nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Piles o' changes

Browse Source
This commit is contained in:
root
2020-06-06 20:58:13 -05:00
parent 2aa6b8efc6
commit 9f59ff30fe
21 changed files with 587 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/fudo/chat.nix
+2
View File
@@ -154,6 +154,8 @@ in {
};
};
security.acme.certs.${cfg.hostname}.email = config.fudo.common.admin-email;
services.nginx = {
enable = true;
config/fudo/common.nix
+6
View File
@@ -46,5 +46,11 @@ with lib;
description = "Path at which to store www files for serving.";
example = /var/www;
};
admin-email = mkOption {
type = types.str;
description = "Email for administrator of this system.";
default = "admin@fudo.org";
};
};
}
config/fudo/git.nix
+115
View File
@@ -0,0 +1,115 @@
{ pkgs, lib, config, ... }:
with lib;
let
cfg = config.fudo.git;
databaseOpts = { ... }: {
options = {
name = mkOption {
type = types.str;
description = "Database name.";
};
hostname = mkOption {
type = types.str;
description = "Hostname of the database server.";
};
user = mkOption {
type = types.str;
description = "Database username.";
};
password-file = mkOption {
type = types.path;
description = "File containing the database user's password.";
};
};
};
in {
options.fudo.git = {
enable = mkEnableOption "Enable Fudo git web server.";
hostname = mkOption {
type = types.str;
description = "Hostname at which this git server is accessible.";
example = "git.fudo.org";
};
site-name = mkOption {
type = types.str;
description = "Name to use for the git server.";
default = "Fudo Git";
};
database = mkOption {
type = (types.submodule databaseOpts);
description = "Gitea database options.";
};
repository-dir = mkOption {
type = types.path;
description = "Path at which to store repositories.";
example = /srv/git/repo;
};
state-dir = mkOption {
type = types.path;
description = "Path at which to store server state.";
example = /srv/git/state;
};
user = mkOption {
type = with types; nullOr str;
description = "System user as which to run.";
default = "git";
};
};
config = mkIf cfg.enable {
security.acme.certs.${cfg.hostname}.email = config.fudo.common.admin-email;
services = {
gitea = {
enable = true;
appName = cfg.site-name;
database = {
createDatabase = true;
host = cfg.database.hostname;
name = cfg.database.name;
user = cfg.database.user;
passwordFile = cfg.database.password-file;
};
domain = cfg.hostname;
httpAddress = "127.0.0.1";
httpPort = 3543;
repositoryRoot = toString cfg.repository-dir;
stateDir = toString cfg.state-dir;
rootUrl = "https://${cfg.hostname}/";
user = mkIf (cfg.user != null) cfg.user;
};
nginx = {
enable = true;
virtualHosts = {
"${cfg.hostname}" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:3543";
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-By $server_addr:$server_port;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
'';
};
};
};
};
};
};
}
config/fudo/grafana.nix
+3
View File
@@ -5,6 +5,7 @@
with lib;
let
cfg = config.fudo.grafana;
fudo-cfg = config.fudo.common;
database-name = "grafana";
database-user = "grafana";
@@ -73,6 +74,8 @@ in {
};
config = mkIf cfg.enable {
security.acme.certs.${cfg.hostname}.email = fudo-cfg.admin-email;
services.nginx = {
enable = true;
config/fudo/mail-container.nix
+39 -74
View File
@@ -16,7 +16,7 @@ let
container-mail-user = "mailer";
container-mail-user-id = 542;
container-mail-group = "mailer";
trusted-networks = config.fudo.common.local-networks;
fudo-cfg = config.fudo.common;
in rec {
options.fudo.mail-server.container = {
@@ -25,18 +25,6 @@ in rec {
description = "URL of the LDAP server to use for authentication.";
example = "ldaps://auth.fudo.org/";
};
# host-ip = mkOption {
# type = types.str;
# description = "The IP to assign to this server, for communication with the mail server container.";
# default = "10.110.0.1";
# };
# container-ip = mkOption {
# type = types.str;
# description = "The IP to assign to the mail server container.";
# default = "10.110.0.2";
# };
};
config = mkIf (cfg.enableContainer && !cfg.enable) {
@@ -73,6 +61,8 @@ in rec {
};
};
security.acme.certs.${cfg.hostname}.email = fudo-cfg.admin-email;
services.nginx = mkIf cfg.monitoring {
enable = true;
@@ -81,9 +71,9 @@ in rec {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
'';
trusted-network-string = optionalString ((length trusted-networks) > 0)
trusted-network-string = optionalString ((length fudo-cfg.local-networks) > 0)
(concatStringsSep "\n"
(map (network: "allow ${network};") trusted-networks)) + "\ndeny all;";
(map (network: "allow ${network};") fudo-cfg.local-networks)) + "\ndeny all;";
in {
"${cfg.hostname}" = {
@@ -123,30 +113,6 @@ in rec {
};
};
# services.xinetd = let
# xinetd-entry = name: port: {
# name = name;
# port = port;
# protocol = "tcp";
# server = "";
# extraConfig = ''
# socket_type = stream
# wait = no
# redirect = ${cfg.container.container-ip} ${toString port}
# '';
# };
# in {
# enable = true;
# services = [
# (xinetd-entry "smtp" 25)
# (xinetd-entry "pop3" 110)
# (xinetd-entry "pop3s" 995)
# (xinetd-entry "imap" 143)
# (xinetd-entry "imaps" 993)
# (xinetd-entry "submission" 587)
# ];
# };
containers.mail-server = {
autoStart = true;
@@ -210,46 +176,45 @@ in rec {
};
};
fudo.mail-server =
{
enable = true;
hostname = cfg.hostname;
domain = cfg.domain;
fudo.mail-server = {
enable = true;
hostname = cfg.hostname;
domain = cfg.domain;
debug = cfg.debug;
monitoring = cfg.monitoring;
debug = cfg.debug;
monitoring = cfg.monitoring;
state-directory = container-statedir;
mail-directory = container-maildir;
state-directory = container-statedir;
mail-directory = container-maildir;
postfix.ssl-certificate = "/etc/${container-postfix-cert}";
postfix.ssl-private-key = "/etc/postfix-certs/key.pem";
postfix.ssl-certificate = "/etc/${container-postfix-cert}";
postfix.ssl-private-key = "/etc/postfix-certs/key.pem";
dovecot = {
ssl-certificate = "/etc/${container-dovecot-cert}";
ssl-private-key = "/etc/dovecot-certs/key.pem";
ldap-ca = "/etc/${container-fudo-ca-cert}";
ldap-urls = cfg.dovecot.ldap-urls;
ldap-reader-dn = cfg.dovecot.ldap-reader-dn;
ldap-reader-passwd = cfg.dovecot.ldap-reader-passwd;
};
local-domains = cfg.local-domains;
alias-users = cfg.alias-users;
user-aliases = cfg.user-aliases;
sender-blacklist = cfg.sender-blacklist;
recipient-blacklist = cfg.recipient-blacklist;
trusted-networks = cfg.trusted-networks;
mail-user = container-mail-user;
mail-user-id = container-mail-user-id;
mail-group = container-mail-group;
clamav.enable = cfg.clamav.enable;
dkim.signing = cfg.dkim.signing;
dovecot = {
ssl-certificate = "/etc/${container-dovecot-cert}";
ssl-private-key = "/etc/dovecot-certs/key.pem";
ldap-ca = "/etc/${container-fudo-ca-cert}";
ldap-urls = cfg.dovecot.ldap-urls;
ldap-reader-dn = cfg.dovecot.ldap-reader-dn;
ldap-reader-passwd = cfg.dovecot.ldap-reader-passwd;
};
local-domains = cfg.local-domains;
alias-users = cfg.alias-users;
user-aliases = cfg.user-aliases;
sender-blacklist = cfg.sender-blacklist;
recipient-blacklist = cfg.recipient-blacklist;
trusted-networks = cfg.trusted-networks;
mail-user = container-mail-user;
mail-user-id = container-mail-user-id;
mail-group = container-mail-group;
clamav.enable = cfg.clamav.enable;
dkim.signing = cfg.dkim.signing;
};
};
};
};
config/fudo/mail/postfix.nix
+4 -3
View File
@@ -105,9 +105,10 @@ in {
domain = cfg.domain;
origin = cfg.domain;
hostname = cfg.hostname;
destination = ["localhost" "localhost.localdomain"] ++
(map (domain: "localhost.${domain}") cfg.local-domains) ++
cfg.local-domains;
destination = ["localhost" "localhost.localdomain"];
# destination = ["localhost" "localhost.localdomain"] ++
# (map (domain: "localhost.${domain}") cfg.local-domains) ++
# cfg.local-domains;
enableHeaderChecks = true;
enableSmtp = true;
config/fudo/node-exporter.nix
+2
View File
@@ -20,6 +20,8 @@ in {
};
config = mkIf cfg.enable {
security.acme.certs.${cfg.hostname}.email = fudo-cfg.admin-email;
services = {
# This'll run an exporter at localhost:9100
prometheus.exporters.node = {
config/fudo/postgres.nix
+35 -9
View File
@@ -65,8 +65,9 @@ let
(username: attrs:
stringJoin "\n"
(map (db: ''
host ${username} ${db} 127.0.0.1/16 md5
host ${username} ${db} ::1/128 md5
local ${db} ${username} md5
host ${db} ${username} 127.0.0.1/16 md5
host ${db} ${username} ::1/128 md5
'') (attrNames attrs.databases)))
users);
@@ -117,6 +118,24 @@ in {
description = "A map of databases to database options.";
default = {};
};
socket-directory = mkOption {
type = types.str;
description = "Directory in which to place unix sockets.";
default = "/run/postgresql";
};
socket-group = mkOption {
type = types.str;
description = "Group for accessing sockets.";
default = "postgres_local";
};
local-users = mkOption {
type = with types; listOf str;
description = "Users able to access the server via local socket.";
default = [];
};
};
config = mkIf cfg.enable {
@@ -157,6 +176,12 @@ in {
};
};
users.groups = {
${cfg.socket-group} = {
members = ["postgres"] ++ cfg.local-users;
};
};
services.postgresql = {
enable = true;
package = pkgs.postgresql_11_gssapi;
@@ -172,23 +197,23 @@ in {
})
cfg.users;
extraConfig =
''
extraConfig = ''
krb_server_keyfile = '/etc/postgresql/private/postgres.keytab'
ssl = true
ssl_cert_file = '/etc/postgresql/cert.pem'
ssl_key_file = '/etc/postgresql/private/privkey.pem'
unix_socket_directories = '/var/run/postgresql'
unix_socket_directories = '${cfg.socket-directory}'
unix_socket_group = '${cfg.socket-group}'
unix_socket_permissions = 0777
'';
authentication =
''
local all all ident
authentication = lib.mkForce ''
${makeLocalUserPasswordEntries cfg.users}
local all all ident
# host-local
host all all 127.0.0.1/32 gss include_realm=0 krb_realm=FUDO.ORG
host all all ::1/128 gss include_realm=0 krb_realm=FUDO.ORG
@@ -204,6 +229,7 @@ in {
systemd.services.postgresql.postStart = ''
${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} ${pkgs.postgresql}/bin/psql --port ${toString config.services.postgresql.port} -f /etc/postgresql/private/user-script.sql -d postgres
${pkgs.coreutils}/bin/chgrp ${cfg.socket-group} ${cfg.socket-directory}/.s.PGSQL*
'';
};
}
config/fudo/prometheus.nix
+2
View File
@@ -77,6 +77,8 @@ in {
config = mkIf cfg.enable {
security.acme.certs.${cfg.hostname}.email = fudo-cfg.admin-email;
services.nginx = {
enable = true;
config/fudo/system.nix
+37
View File
@@ -0,0 +1,37 @@
{ pkgs, lib, config, ... }:
with lib;
let
cfg = config.fudo.system;
in {
options.fudo.system = {
disableTransparentHugePages = mkOption {
type = types.bool;
description = ''
Disable transparent huge pages (recommended for database loads, in
particular for Redis.
'';
default = false;
};
postHugePageServices = mkOption {
type = with types; listOf str;
description = "List of systemd services that should wait until after THP are disabled.";
default = [];
example = ["redis.service"];
};
};
config = mkIf cfg.disableTransparentHugePages {
systemd.services.disableHugePages = {
description = "Turn off Transparent Huge Pages (https://www.kernel.org/doc/Documentation/vm/transhuge.txt)";
after = [ "sysinit.target" "localfs-target" ];
before = cfg.postHugePageServices;
enable = true;
serviceConfig = {
ExecStart = "/bin/sh -c 'echo never | tee /sys/kernel/mm/transparent_hugepage/enabled > /dev/null";
Type = "oneshot";
};
};
};
}
config/fudo/webmail.nix
+65 -38
View File
@@ -145,6 +145,12 @@ let
};
default = null;
};
admin-email = mkOption {
type = types.str;
description = "Email of administrator of this site.";
default = "admin@fudo.org";
};
};
};
@@ -220,6 +226,11 @@ in {
};
};
security.acme.certs = mapAttrs' (site: site-cfg:
nameValuePair site {
email = site-cfg.admin-email;
}) cfg.sites;
services = {
phpfpm = {
pools.webmail = {
@@ -273,46 +284,62 @@ in {
};
};
systemd.services.nginx.preStart = let
link-configs = concatStringsSep "\n" (mapAttrsToList (site: site-cfg: let
cfg-file = builtins.toFile "${site}-rainloop.cfg" (import ./include/rainloop.nix lib site site-cfg site-packages.${site}.version);
domain-cfg = builtins.toFile "${site}-domain.cfg" ''
imap_host = "${site-cfg.mail-server}"
imap_port = 143
imap_secure = "TLS"
imap_short_login = On
sieve_use = Off
sieve_allow_raw = Off
sieve_host = ""
sieve_port = 4190
sieve_secure = "None"
smtp_host = "${site-cfg.mail-server}"
smtp_port = 587
smtp_secure = "TLS"
smtp_short_login = On
smtp_auth = On
smtp_php_mail = Off
white_list = ""
'';
systemd.services = {
webmail-init = let
link-configs = concatStringsSep "\n" (mapAttrsToList (site: site-cfg: let
cfg-file = builtins.toFile "${site}-rainloop.cfg" (import ./include/rainloop.nix lib site site-cfg site-packages.${site}.version);
domain-cfg = builtins.toFile "${site}-domain.cfg" ''
imap_host = "${site-cfg.mail-server}"
imap_port = 143
imap_secure = "TLS"
imap_short_login = On
sieve_use = Off
sieve_allow_raw = Off
sieve_host = ""
sieve_port = 4190
sieve_secure = "None"
smtp_host = "${site-cfg.mail-server}"
smtp_port = 587
smtp_secure = "TLS"
smtp_short_login = On
smtp_auth = On
smtp_php_mail = Off
white_list = ""
'';
in ''
${pkgs.coreutils}/bin/mkdir -p ${base-data-path}/${site}/_data_/_default_/configs
${pkgs.coreutils}/bin/cp ${cfg-file} ${base-data-path}/${site}/_data_/_default_/configs/application.ini
in ''
mkdir -p ${base-data-path}/${site}/_data_/_default_/configs
cp ${cfg-file} ${base-data-path}/${site}/_data_/_default_/configs/application.ini
${pkgs.coreutils}/bin/mkdir -p ${base-data-path}/${site}/_data_/_default_/domains/
${pkgs.coreutils}/bin/cp ${domain-cfg} ${base-data-path}/${site}/_data_/_default_/domains/${site-cfg.domain}.ini
'') cfg.sites);
scriptPkg = (pkgs.writeScriptBin "webmail-init.sh" ''
#!${pkgs.bash}/bin/bash -e
${link-configs}
${pkgs.coreutils}/bin/chown -R ${webmail-user}:${webmail-group} ${base-data-path}
${pkgs.coreutils}/bin/chmod -R ug+w ${base-data-path}
'');
in {
requiredBy = [ "nginx.service" ];
description = "Initialize webmail service directories prior to starting nginx.";
script = "${scriptPkg}/bin/webmail-init.sh";
};
mkdir -p ${base-data-path}/${site}/_data_/_default_/domains/
cp ${domain-cfg} ${base-data-path}/${site}/_data_/_default_/domains/${site-cfg.domain}.ini
phpfpm-webmail-socket-perm = {
wantedBy = [ "multi-user.target" ];
description = "Change ownership of the phpfpm socket for webmail once it's started.";
requires = [ "phpfpm-webmail.service" ];
serviceConfig = {
ExecStart = ''
${pkgs.coreutils}/bin/chown ${webmail-user}:${webmail-group} ${config.services.phpfpm.pools.webmail.socket}
'';
};
};
'') cfg.sites);
in ''
${link-configs}
chown -R ${webmail-user}:${webmail-group} ${base-data-path}
chmod -R ug+w ${base-data-path}
'';
systemd.services.phpfpm-webmail.postStart = ''
chown ${webmail-user}:${webmail-group} ${config.services.phpfpm.pools.webmail.socket}
'';
nginx = {
requires = [ "webmail-init.service" ];
wantedBy = [ "phpfpm-webmail-socket-perm.service" ];
};
};
};
}
config/local.nix
+2
View File
@@ -7,6 +7,7 @@ with lib;
./fudo/authentication.nix
./fudo/chat.nix
./fudo/common.nix
./fudo/git.nix
./fudo/grafana.nix
./fudo/kdc.nix
./fudo/ldap.nix
@@ -16,6 +17,7 @@ with lib;
./fudo/node-exporter.nix
./fudo/postgres.nix
./fudo/prometheus.nix
./fudo/system.nix
./fudo/webmail.nix
../fudo/profiles