nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Added cashew, did some backplane yak shaving

Browse Source
This commit is contained in:
niten
2021-11-16 16:56:43 -08:00
parent c747746eee
commit b5cdfc7293
21 changed files with 933 additions and 539 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/client.nix
+37
View File
@@ -0,0 +1,37 @@
{ config, lib, pkgs, ... }:
with lib;
let
make-passwd-file = hostname:
pkgs.lib.fudo.passwd.stablerandom-passwd-file
"${hostname}-fudo-client-passwd"
config.instance.build-seed;
secrets =
config.fudo.secrets.host-secrets.${config.instance.hostname};
host-password-files = mapAttrs (hostname: hostOpts:
make-password-file hostname) config.fudo.hosts;
in {
config = {
fudo = {
secrets.host-secrets = mapAttrs (hostname: hostOpts: {
backplane-client-passwd = {
source-file = host-password-files.${hostname};
target-file = "/var/fudo/client/passwd";
user = config.fudo.client.dns.user;
};
}) config.fudo.hosts;
client.dns = {
password-file =
secrets.backplane-client-passwd.target-file;
};
backplane.client-hosts = mapAttrs (hostname: hostOpts: {
password-file = host-password-files.${hostname};
}) config.fudo.hosts;
};
};
}
config/default.nix
+12 -12
View File
@@ -1,16 +1,16 @@
{ config, lib, pkgs, ... }:
{
imports = [
./aliases.nix
./bash.nix
./common.nix
./domains.nix
./groups.nix
./hosts.nix
./networks.nix
./sites.nix
./users.nix
./wireless-networks.nix
];
imports = [
./aliases.nix
./bash.nix
./common.nix
./domains.nix
./groups.nix
./hosts.nix
./networks.nix
./sites.nix
./users.nix
./wireless-networks.nix
];
}
config/domains.nix
+2 -2
View File
@@ -14,6 +14,7 @@
local-admins = [ "niten" "reaper" ];
admin-email = "admin@fudo.org";
gssapi-realm = "FUDO.ORG";
kerberos-master = "nutboy3";
};
"sea.fudo.org" = {
@@ -63,7 +64,6 @@
admin-email = "viator@informis.land";
gssapi-realm = "INFORMIS.LAND";
kerberos-master = "procul";
kerberos-slaves = [ "legatus" ];
primary-nameserver = "procul";
};
@@ -77,7 +77,7 @@
local-users = [ "niten" "reaper" ];
local-groups = [ "admin" ];
local-admins = [ "niten" "reaper" ];
admin-email = "nitenn@fudo.org";
admin-email = "niten@fudo.org";
gssapi-realm = "FUDO.ORG";
# kerberos-master = "legatus";
primary-nameserver = "legatus";
config/hardware/cashew.nix
+5
View File
@@ -0,0 +1,5 @@
{ config, lib, pkgs, ... }:
{
}
config/host-config/cashew.nix
+35
View File
@@ -0,0 +1,35 @@
{ config, lib, pkgs, ... }:
with lib;
let
hostname = config.instance.hostname;
host-ipv4 = pkgs.lib.fudo.network.host-ipv4 config hostname;
site-name = config.fudo.hosts.${hostname}.site;
site = config.fudo.sites.${site-name};
network-prefix-length =
pkgs.lib.fudo.ip.getNetworkMask site.network;
local-packages = with pkgs; [
bind
];
in {
config = {
networking = {
defaultGateway = {
address = site.gateway-v4;
interface = "extif0";
};
interfaces.extif0 = {
ipv4.addresses = [{
address = host-ipv4;
prefixLength = network-prefix-length;
}];
};
};
environment.systemPackages = local-packages;
};
}
config/host-config/france.nix
+6 -12
View File
@@ -51,12 +51,6 @@ in {
options = [ "noatime" "nodiratime" "noexec" "subvol=grafana" ];
};
"/srv/gitlab" = {
fsType = "btrfs";
label = "pool0";
options = [ "noatime" "nodiratime" "noexec" "subvol=grafana" ];
};
${mail-directory} = {
fsType = "btrfs";
label = "pool0";
@@ -278,12 +272,12 @@ in {
locations."/" = {
proxyPass = "http://127.0.0.1:8001";
extraConfig = ''
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-By $server_addr:$server_port;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
'';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-By $server_addr:$server_port;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
'';
};
};
};
config/host-config/france/jabber.nix
-10
View File
@@ -7,16 +7,6 @@ let
cfg = config.fudo.france.jabber;
generate-auth-file = name: files: let
make-entry = name: passwd-file:
''("${name}" . "${readFile passwd-file}")'';
entries = mapAttrsToList make-entry files;
content = concatStringsSep "\n" entries;
in pkgs.writeText "${name}-backplane-auth.scm" "'(${content})";
host-auth-file = generate-auth-file "host" cfg.backplane.host-passwd-files;
service-auth-file = generate-auth-file "service" cfg.backplane.service-passwd-files;
ldap-password-file =
pkgs.lib.fudo.passwd.random-passwd-file "ejabberd-ldap-auth-user" 30;
config/host-config/nutboy3.nix
+203 -165
View File
@@ -3,6 +3,7 @@
with lib;
let
hostname = "nutboy3";
host-fqdn = config.instance.host-fqdn;
host-ipv4 = "199.87.154.175";
domain-name = config.fudo.hosts.${hostname}.domain;
domain = config.fudo.domains.${domain-name};
@@ -13,184 +14,221 @@ let
secrets = config.fudo.secrets.host-secrets.${hostname};
postgresql-user =
config.systemd.services.postgresql.serviceConfig.User;
files = config.fudo.secrets.files;
acme-copies = config.fudo.acme.host-domains.${hostname};
in {
networking = {
enableIPv6 = true;
nameservers = [ "1.1.1.1" ];
defaultGateway = {
address = site.gateway-v4;
interface = "extif0";
config = {
networking = {
enableIPv6 = true;
nameservers = [ "1.1.1.1" ];
defaultGateway = {
address = site.gateway-v4;
interface = "extif0";
};
interfaces.extif0.ipv4.addresses = [{
address = host-ipv4;
prefixLength = 31;
}];
};
interfaces.extif0.ipv4.addresses = [{
address = host-ipv4;
prefixLength = 31;
}];
};
systemd.tmpfiles.rules = [
"L /etc/adjtime - - - - /state/etc/adjtime"
];
systemd.tmpfiles.rules = [
"L /etc/adjtime - - - - /state/etc/adjtime"
];
environment.systemPackages = local-packages;
environment.systemPackages = local-packages;
fudo = {
hosts.${hostname}.external-interfaces = [ "extif0" ];
# networking.firewall.allowedTCPPorts = [ 80 443 ];
secrets.host-secrets.nutboy3 = let
files = config.fudo.secrets.files;
in {
heimdal-master-key = {
source-file = files.realm-master-keys."FUDO.ORG";
target-file = "/run/heimdal/master-key";
user = config.fudo.auth.kdc.user;
};
# informis.cl-gemini = {
# enable = true;
ldap-keytab = {
source-file = files.service-keytabs.${hostname}.openldap;
target-file = "/run/openldap/ldap.keytab";
user = config.services.openldap.user;
};
# hostname = "gemini.informis.land";
# server-ip = host-ipv4;
# document-root = "/srv/gemini/root";
# textfiles-archive = "${pkgs.textfiles}";
# slynk-port = 4005;
postgresql-keytab = {
source-file = files.service-keytabs.nutboy3.postgres;
target-file = "/run/postgresql/postgres.keytab";
user = postgresql-user;
};
};
# feeds = {
# viator = {
# title = "viator's phlog";
# path = "/home/viator/gemini-public/feed/";
# url = "gemini://informis.land/user/viator/feed/";
# };
# };
# };
acme.host-domains.${hostname}.${host-fqdn}.local-copies = {
openldap = {
user = config.services.openldap.user;
dependent-services = [ "openldap.service" ];
part-of = [ config.fudo.auth.ldap-server.systemd-target ];
};
fudo = {
hosts.${hostname}.external-interfaces = [ "extif0" ];
secrets.host-secrets.nutboy3 = let
files = config.fudo.secrets.files;
postgresql = {
user = postgresql-user;
dependent-services = [ "postgresql.service" ];
part-of = [ config.fudo.postgresql.systemd-target ];
};
};
client.dns = {
ipv4 = true;
ipv6 = true;
user = "fudo-client";
external-interface = "extif0";
};
auth = {
ldap-server = let
ldap-copy = acme-copies.${host-fqdn}.local-copies.openldap;
in {
enable = true;
base = "dc=fudo,dc=org";
organization = "Fudo";
kerberos-host = host-fqdn;
kerberos-keytab = secrets.ldap-keytab.target-file;
listen-uris = [ "ldap:///" "ldaps:///" "ldapi:///"];
required-services = [ ldap-copy.service ];
users = config.fudo.users;
groups = config.fudo.groups;
system-users = config.fudo.system-users;
state-directory = "/state/openldap";
ssl-chain = ldap-copy.chain;
ssl-certificate = ldap-copy.certificate;
ssl-private-key = ldap-copy.private-key;
ssl-ca-certificate = "${pkgs.letsencrypt-ca}";
};
kdc = {
master-key-file =
secrets.heimdal-master-key.target-file;
state-directory = "/state/kerberos";
};
};
# dns.state-directory = "/state/nsd";
# mail-server = {
# enableContainer = true;
# debug = true;
# domain = domain-name;
# mail-hostname = "${host-fqdn}";
# monitoring = false;
# mail-user = "mailuser";
# mail-user-id = 525;
# mail-group = "mailgroup";
# clamav.enable = true;
# dkim.signing = true;
# dovecot = {
# ssl-certificate = acme-certificate "imap.${domain-name}";
# ssl-private-key = acme-private-key "imap.${domain-name}";
# };
# postfix = {
# ssl-certificate = acme-certificate "smtp.${domain-name}";
# ssl-private-key = acme-private-key "smtp.${domain-name}";
# };
# # This should NOT include the primary domain
# local-domains = [ host-fqdn "smtp.${domain-name}" ];
# mail-directory = "/srv/mailserver/mail";
# state-directory = "/srv/mailserver/state";
# trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];
# alias-users = {
# root = [ "niten" ];
# postmaster = [ "niten" ];
# hostmaster = [ "niten" ];
# webmaster = [ "niten" ];
# system = [ "niten" ];
# admin = [ "niten" ];
# dmarc-report = [ "niten" ];
# };
# };
postgresql = let
cert-copy =
config.fudo.acme.host-domains.${hostname}.${host-fqdn}.local-copies.postgresql;
in {
enable = true;
ssl-certificate = cert-copy.full-certificate;
ssl-private-key = cert-copy.private-key;
keytab = secrets.postgresql-keytab.target-file;
local-networks = config.instance.local-networks;
state-directory = "/state/postgresql";
required-services = [ cert-copy.service ];
};
# git = {
# enable = true;
# hostname = "git.informis.land";
# site-name = "informis git";
# user = "gituser";
# repository-dir = /srv/git/repo;
# state-dir = /srv/git/state;
# database = {
# user = "gituser";
# password-file =
# secrets.gitea-database-password.target-file;
# hostname = "127.0.0.1";
# name = "git";
# };
# ssh = {
# listen-ip = host-ipv4;
# listen-port = 2222;
# };
# };
};
containers.cashew = let
initialize-host = import ../../initialize.nix;
build-timestamp = config.instance.build-timestamp;
site = "nuttyclub-vm";
domain = config.instance.local-domain;
profile = "container";
in {
# heimdal-master-key = {
# source-file = files.realm-master-keys."FUDO.ORG";
# target-file = "/run/heimdal/master-key";
# user = config.fudo.auth.kdc.user;
# };
autoStart = true;
# ipropd-keytab = {
# source-file = files.service-keytabs.legatus.ipropd;
# target-file = "/run/heimdal/ipropd.keytab";
# user = config.fudo.auth.kdc.user;
# };
bindMounts = {
};
config = { pkgs, ... }: {
imports = [
(initialize-host {
inherit
lib
pkgs
build-timestamp
site
domain
profile;
hostname = "cashew";
})
];
instance.build-seed = build-seed;
};
};
client.dns = {
ipv4 = true;
ipv6 = true;
user = "fudo-client";
external-interface = "extif0";
};
# auth.kdc = {
# enable = true;
# realm = "FUDO.ORG";
# bind-addresses = [ host-ipv4 "127.0.0.1" ];
# master-key-file =
# secrets.heimdal-master-key.target-file;
# state-directory = "/state/kerberos";
# slave-config = {
# master-host = "france";
# ipropd-keytab = secrets.ipropd-keytab.target-file;
# };
# };
# secure-dns-proxy = {
# enable = true;
# upstream-dns =
# [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
# bootstrap-dns = "1.1.1.1";
# listen-ips = [ "127.0.0.1" ];
# listen-port = 53;
# allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
# };
# dns.state-directory = "/state/nsd";
# mail-server = {
# enable = true;
# debug = true;
# domain = domain-name;
# mail-hostname = "${host-fqdn}";
# monitoring = false;
# mail-user = "mailuser";
# mail-user-id = 525;
# mail-group = "mailgroup";
# clamav.enable = true;
# dkim.signing = true;
# dovecot = {
# ssl-certificate = acme-certificate "imap.${domain-name}";
# ssl-private-key = acme-private-key "imap.${domain-name}";
# };
# postfix = {
# ssl-certificate = acme-certificate "smtp.${domain-name}";
# ssl-private-key = acme-private-key "smtp.${domain-name}";
# };
# # This should NOT include the primary domain
# local-domains = [ host-fqdn "smtp.${domain-name}" ];
# mail-directory = "/srv/mailserver/mail";
# state-directory = "/srv/mailserver/state";
# trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];
# alias-users = {
# root = [ "niten" ];
# postmaster = [ "niten" ];
# hostmaster = [ "niten" ];
# webmaster = [ "niten" ];
# system = [ "niten" ];
# admin = [ "niten" ];
# dmarc-report = [ "niten" ];
# };
# };
# postgresql = {
# enable = true;
# ssl-certificate = (acme-certificate host-fqdn);
# ssl-private-key = (acme-private-key host-fqdn);
# keytab = secrets.postgres-keytab.target-file;
# local-networks = local-networks;
# users = {
# gituser = {
# password-file =
# secrets.gitea-database-password.target-file;
# databases = {
# git = {
# access = "CONNECT";
# entity-access = {
# "ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
# "ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
# };
# };
# };
# };
# };
# databases = { git = { users = [ "niten" ]; }; };
# };
# git = {
# enable = true;
# hostname = "git.informis.land";
# site-name = "informis git";
# user = "gituser";
# repository-dir = /srv/git/repo;
# state-dir = /srv/git/state;
# database = {
# user = "gituser";
# password-file =
# secrets.gitea-database-password.target-file;
# hostname = "127.0.0.1";
# name = "git";
# };
# ssh = {
# listen-ip = host-ipv4;
# listen-port = 2222;
# };
# };
};
}
config/hosts/cashew.nix
+12
View File
@@ -0,0 +1,12 @@
{
description = "fudo.org primary dns server.";
rp = "reaper";
admin-email = "reaper@fudo.org";
domain = "fudo.org";
site = "nuttyclub-vm";
profile = "container";
enable-gui = false;
arch = "x86_64-linux";
nixos-system = true;
machine-id = "e5f456e3183a4dc186181a70bc3af2d1";
}
config/profile-config/server.nix
+2
View File
@@ -31,6 +31,8 @@ let
TIMEOUT=15m
fi
TMP=$(mktemp -d /tmp/fudo-test-config-XXXXXXX)
SYNCFILE=$TMP/sync-$(date +"%Y%m%d-%H%M%N")
touch $SYNCFILE
${pkgs.utillinux}/bin/wall "Launching config. System will restart in $TIMEOUT if $SYNCFILE still exists."
config/sites.nix
+12
View File
@@ -50,6 +50,18 @@
mail-server = "mail.fudo.org";
};
nuttyclub-vm = {
gateway-v4 = "FIXME";
network = "FIXME/29";
nameservers = [ "1.1.1.1" ];
timezone = "America/Winnipeg";
deploy-pubkeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPwh522lvafTJYA0X2uFdP7Ws+Um1f8gZsARK1Y5nMzf6ZcWBF1jplTOKUVSOl4isMWni0Tu0TnX4zqCcgocWUVbwIwXSIRYqdiCPvVOH+/Ibc97n1/dYxk5JPMtbrsEw6/gWZxVg0qwe0J3dQWldEMiDY7iWhlrmIr7YL+Y3PUd7DOwp3PbfWfNyzTfE1kXcz5YvTeN+txFhbbXT0oS2R2wtc1vYXFZ/KbNstjqd+i8jszAq3ZkbbwL3aNR0RO4n8+GoIILGw8Ya4eP7D6+mYk608IhAoxpGyMrUch2TC2uvOK3rd/rw1hsTxf4AKjAZbrfd/FJaYru9ZeoLjD4bRGMdVp56F1m7pLvRiWRK62pV2Q/fjx+4KjHUrgyPd601eUIP0ayS/Rfuq8ijLpBJgO5/Y/6mFus/kjZIfRR9dXfLM67IMpyEzEITYrc/R2sedWf+YHxSh6eguAZ/kLzioar1nHLR7Wzgeu0tgWkD78WQGjpXGoefAz3xHeBg3Et0="
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDGVez4of30f+j0cWKj5kYCKeFjyNsYvG9UbOMxF5hImD2lP5MSbFBv31gFgHjx3yCG4zQRZlpuyU5uWo0qIwe9N84/LcZcB9WrWKZXDmuof7zPFy0J+Hj+LVLDQI/mVXHNwkMhBMHpPrdwA05EYDAYCYklWT4cSByu10pHtST+olF8i+A+UQgUzgNZzdJVeiYZv6MBDTYsJWptGeDUkl2B0Es3gtbGYcCCfnyS3RC7DIXlDo3NBbAr7WaHY2MBbT+R/+jicn9E3IY3NCM5jENxqmvHy9MDsxEEYgFNm7IDwq4V1VRUWy277YsvRbmEaHb+osOA5u1VNN4z3UftOZcSZgR5C/vR71cENXoPt1YQpCzu7i38ojtvL+tDVEKT7sIovrQw8q1sszNlW2nXh8RSPiIq5TMnrV73MP0egKcr9n3tfxwi1BIkLjvfom/02BkTK9R9v+VMNhYU1YwROhORCiMIgoxUGiUvtH8u38JGr7E0hhMoAjCE5k80WPUivl0="
];
mail-server = "mail.fudo.org";
};
russell = {
gateway-v4 = "10.0.0.1";
nameservers = [ "10.0.0.1" ];