Added cashew, did some backplane yak shaving
This commit is contained in:
@@ -0,0 +1,35 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
hostname = config.instance.hostname;
|
||||
host-ipv4 = pkgs.lib.fudo.network.host-ipv4 config hostname;
|
||||
site-name = config.fudo.hosts.${hostname}.site;
|
||||
site = config.fudo.sites.${site-name};
|
||||
|
||||
network-prefix-length =
|
||||
pkgs.lib.fudo.ip.getNetworkMask site.network;
|
||||
|
||||
local-packages = with pkgs; [
|
||||
bind
|
||||
];
|
||||
|
||||
in {
|
||||
config = {
|
||||
networking = {
|
||||
defaultGateway = {
|
||||
address = site.gateway-v4;
|
||||
interface = "extif0";
|
||||
};
|
||||
|
||||
interfaces.extif0 = {
|
||||
ipv4.addresses = [{
|
||||
address = host-ipv4;
|
||||
prefixLength = network-prefix-length;
|
||||
}];
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = local-packages;
|
||||
};
|
||||
}
|
||||
@@ -51,12 +51,6 @@ in {
|
||||
options = [ "noatime" "nodiratime" "noexec" "subvol=grafana" ];
|
||||
};
|
||||
|
||||
"/srv/gitlab" = {
|
||||
fsType = "btrfs";
|
||||
label = "pool0";
|
||||
options = [ "noatime" "nodiratime" "noexec" "subvol=grafana" ];
|
||||
};
|
||||
|
||||
${mail-directory} = {
|
||||
fsType = "btrfs";
|
||||
label = "pool0";
|
||||
@@ -278,12 +272,12 @@ in {
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:8001";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-By $server_addr:$server_port;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
'';
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-By $server_addr:$server_port;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -7,16 +7,6 @@ let
|
||||
|
||||
cfg = config.fudo.france.jabber;
|
||||
|
||||
generate-auth-file = name: files: let
|
||||
make-entry = name: passwd-file:
|
||||
''("${name}" . "${readFile passwd-file}")'';
|
||||
entries = mapAttrsToList make-entry files;
|
||||
content = concatStringsSep "\n" entries;
|
||||
in pkgs.writeText "${name}-backplane-auth.scm" "'(${content})";
|
||||
|
||||
host-auth-file = generate-auth-file "host" cfg.backplane.host-passwd-files;
|
||||
service-auth-file = generate-auth-file "service" cfg.backplane.service-passwd-files;
|
||||
|
||||
ldap-password-file =
|
||||
pkgs.lib.fudo.passwd.random-passwd-file "ejabberd-ldap-auth-user" 30;
|
||||
|
||||
|
||||
+203
-165
@@ -3,6 +3,7 @@
|
||||
with lib;
|
||||
let
|
||||
hostname = "nutboy3";
|
||||
host-fqdn = config.instance.host-fqdn;
|
||||
host-ipv4 = "199.87.154.175";
|
||||
domain-name = config.fudo.hosts.${hostname}.domain;
|
||||
domain = config.fudo.domains.${domain-name};
|
||||
@@ -13,184 +14,221 @@ let
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
postgresql-user =
|
||||
config.systemd.services.postgresql.serviceConfig.User;
|
||||
|
||||
files = config.fudo.secrets.files;
|
||||
|
||||
acme-copies = config.fudo.acme.host-domains.${hostname};
|
||||
|
||||
in {
|
||||
networking = {
|
||||
enableIPv6 = true;
|
||||
|
||||
nameservers = [ "1.1.1.1" ];
|
||||
defaultGateway = {
|
||||
address = site.gateway-v4;
|
||||
interface = "extif0";
|
||||
config = {
|
||||
networking = {
|
||||
enableIPv6 = true;
|
||||
|
||||
nameservers = [ "1.1.1.1" ];
|
||||
defaultGateway = {
|
||||
address = site.gateway-v4;
|
||||
interface = "extif0";
|
||||
};
|
||||
|
||||
interfaces.extif0.ipv4.addresses = [{
|
||||
address = host-ipv4;
|
||||
prefixLength = 31;
|
||||
}];
|
||||
};
|
||||
|
||||
interfaces.extif0.ipv4.addresses = [{
|
||||
address = host-ipv4;
|
||||
prefixLength = 31;
|
||||
}];
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"L /etc/adjtime - - - - /state/etc/adjtime"
|
||||
];
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"L /etc/adjtime - - - - /state/etc/adjtime"
|
||||
];
|
||||
environment.systemPackages = local-packages;
|
||||
|
||||
environment.systemPackages = local-packages;
|
||||
fudo = {
|
||||
hosts.${hostname}.external-interfaces = [ "extif0" ];
|
||||
|
||||
# networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
secrets.host-secrets.nutboy3 = let
|
||||
files = config.fudo.secrets.files;
|
||||
in {
|
||||
heimdal-master-key = {
|
||||
source-file = files.realm-master-keys."FUDO.ORG";
|
||||
target-file = "/run/heimdal/master-key";
|
||||
user = config.fudo.auth.kdc.user;
|
||||
};
|
||||
|
||||
# informis.cl-gemini = {
|
||||
# enable = true;
|
||||
ldap-keytab = {
|
||||
source-file = files.service-keytabs.${hostname}.openldap;
|
||||
target-file = "/run/openldap/ldap.keytab";
|
||||
user = config.services.openldap.user;
|
||||
};
|
||||
|
||||
# hostname = "gemini.informis.land";
|
||||
# server-ip = host-ipv4;
|
||||
# document-root = "/srv/gemini/root";
|
||||
# textfiles-archive = "${pkgs.textfiles}";
|
||||
# slynk-port = 4005;
|
||||
postgresql-keytab = {
|
||||
source-file = files.service-keytabs.nutboy3.postgres;
|
||||
target-file = "/run/postgresql/postgres.keytab";
|
||||
user = postgresql-user;
|
||||
};
|
||||
};
|
||||
|
||||
# feeds = {
|
||||
# viator = {
|
||||
# title = "viator's phlog";
|
||||
# path = "/home/viator/gemini-public/feed/";
|
||||
# url = "gemini://informis.land/user/viator/feed/";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
acme.host-domains.${hostname}.${host-fqdn}.local-copies = {
|
||||
openldap = {
|
||||
user = config.services.openldap.user;
|
||||
dependent-services = [ "openldap.service" ];
|
||||
part-of = [ config.fudo.auth.ldap-server.systemd-target ];
|
||||
};
|
||||
|
||||
fudo = {
|
||||
hosts.${hostname}.external-interfaces = [ "extif0" ];
|
||||
secrets.host-secrets.nutboy3 = let
|
||||
files = config.fudo.secrets.files;
|
||||
postgresql = {
|
||||
user = postgresql-user;
|
||||
dependent-services = [ "postgresql.service" ];
|
||||
part-of = [ config.fudo.postgresql.systemd-target ];
|
||||
};
|
||||
};
|
||||
|
||||
client.dns = {
|
||||
ipv4 = true;
|
||||
ipv6 = true;
|
||||
user = "fudo-client";
|
||||
external-interface = "extif0";
|
||||
};
|
||||
|
||||
auth = {
|
||||
ldap-server = let
|
||||
ldap-copy = acme-copies.${host-fqdn}.local-copies.openldap;
|
||||
in {
|
||||
enable = true;
|
||||
base = "dc=fudo,dc=org";
|
||||
organization = "Fudo";
|
||||
kerberos-host = host-fqdn;
|
||||
kerberos-keytab = secrets.ldap-keytab.target-file;
|
||||
listen-uris = [ "ldap:///" "ldaps:///" "ldapi:///"];
|
||||
required-services = [ ldap-copy.service ];
|
||||
|
||||
users = config.fudo.users;
|
||||
groups = config.fudo.groups;
|
||||
system-users = config.fudo.system-users;
|
||||
|
||||
state-directory = "/state/openldap";
|
||||
|
||||
ssl-chain = ldap-copy.chain;
|
||||
ssl-certificate = ldap-copy.certificate;
|
||||
ssl-private-key = ldap-copy.private-key;
|
||||
ssl-ca-certificate = "${pkgs.letsencrypt-ca}";
|
||||
};
|
||||
|
||||
kdc = {
|
||||
master-key-file =
|
||||
secrets.heimdal-master-key.target-file;
|
||||
state-directory = "/state/kerberos";
|
||||
};
|
||||
};
|
||||
|
||||
# dns.state-directory = "/state/nsd";
|
||||
|
||||
# mail-server = {
|
||||
# enableContainer = true;
|
||||
# debug = true;
|
||||
|
||||
# domain = domain-name;
|
||||
# mail-hostname = "${host-fqdn}";
|
||||
# monitoring = false;
|
||||
# mail-user = "mailuser";
|
||||
# mail-user-id = 525;
|
||||
# mail-group = "mailgroup";
|
||||
# clamav.enable = true;
|
||||
# dkim.signing = true;
|
||||
|
||||
# dovecot = {
|
||||
# ssl-certificate = acme-certificate "imap.${domain-name}";
|
||||
# ssl-private-key = acme-private-key "imap.${domain-name}";
|
||||
# };
|
||||
|
||||
# postfix = {
|
||||
# ssl-certificate = acme-certificate "smtp.${domain-name}";
|
||||
# ssl-private-key = acme-private-key "smtp.${domain-name}";
|
||||
# };
|
||||
|
||||
# # This should NOT include the primary domain
|
||||
# local-domains = [ host-fqdn "smtp.${domain-name}" ];
|
||||
|
||||
# mail-directory = "/srv/mailserver/mail";
|
||||
# state-directory = "/srv/mailserver/state";
|
||||
|
||||
# trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];
|
||||
|
||||
# alias-users = {
|
||||
# root = [ "niten" ];
|
||||
# postmaster = [ "niten" ];
|
||||
# hostmaster = [ "niten" ];
|
||||
# webmaster = [ "niten" ];
|
||||
# system = [ "niten" ];
|
||||
# admin = [ "niten" ];
|
||||
# dmarc-report = [ "niten" ];
|
||||
# };
|
||||
# };
|
||||
|
||||
postgresql = let
|
||||
cert-copy =
|
||||
config.fudo.acme.host-domains.${hostname}.${host-fqdn}.local-copies.postgresql;
|
||||
in {
|
||||
enable = true;
|
||||
ssl-certificate = cert-copy.full-certificate;
|
||||
ssl-private-key = cert-copy.private-key;
|
||||
keytab = secrets.postgresql-keytab.target-file;
|
||||
local-networks = config.instance.local-networks;
|
||||
state-directory = "/state/postgresql";
|
||||
required-services = [ cert-copy.service ];
|
||||
};
|
||||
|
||||
# git = {
|
||||
# enable = true;
|
||||
# hostname = "git.informis.land";
|
||||
# site-name = "informis git";
|
||||
# user = "gituser";
|
||||
# repository-dir = /srv/git/repo;
|
||||
# state-dir = /srv/git/state;
|
||||
# database = {
|
||||
# user = "gituser";
|
||||
# password-file =
|
||||
# secrets.gitea-database-password.target-file;
|
||||
# hostname = "127.0.0.1";
|
||||
# name = "git";
|
||||
# };
|
||||
# ssh = {
|
||||
# listen-ip = host-ipv4;
|
||||
# listen-port = 2222;
|
||||
# };
|
||||
# };
|
||||
};
|
||||
|
||||
containers.cashew = let
|
||||
initialize-host = import ../../initialize.nix;
|
||||
build-timestamp = config.instance.build-timestamp;
|
||||
site = "nuttyclub-vm";
|
||||
domain = config.instance.local-domain;
|
||||
profile = "container";
|
||||
in {
|
||||
# heimdal-master-key = {
|
||||
# source-file = files.realm-master-keys."FUDO.ORG";
|
||||
# target-file = "/run/heimdal/master-key";
|
||||
# user = config.fudo.auth.kdc.user;
|
||||
# };
|
||||
autoStart = true;
|
||||
|
||||
# ipropd-keytab = {
|
||||
# source-file = files.service-keytabs.legatus.ipropd;
|
||||
# target-file = "/run/heimdal/ipropd.keytab";
|
||||
# user = config.fudo.auth.kdc.user;
|
||||
# };
|
||||
bindMounts = {
|
||||
|
||||
};
|
||||
|
||||
config = { pkgs, ... }: {
|
||||
imports = [
|
||||
(initialize-host {
|
||||
inherit
|
||||
lib
|
||||
pkgs
|
||||
build-timestamp
|
||||
site
|
||||
domain
|
||||
profile;
|
||||
hostname = "cashew";
|
||||
})
|
||||
];
|
||||
|
||||
instance.build-seed = build-seed;
|
||||
};
|
||||
};
|
||||
|
||||
client.dns = {
|
||||
ipv4 = true;
|
||||
ipv6 = true;
|
||||
user = "fudo-client";
|
||||
external-interface = "extif0";
|
||||
};
|
||||
|
||||
# auth.kdc = {
|
||||
# enable = true;
|
||||
# realm = "FUDO.ORG";
|
||||
# bind-addresses = [ host-ipv4 "127.0.0.1" ];
|
||||
# master-key-file =
|
||||
# secrets.heimdal-master-key.target-file;
|
||||
# state-directory = "/state/kerberos";
|
||||
# slave-config = {
|
||||
# master-host = "france";
|
||||
# ipropd-keytab = secrets.ipropd-keytab.target-file;
|
||||
# };
|
||||
# };
|
||||
|
||||
# secure-dns-proxy = {
|
||||
# enable = true;
|
||||
# upstream-dns =
|
||||
# [ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
|
||||
# bootstrap-dns = "1.1.1.1";
|
||||
# listen-ips = [ "127.0.0.1" ];
|
||||
# listen-port = 53;
|
||||
# allowed-networks = [ "1.1.1.1/32" "1.0.0.1/32" "localhost" "link-local" ];
|
||||
# };
|
||||
|
||||
# dns.state-directory = "/state/nsd";
|
||||
|
||||
# mail-server = {
|
||||
# enable = true;
|
||||
# debug = true;
|
||||
|
||||
# domain = domain-name;
|
||||
# mail-hostname = "${host-fqdn}";
|
||||
# monitoring = false;
|
||||
# mail-user = "mailuser";
|
||||
# mail-user-id = 525;
|
||||
# mail-group = "mailgroup";
|
||||
# clamav.enable = true;
|
||||
# dkim.signing = true;
|
||||
|
||||
# dovecot = {
|
||||
# ssl-certificate = acme-certificate "imap.${domain-name}";
|
||||
# ssl-private-key = acme-private-key "imap.${domain-name}";
|
||||
# };
|
||||
|
||||
# postfix = {
|
||||
# ssl-certificate = acme-certificate "smtp.${domain-name}";
|
||||
# ssl-private-key = acme-private-key "smtp.${domain-name}";
|
||||
# };
|
||||
|
||||
# # This should NOT include the primary domain
|
||||
# local-domains = [ host-fqdn "smtp.${domain-name}" ];
|
||||
|
||||
# mail-directory = "/srv/mailserver/mail";
|
||||
# state-directory = "/srv/mailserver/state";
|
||||
|
||||
# trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];
|
||||
|
||||
# alias-users = {
|
||||
# root = [ "niten" ];
|
||||
# postmaster = [ "niten" ];
|
||||
# hostmaster = [ "niten" ];
|
||||
# webmaster = [ "niten" ];
|
||||
# system = [ "niten" ];
|
||||
# admin = [ "niten" ];
|
||||
# dmarc-report = [ "niten" ];
|
||||
# };
|
||||
# };
|
||||
|
||||
# postgresql = {
|
||||
# enable = true;
|
||||
# ssl-certificate = (acme-certificate host-fqdn);
|
||||
# ssl-private-key = (acme-private-key host-fqdn);
|
||||
# keytab = secrets.postgres-keytab.target-file;
|
||||
# local-networks = local-networks;
|
||||
|
||||
# users = {
|
||||
# gituser = {
|
||||
# password-file =
|
||||
# secrets.gitea-database-password.target-file;
|
||||
# databases = {
|
||||
# git = {
|
||||
# access = "CONNECT";
|
||||
# entity-access = {
|
||||
# "ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
|
||||
# "ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
|
||||
# databases = { git = { users = [ "niten" ]; }; };
|
||||
# };
|
||||
|
||||
# git = {
|
||||
# enable = true;
|
||||
# hostname = "git.informis.land";
|
||||
# site-name = "informis git";
|
||||
# user = "gituser";
|
||||
# repository-dir = /srv/git/repo;
|
||||
# state-dir = /srv/git/state;
|
||||
# database = {
|
||||
# user = "gituser";
|
||||
# password-file =
|
||||
# secrets.gitea-database-password.target-file;
|
||||
# hostname = "127.0.0.1";
|
||||
# name = "git";
|
||||
# };
|
||||
# ssh = {
|
||||
# listen-ip = host-ipv4;
|
||||
# listen-port = 2222;
|
||||
# };
|
||||
# };
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user