||
gitea-database-password = {
|
||||
source-file = secrets.service-passwords.procul.gitea-database;
|
||||
source-file = files.service-passwords.procul.gitea-database;
|
||||
target-file = "/srv/gitea/secure/database.passwd";
|
||||
user = config.fudo.git.user;
|
||||
};
|
||||
|
||||
+11
-1
@@ -1,8 +1,18 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
syslib = pkgs.callPackage ../lib/hosts.nix {};
|
||||
|
||||
in {
|
||||
config.fudo.hosts = syslib.base-host-config ./hosts;
|
||||
config.fudo.hosts = let
|
||||
build-seed = config.instance.build-seed;
|
||||
base-config = syslib.base-host-config ./hosts;
|
||||
in mapAttrs (hostname: base-config:
|
||||
base-config // {
|
||||
backplane-password-file =
|
||||
pkgs.lib.fudo.passwd.stablerandom-passwd-file
|
||||
"${hostname}-host-backplane-passwd"
|
||||
"${hostname}-host-backplane-passwd-${build-seed}";
|
||||
}) base-config;
|
||||
}
|
||||
|
||||
@@ -1,140 +1,4 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
hostname = config.instance.hostname;
|
||||
enable-gui = config.fudo.hosts.${hostname}.enable-gui;
|
||||
|
||||
in {
|
||||
imports = [ ./common.nix ];
|
||||
|
||||
boot.plymouth.enable = false;
|
||||
|
||||
boot.tmpOnTmpfs = true;
|
||||
|
||||
environment = mkIf enable-gui {
|
||||
systemPackages = [
|
||||
#libva
|
||||
];
|
||||
};
|
||||
|
||||
# We're deploying via nixops, this is just annoying
|
||||
system = { autoUpgrade.enable = false; };
|
||||
|
||||
services = {
|
||||
xserver = mkIf enable-gui {
|
||||
enable = true;
|
||||
|
||||
desktopManager.gnome.enable = true;
|
||||
|
||||
displayManager.gdm = {
|
||||
enable = true;
|
||||
wayland = false;
|
||||
};
|
||||
|
||||
windowManager.stumpwm.enable = true;
|
||||
|
||||
# windowManager.session = pkgs.lib.singleton {
|
||||
# name = "stumpwm";
|
||||
# start = ''
|
||||
# ${pkgs.lispPackages.stumpwm}/bin/stumpwm &
|
||||
# waidPID=$!
|
||||
# '';
|
||||
# };
|
||||
};
|
||||
|
||||
trezord.enable = true;
|
||||
};
|
||||
|
||||
hardware = {
|
||||
bluetooth.enable = true;
|
||||
|
||||
opengl = mkIf enable-gui {
|
||||
enable = true;
|
||||
driSupport = true;
|
||||
driSupport32Bit = true;
|
||||
};
|
||||
};
|
||||
|
||||
sound.enable = true;
|
||||
hardware.pulseaudio = {
|
||||
enable = true;
|
||||
support32Bit = config.hardware.pulseaudio.enable;
|
||||
};
|
||||
|
||||
console.font =
|
||||
lib.mkDefault "${pkgs.terminus_font}/share/consolefonts/ter-g18n.psf.gz";
|
||||
|
||||
services.gnome = mkIf enable-gui {
|
||||
evolution-data-server.enable = mkForce false;
|
||||
gnome-user-share.enable = mkForce false;
|
||||
};
|
||||
|
||||
services.flatpak.enable = enable-gui;
|
||||
|
||||
# programs.steam.enable = enable-gui;
|
||||
|
||||
fonts = mkIf enable-gui {
|
||||
fontDir.enable = true;
|
||||
fontconfig.enable = true;
|
||||
#fontconfig.antialias = true;
|
||||
#fontconfig.penultimate.enable = true;
|
||||
#fontconfig.subpixel.lcdfilter = "default";
|
||||
|
||||
fonts = with pkgs; [
|
||||
cantarell_fonts
|
||||
dejavu_fonts
|
||||
dina-font
|
||||
dosemu_fonts
|
||||
fira-code
|
||||
fira-code-symbols
|
||||
freefont_ttf
|
||||
liberation_ttf
|
||||
mplus-outline-fonts
|
||||
nerdfonts
|
||||
noto-fonts
|
||||
noto-fonts-cjk
|
||||
noto-fonts-emoji
|
||||
proggyfonts
|
||||
terminus_font
|
||||
ubuntu_font_family
|
||||
ucsFonts
|
||||
ultimate-oldschool-pc-font-pack
|
||||
unifont
|
||||
xorg.fontadobe100dpi
|
||||
xorg.fontadobe75dpi
|
||||
xorg.fontadobeutopia100dpi
|
||||
xorg.fontadobeutopia75dpi
|
||||
xorg.fontadobeutopiatype1
|
||||
xorg.fontarabicmisc
|
||||
xorg.fontbh100dpi
|
||||
xorg.fontbh75dpi
|
||||
xorg.fontbhlucidatypewriter100dpi
|
||||
xorg.fontbhlucidatypewriter75dpi
|
||||
xorg.fontbhttf
|
||||
xorg.fontbhtype1
|
||||
xorg.fontbitstream100dpi
|
||||
xorg.fontbitstream75dpi
|
||||
xorg.fontbitstreamtype1
|
||||
xorg.fontcronyxcyrillic
|
||||
xorg.fontcursormisc
|
||||
xorg.fontdaewoomisc
|
||||
xorg.fontdecmisc
|
||||
xorg.fontibmtype1
|
||||
xorg.fontisasmisc
|
||||
xorg.fontjismisc
|
||||
xorg.fontmicromisc
|
||||
xorg.fontmisccyrillic
|
||||
xorg.fontmiscethiopic
|
||||
xorg.fontmiscmeltho
|
||||
xorg.fontmiscmisc
|
||||
xorg.fontmuttmisc
|
||||
xorg.fontschumachermisc
|
||||
xorg.fontscreencyrillic
|
||||
xorg.fontsonymisc
|
||||
xorg.fontsunmisc
|
||||
xorg.fontwinitzkicyrillic
|
||||
xorg.fontxfree86type1
|
||||
];
|
||||
};
|
||||
{
|
||||
}
|
||||
|
||||
@@ -1,142 +1,5 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
# Available to all users on the system. Keep it minimal.
|
||||
global-packages = with pkgs; [
|
||||
bind
|
||||
cryptsetup
|
||||
git
|
||||
heimdal
|
||||
openssh_gssapi
|
||||
tldr
|
||||
vim
|
||||
wget
|
||||
];
|
||||
|
||||
in {
|
||||
environment = {
|
||||
etc.nixos-live.source = ../../.;
|
||||
|
||||
systemPackages = global-packages;
|
||||
|
||||
# shellInit = ''
|
||||
# ${pkgs.gnupg}/bin/gpg-connect-agent /bye
|
||||
# export SSH_AUTH_SOCK=$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)
|
||||
# '';
|
||||
};
|
||||
|
||||
nix = {
|
||||
package = pkgs.nixFlakes;
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
security.acme.acceptTerms = true;
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
|
||||
krb5 = {
|
||||
enable = true;
|
||||
|
||||
appdefaults = {
|
||||
forwardable = true;
|
||||
proxiable = true;
|
||||
encrypt = true;
|
||||
forward = true;
|
||||
};
|
||||
|
||||
libdefaults = {
|
||||
allow_weak_crypto = true;
|
||||
dns_lookup_kdc = true;
|
||||
dns_lookup_realm = true;
|
||||
forwardable = true;
|
||||
proxiable = true;
|
||||
};
|
||||
|
||||
kerberos = pkgs.heimdalFull;
|
||||
};
|
||||
|
||||
services = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
startWhenNeeded = true;
|
||||
useDns = true;
|
||||
permitRootLogin = "prohibit-password";
|
||||
extraConfig = ''
|
||||
GSSAPIAuthentication yes
|
||||
GSSAPICleanupCredentials yes
|
||||
GSSAPIKeyExchange yes
|
||||
GSSAPIStoreCredentialsOnRekey yes
|
||||
'';
|
||||
};
|
||||
|
||||
fail2ban =
|
||||
let domain-name = config.fudo.hosts.${config.instance.hostname}.domain;
|
||||
in {
|
||||
enable = config.networking.firewall.enable;
|
||||
bantime-increment.enable = true;
|
||||
ignoreIP = config.fudo.domains.${domain-name}.local-networks;
|
||||
};
|
||||
|
||||
xserver = {
|
||||
layout = "us";
|
||||
xkbVariant = "dvp";
|
||||
xkbOptions = "ctrl:nocaps";
|
||||
};
|
||||
|
||||
# pcscd.enable = true;
|
||||
# udev.packages = with pkgs; [ yubikey-personalization ];
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
# Allow mosh connections if the firewall is enabled
|
||||
allowedUDPPortRanges = [{
|
||||
from = 60000;
|
||||
to = 60100;
|
||||
}];
|
||||
};
|
||||
|
||||
console.useXkbConfig = true;
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
programs = {
|
||||
mosh.enable = true;
|
||||
|
||||
bash.enableCompletion = true;
|
||||
|
||||
fish.enable = true;
|
||||
|
||||
gnupg.agent = {
|
||||
enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# pinentryFlavor = if cfg.enable-gui then "gnome3" else "curses";
|
||||
};
|
||||
|
||||
ssh = {
|
||||
startAgent = true;
|
||||
|
||||
package = pkgs.openssh_gssapi;
|
||||
|
||||
extraConfig = ''
|
||||
GSSAPIAuthentication yes
|
||||
GSSAPIDelegateCredentials yes
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
security.pam = {
|
||||
enableSSHAgentAuth = true;
|
||||
|
||||
services = {
|
||||
sshd = {
|
||||
makeHomeDir = true;
|
||||
sshAgentAuth = true;
|
||||
# This isn't supposed to ask for a code unless ~/.google_authenticator exists...but it does
|
||||
# googleAuthenticator.enable = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
{
|
||||
}
|
||||
|
||||
@@ -1,7 +1,4 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib; {
|
||||
imports = [ ./common-ui.nix ];
|
||||
|
||||
config = { networking = { networkmanager.enable = mkForce false; }; };
|
||||
}
|
||||
|
||||
@@ -2,31 +2,4 @@
|
||||
|
||||
with lib;
|
||||
{
|
||||
imports = [ ./common-ui.nix ];
|
||||
|
||||
options.fudo.profile.laptop = {
|
||||
use-network-manager =
|
||||
mkEnableOption "Use NetworkManager instead of wpa_supplicant.";
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
environment.systemPackages = with pkgs; [ acpi upower wpa_supplicant ];
|
||||
|
||||
networking = if (config.fudo.profile.laptop.use-network-manager) then {
|
||||
networkmanager.enable = true;
|
||||
} else {
|
||||
networkmanager.enable = false;
|
||||
wireless = {
|
||||
enable = true;
|
||||
userControlled = {
|
||||
enable = true;
|
||||
group = "wheel";
|
||||
};
|
||||
networks = mapAttrs (network: networkOpts: {
|
||||
psk = networkOpts.key;
|
||||
}) config.fudo.wireless-networks;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,75 +1,5 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
serverPackages = with pkgs; [ emacs-nox reboot-if-necessary test-config ];
|
||||
|
||||
reboot-if-necessary = pkgs.writeShellScriptBin "reboot-if-necessary" ''
|
||||
if [ $# -ne 1 ]; then
|
||||
echo "FAILED: no sync file provided."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
WALL=${pkgs.utillinux}/bin/wall
|
||||
|
||||
if [ -f $1 ]; then
|
||||
$WALL "$1 exists, rebooting system"
|
||||
${pkgs.systemd}/bin/reboot
|
||||
else
|
||||
$WALL "$1 does not exist, switching config."
|
||||
nixos-rebuild switch
|
||||
fi
|
||||
|
||||
exit 0
|
||||
'';
|
||||
|
||||
test-config = pkgs.writeShellScriptBin "fudo-test-config" ''
|
||||
if [ $# -gt 1 ]; then
|
||||
echo "usage: $0 [timeout]"
|
||||
exit 1
|
||||
elif [ $# -eq 1 ]; then
|
||||
TIMEOUT=$1
|
||||
else
|
||||
TIMEOUT=15m
|
||||
fi
|
||||
|
||||
SYNCFILE=$TMP/sync-$(date +"%Y%m%d-%H%M%N")
|
||||
touch $SYNCFILE
|
||||
${pkgs.utillinux}/bin/wall "Launching config. System will restart in $TIMEOUT if $SYNCFILE still exists."
|
||||
systemd-run --on-active=$TIMEOUT ${reboot-if-necessary} $SYNCFILE
|
||||
nixos-rebuild test
|
||||
|
||||
exit 0
|
||||
'';
|
||||
|
||||
in {
|
||||
imports = [ ./common.nix ];
|
||||
|
||||
config = {
|
||||
environment = { systemPackages = serverPackages; };
|
||||
|
||||
system.autoUpgrade.enable = false;
|
||||
|
||||
networking.networkmanager.enable = mkForce false;
|
||||
|
||||
services = { xserver.enable = false; };
|
||||
|
||||
sound.enable = false;
|
||||
hardware.pulseaudio.enable = false;
|
||||
|
||||
powerManagement =
|
||||
if config.fudo.hosts.${config.instance.hostname}.keep-cool then {
|
||||
enable = true;
|
||||
cpuFreqGovernor = "ondemand";
|
||||
} else {
|
||||
enable = false;
|
||||
};
|
||||
|
||||
systemd.targets = {
|
||||
sleep.enable = false;
|
||||
suspend.enable = false;
|
||||
hibernate.enable = false;
|
||||
hybrid-sleep.enable = false;
|
||||
};
|
||||
};
|
||||
{
|
||||
}
|
||||
|
||||
@@ -0,0 +1,131 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
hostname = config.instance.hostname;
|
||||
enable-gui = config.fudo.hosts.${hostname}.enable-gui;
|
||||
|
||||
in {
|
||||
imports = [ ./common.nix ];
|
||||
|
||||
boot = {
|
||||
plymouth.enable = false;
|
||||
tmpOnTmpfs = true;
|
||||
};
|
||||
|
||||
services = {
|
||||
xserver = mkIf enable-gui {
|
||||
enable = true;
|
||||
|
||||
desktopManager.gnome.enable = true;
|
||||
|
||||
displayManager.gdm = {
|
||||
enable = true;
|
||||
wayland = false;
|
||||
autoSuspend = false;
|
||||
};
|
||||
|
||||
windowManager.stumpwm.enable = true;
|
||||
|
||||
# windowManager.session = pkgs.lib.singleton {
|
||||
# name = "stumpwm";
|
||||
# start = ''
|
||||
# ${pkgs.lispPackages.stumpwm}/bin/stumpwm &
|
||||
# waidPID=$!
|
||||
# '';
|
||||
# };
|
||||
};
|
||||
|
||||
trezord.enable = true;
|
||||
};
|
||||
|
||||
hardware = {
|
||||
bluetooth.enable = true;
|
||||
|
||||
opengl = mkIf enable-gui {
|
||||
enable = true;
|
||||
driSupport = true;
|
||||
driSupport32Bit = true;
|
||||
};
|
||||
};
|
||||
|
||||
sound.enable = true;
|
||||
hardware.pulseaudio = {
|
||||
enable = true;
|
||||
support32Bit = config.hardware.pulseaudio.enable;
|
||||
};
|
||||
|
||||
# console.font =
|
||||
# lib.mkDefault "${pkgs.terminus_font}/share/consolefonts/ter-g18n.psf.gz";
|
||||
|
||||
services.gnome = mkIf enable-gui {
|
||||
evolution-data-server.enable = mkForce false;
|
||||
gnome-user-share.enable = mkForce false;
|
||||
};
|
||||
|
||||
services.flatpak.enable = enable-gui;
|
||||
|
||||
fonts = mkIf enable-gui {
|
||||
fontDir.enable = true;
|
||||
fontconfig.enable = true;
|
||||
#fontconfig.antialias = true;
|
||||
#fontconfig.penultimate.enable = true;
|
||||
#fontconfig.subpixel.lcdfilter = "default";
|
||||
|
||||
fonts = with pkgs; [
|
||||
cantarell_fonts
|
||||
dejavu_fonts
|
||||
dina-font
|
||||
dosemu_fonts
|
||||
fira-code
|
||||
fira-code-symbols
|
||||
freefont_ttf
|
||||
liberation_ttf
|
||||
mplus-outline-fonts
|
||||
nerdfonts
|
||||
noto-fonts
|
||||
noto-fonts-cjk
|
||||
noto-fonts-emoji
|
||||
proggyfonts
|
||||
terminus_font
|
||||
ubuntu_font_family
|
||||
ucsFonts
|
||||
ultimate-oldschool-pc-font-pack
|
||||
unifont
|
||||
xorg.fontadobe100dpi
|
||||
xorg.fontadobe75dpi
|
||||
xorg.fontadobeutopia100dpi
|
||||
xorg.fontadobeutopia75dpi
|
||||
xorg.fontadobeutopiatype1
|
||||
xorg.fontarabicmisc
|
||||
xorg.fontbh100dpi
|
||||
xorg.fontbh75dpi
|
||||
xorg.fontbhlucidatypewriter100dpi
|
||||
xorg.fontbhlucidatypewriter75dpi
|
||||
xorg.fontbhttf
|
||||
xorg.fontbhtype1
|
||||
xorg.fontbitstream100dpi
|
||||
xorg.fontbitstream75dpi
|
||||
xorg.fontbitstreamtype1
|
||||
xorg.fontcronyxcyrillic
|
||||
xorg.fontcursormisc
|
||||
xorg.fontdaewoomisc
|
||||
xorg.fontdecmisc
|
||||
xorg.fontibmtype1
|
||||
xorg.fontisasmisc
|
||||
xorg.fontjismisc
|
||||
xorg.fontmicromisc
|
||||
xorg.fontmisccyrillic
|
||||
xorg.fontmiscethiopic
|
||||
xorg.fontmiscmeltho
|
||||
xorg.fontmiscmisc
|
||||
xorg.fontmuttmisc
|
||||
xorg.fontschumachermisc
|
||||
xorg.fontscreencyrillic
|
||||
xorg.fontsonymisc
|
||||
xorg.fontsunmisc
|
||||
xorg.fontwinitzkicyrillic
|
||||
xorg.fontxfree86type1
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,144 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
# Available to all users on the system. Keep it minimal.
|
||||
global-packages = with pkgs; [
|
||||
bind
|
||||
cryptsetup
|
||||
git
|
||||
heimdal
|
||||
openssh_gssapi
|
||||
tldr
|
||||
vim
|
||||
wget
|
||||
];
|
||||
|
||||
in {
|
||||
environment = {
|
||||
etc.nixos-live.source = ../../.;
|
||||
|
||||
systemPackages = global-packages;
|
||||
|
||||
# shellInit = ''
|
||||
# ${pkgs.gnupg}/bin/gpg-connect-agent /bye
|
||||
# export SSH_AUTH_SOCK=$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)
|
||||
# '';
|
||||
};
|
||||
|
||||
system.autoUpgrade.enable = false;
|
||||
|
||||
nix = {
|
||||
package = pkgs.nixFlakes;
|
||||
extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
};
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
security.acme.acceptTerms = true;
|
||||
hardware.enableRedistributableFirmware = true;
|
||||
|
||||
krb5 = {
|
||||
enable = true;
|
||||
|
||||
appdefaults = {
|
||||
forwardable = true;
|
||||
proxiable = true;
|
||||
encrypt = true;
|
||||
forward = true;
|
||||
};
|
||||
|
||||
libdefaults = {
|
||||
allow_weak_crypto = true;
|
||||
dns_lookup_kdc = true;
|
||||
dns_lookup_realm = true;
|
||||
forwardable = true;
|
||||
proxiable = true;
|
||||
};
|
||||
|
||||
kerberos = pkgs.heimdalFull;
|
||||
};
|
||||
|
||||
services = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
startWhenNeeded = true;
|
||||
useDns = true;
|
||||
permitRootLogin = "prohibit-password";
|
||||
extraConfig = ''
|
||||
GSSAPIAuthentication yes
|
||||
GSSAPICleanupCredentials yes
|
||||
GSSAPIKeyExchange yes
|
||||
GSSAPIStoreCredentialsOnRekey yes
|
||||
'';
|
||||
};
|
||||
|
||||
fail2ban = let
|
||||
domain-name = config.fudo.hosts.${config.instance.hostname}.domain;
|
||||
in {
|
||||
enable = config.networking.firewall.enable;
|
||||
bantime-increment.enable = true;
|
||||
ignoreIP = config.instance.local-networks;
|
||||
};
|
||||
|
||||
xserver = {
|
||||
layout = "us";
|
||||
xkbVariant = "dvp";
|
||||
xkbOptions = "ctrl:nocaps";
|
||||
};
|
||||
|
||||
# pcscd.enable = true;
|
||||
# udev.packages = with pkgs; [ yubikey-personalization ];
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
# Allow mosh connections if the firewall is enabled
|
||||
allowedUDPPortRanges = [{
|
||||
from = 60000;
|
||||
to = 60100;
|
||||
}];
|
||||
};
|
||||
|
||||
console.useXkbConfig = true;
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
programs = {
|
||||
mosh.enable = true;
|
||||
|
||||
bash.enableCompletion = true;
|
||||
|
||||
fish.enable = true;
|
||||
|
||||
gnupg.agent = {
|
||||
enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# pinentryFlavor = if cfg.enable-gui then "gnome3" else "curses";
|
||||
};
|
||||
|
||||
ssh = {
|
||||
startAgent = true;
|
||||
|
||||
package = pkgs.openssh_gssapi;
|
||||
|
||||
extraConfig = ''
|
||||
GSSAPIAuthentication yes
|
||||
GSSAPIDelegateCredentials yes
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
security.pam = {
|
||||
enableSSHAgentAuth = true;
|
||||
|
||||
services = {
|
||||
sshd = {
|
||||
makeHomeDir = true;
|
||||
sshAgentAuth = true;
|
||||
# This isn't supposed to ask for a code unless ~/.google_authenticator exists...but it does
|
||||
# googleAuthenticator.enable = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
{
|
||||
imports = [ ./common-ui.nix ];
|
||||
|
||||
config = {
|
||||
networking.networkmanager.enable = mkForce false;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
{
|
||||
imports = [ ./common-ui.nix ];
|
||||
|
||||
options.fudo.profile.laptop = {
|
||||
use-network-manager =
|
||||
mkEnableOption "Use NetworkManager instead of wpa_supplicant.";
|
||||
};
|
||||
|
||||
config = {
|
||||
|
||||
environment.systemPackages = with pkgs; [ acpi upower wpa_supplicant ];
|
||||
|
||||
networking = if (config.fudo.profile.laptop.use-network-manager) then {
|
||||
networkmanager.enable = true;
|
||||
} else {
|
||||
networkmanager.enable = false;
|
||||
wireless = {
|
||||
enable = true;
|
||||
userControlled = {
|
||||
enable = true;
|
||||
group = "wheel";
|
||||
};
|
||||
networks = mapAttrs (network: networkOpts: {
|
||||
psk = networkOpts.key;
|
||||
}) config.fudo.wireless-networks;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,74 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
reboot-if-necessary = pkgs.writeShellScriptBin "reboot-if-necessary" ''
|
||||
if [ $# -ne 1 ]; then
|
||||
echo "FAILED: no sync file provided."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
WALL=${pkgs.utillinux}/bin/wall
|
||||
|
||||
if [ -f $1 ]; then
|
||||
$WALL "$1 exists, rebooting system"
|
||||
${pkgs.systemd}/bin/reboot
|
||||
else
|
||||
$WALL "$1 does not exist, switching config."
|
||||
nixos-rebuild switch
|
||||
fi
|
||||
|
||||
exit 0
|
||||
'';
|
||||
|
||||
test-config = pkgs.writeShellScriptBin "fudo-test-config" ''
|
||||
if [ $# -gt 1 ]; then
|
||||
echo "usage: $0 [timeout]"
|
||||
exit 1
|
||||
elif [ $# -eq 1 ]; then
|
||||
TIMEOUT=$1
|
||||
else
|
||||
TIMEOUT=15m
|
||||
fi
|
||||
|
||||
SYNCFILE=$TMP/sync-$(date +"%Y%m%d-%H%M%N")
|
||||
touch $SYNCFILE
|
||||
${pkgs.utillinux}/bin/wall "Launching config. System will restart in $TIMEOUT if $SYNCFILE still exists."
|
||||
systemd-run --on-active=$TIMEOUT ${reboot-if-necessary} $SYNCFILE
|
||||
nixos-rebuild test
|
||||
|
||||
exit 0
|
||||
'';
|
||||
|
||||
in {
|
||||
imports = [ ./common.nix ];
|
||||
|
||||
config = {
|
||||
environment = {
|
||||
serverPackages = with pkgs;
|
||||
[ emacs-nox reboot-if-necessary test-config ];
|
||||
};
|
||||
|
||||
networking.networkmanager.enable = mkForce false;
|
||||
|
||||
services.xserver.enable = false;
|
||||
|
||||
sound.enable = false;
|
||||
hardware.pulseaudio.enable = false;
|
||||
|
||||
powerManagement =
|
||||
if config.fudo.hosts.${config.instance.hostname}.keep-cool then {
|
||||
enable = true;
|
||||
cpuFreqGovernor = "ondemand";
|
||||
} else {
|
||||
enable = false;
|
||||
};
|
||||
|
||||
systemd.targets = {
|
||||
sleep.enable = false;
|
||||
suspend.enable = false;
|
||||
hibernate.enable = false;
|
||||
hybrid-sleep.enable = false;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -38,29 +38,31 @@ in {
|
||||
options = [ "comment=systemd.automount" ];
|
||||
};
|
||||
|
||||
# NOTE: these are pointing directly to nostromo so the krb lookup works
|
||||
"/net/documents" = {
|
||||
device = "sea-store.sea.fudo.org:/export/documents";
|
||||
device = "nostromo.sea.fudo.org:/export/documents";
|
||||
fsType = "nfs4";
|
||||
options = [ "comment=systemd.automount" "sec=krb5p" ];
|
||||
options = [ "comment=systemd.automount" "sec=krb5p" "proto=tcp" ];
|
||||
};
|
||||
"/net/downloads" = {
|
||||
device = "sea-store.sea.fudo.org:/export/downloads";
|
||||
device = "nostromo.sea.fudo.org:/export/downloads";
|
||||
fsType = "nfs4";
|
||||
options = [ "comment=systemd.automount" "sec=krb5i" ];
|
||||
options = [ "comment=systemd.automount" "sec=krb5i" "proto=tcp" ];
|
||||
};
|
||||
"/net/projects" = {
|
||||
device = "sea-store.sea.fudo.org:/export/projects";
|
||||
device = "nostromo.sea.fudo.org:/export/projects";
|
||||
fsType = "nfs4";
|
||||
options = [ "comment=systemd.automount" "sec=krb5p" ];
|
||||
options = [ "comment=systemd.automount" "sec=krb5p" "proto=tcp" ];
|
||||
};
|
||||
};
|
||||
|
||||
systemd = {
|
||||
tmpfiles.rules = [
|
||||
"d /net/documents - root sea-documents - -"
|
||||
"d /net/downloads - root sea-downloads - -"
|
||||
"d /net/projects - root sea-projects - -"
|
||||
];
|
||||
## This fails if the filesystems already exist
|
||||
# tmpfiles.rules = [
|
||||
# "d /net/documents - root sea-documents - -"
|
||||
# "d /net/downloads - root sea-downloads - -"
|
||||
# "d /net/projects - root sea-projects - -"
|
||||
# ];
|
||||
|
||||
# mounts = [
|
||||
# {
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
|
||||
{
|
||||
replicator = {
|
||||
description = "Database Replicator";
|
||||
hashed-password = "{SHA}HpiRMyxLR+0ZFHz/COvG9lcNYyQ=";
|
||||
};
|
||||
|
||||
auth_reader = {
|
||||
description = "System Authenticator";
|
||||
hashed-password = "{MD5}N36/kQ64mev1HARddvVk7Q==";
|
||||
};
|
||||
|
||||
user_db_reader = {
|
||||
description = "User Database Reader";
|
||||
hashed-password = "{SSHA}IVKhrB+wMOCI/CCzbJW8sNDbH67ZTMBv";
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user