nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Evolution in Seattle

Browse Source
This commit is contained in:
niten
2021-04-29 21:39:21 -07:00
parent a67881c68c
commit 82596ea68a
12 changed files with 187 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/host-config/lambda.nix
+8
View File
@@ -23,6 +23,14 @@ in {
};
};
fudo.secrets.host-secrets.lambda = {
host-keytab = {
source-file = /state/secrets/kerberos/lambda.keytab;
target-file = "/etc/krb5.keytab";
user = "root";
};
};
fudo.ipfs = {
enable = true;
users = [ "niten" ];
config/host-config/limina.nix
+9 -3
View File
@@ -59,12 +59,18 @@ in {
network-definition = config.fudo.networks.${domain-name};
};
secrets.limina = {
secrets.host-secrets.limina = {
backplane-client-passwd = {
source-file = "/srv/secrets/backplane-client/limina.passwd";
source-file = /state/secrets/backplane-client/limina.passwd;
target-file = "/srv/backplane/dns/client.passwd";
user = config.fudo.client.dns.user;
};
host-keytab = {
source-file = /state/secrets/kerberos/limina.keytab;
target-file = "/etc/krb5.keytab";
user = "root";
};
};
client.dns = {
@@ -74,7 +80,7 @@ in {
user = "fudo-client";
external-interface = "enp1s0";
password-file =
config.fudo.secrets.limina.backplane-client-passwd.target-file;
config.fudo.secrets.host-secrets.limina.backplane-client-passwd.target-file;
};
garbage-collector = {
config/host-config/plato.nix
+21 -31
View File
@@ -1,37 +1,27 @@
{ config, lib, pkgs, ... }:
with lib;
let
primary-ip = "10.0.0.21";
deploy-group = "nixops-deploy";
secrets-path = "/srv/secrets";
let primary-ip = "10.0.0.21";
in {
config = {
users.groups = { ${deploy-group} = { members = [ "niten" ]; }; };
fudo.secrets = {
host-secrets.plato = {
host-keytab = {
source-file = /state/secrets/kerberos/plato.keytab;
target-file = "/etc/krb5.keytab";
user = "root";
};
};
secret-group = "fudo-secrets";
secret-users = [ "niten" ];
secret-paths = [ "/state/secrets" ];
};
systemd = let secrets-watcher-name = "secrets-ownership-fixer";
in {
paths.${secrets-watcher-name} = {
description = "Watch ${secrets-path} and correct perms on change.";
wantedBy = [ "multi-user.target" ];
pathConfig = {
PathChanged = secrets-path;
Unit = "${secrets-watcher-name}.service";
};
};
services.${secrets-watcher-name} = {
wantedBy = [ "multi-user.target" ];
description = "Correct perms on ${secrets-path}.";
serviceConfig = {
ExecStart = pkgs.writeShellScript "${secrets-watcher-name}.sh" ''
chown -R root:${deploy-group} ${secrets-path}
chmod -R ug=rX,o= ${secrets-path}
'';
};
};
tmpfiles.rules = [
"L /root/.gnupg - - - - /state/root/gnupg"
# "L /root/.emacs.d - - - - /state/root/emacs.d"
@@ -49,12 +39,12 @@ in {
NIXOS.source = "/state/etc/NIXOS";
machine-id.source = "/state/etc/machine-id";
"host-config.nix".source = "/state/etc/host-config.nix";
"krb5.keytab" = {
source = "/state/etc/plato.keytab";
user = "root";
group = "root";
mode = "0600";
};
# "krb5.keytab" = {
# source = "/state/etc/plato.keytab";
# user = "root";
# group = "root";
# mode = "0600";
# };
};
system.stateVersion = "20.09";
config/host-config/procul.nix
+15 -8
View File
@@ -71,24 +71,30 @@ in {
fudo = {
hosts.procul.external-interfaces = [ "extif0" ];
secrets.procul = {
secrets.host-secrets.procul = {
backplane-client-passwd = {
source-file = "/srv/secrets/backplane-client/procul.passwd";
source-file = /state/secrets/backplane-client/procul.passwd;
target-file = "/srv/backplane/dns/client.passwd";
user = config.fudo.client.dns.user;
};
postgres-keytab = {
source-file = "/srv/secrets/kerberos/procul-postgres.keytab";
source-file = /state/secrets/kerberos/procul-postgres.keytab;
target-file = "/srv/postgres/secure/postgres.keytab";
user = "root";
};
gitea-database-password = {
source-file = "/srv/secrets/gitea/procul-database.passwd";
source-file = /state/secrets/gitea/procul-database.passwd;
target-file = "/srv/gitea/secure/database.passwd";
user = config.fudo.git.user;
};
# host-keytab = {
# source-file = /state/secrets/kerberos/procul.keytab;
# target-file = "/etc/krb5.keytab";
# user = "root";
# };
};
client.dns = {
@@ -98,7 +104,7 @@ in {
user = "fudo-client";
external-interface = "extif0";
password-file =
config.fudo.secrets.procul.backplane-client-passwd.target-file;
config.fudo.secrets.host-secrets.procul.backplane-client-passwd.target-file;
};
auth.kdc = {
@@ -195,13 +201,14 @@ in {
enable = true;
ssl-certificate = (acme-certificate host-fqdn);
ssl-private-key = (acme-private-key host-fqdn);
keytab = config.fudo.secrets.procul.postgres-keytab.target-file;
keytab =
config.fudo.secrets.host-secrets.procul.postgres-keytab.target-file;
local-networks = local-networks;
users = {
gituser = {
password-file =
config.fudo.secrets.procul.gitea-database-password.target-file;
config.fudo.secrets.host-secrets.procul.gitea-database-password.target-file;
databases = {
git = {
access = "CONNECT";
@@ -227,7 +234,7 @@ in {
database = {
user = "gituser";
password-file =
config.fudo.secrets.procul.gitea-database-password.target-file;
config.fudo.secrets.host-secrets.procul.gitea-database-password.target-file;
hostname = "127.0.0.1";
name = "git";
};
config/sites.nix
+2
View File
@@ -22,6 +22,7 @@
};
};
enable-distributed-builds = true;
keytab-directory = "/state/secrets/kerberos";
# FIXME: good idea?
# network-mounts = {
# "/mnt/documents" = {
@@ -75,6 +76,7 @@
timezone = "America/Winnipeg";
deploy-pubkey =
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPwh522lvafTJYA0X2uFdP7Ws+Um1f8gZsARK1Y5nMzf6ZcWBF1jplTOKUVSOl4isMWni0Tu0TnX4zqCcgocWUVbwIwXSIRYqdiCPvVOH+/Ibc97n1/dYxk5JPMtbrsEw6/gWZxVg0qwe0J3dQWldEMiDY7iWhlrmIr7YL+Y3PUd7DOwp3PbfWfNyzTfE1kXcz5YvTeN+txFhbbXT0oS2R2wtc1vYXFZ/KbNstjqd+i8jszAq3ZkbbwL3aNR0RO4n8+GoIILGw8Ya4eP7D6+mYk608IhAoxpGyMrUch2TC2uvOK3rd/rw1hsTxf4AKjAZbrfd/FJaYru9ZeoLjD4bRGMdVp56F1m7pLvRiWRK62pV2Q/fjx+4KjHUrgyPd601eUIP0ayS/Rfuq8ijLpBJgO5/Y/6mFus/kjZIfRR9dXfLM67IMpyEzEITYrc/R2sedWf+YHxSh6eguAZ/kLzioar1nHLR7Wzgeu0tgWkD78WQGjpXGoefAz3xHeBg3Et0=";
keytab-directory = "/state/secrets/kerberos";
};
};
}