No Description

default.nix 7.5KB

    let nixpkgsOptions = { overlays = [ (self: super: { /* NOTE: Namespaced under `pkgs.cryto.*` to prevent naming conflicts with upstream nixpkgs */ cryto = { fetchFromCrytoGit = self.callPackage ./lib/fetch/from-cryto-git.nix {}; nodeApplication = self.callPackage ./lib/node-application.nix {}; unpack = self.callPackage ./lib/unpack.nix {}; mobileProxy = self.callPackage ./packages/mobile-proxy { configFile = null; }; matrixRooms = self.callPackage ./packages/matrix-rooms {}; }; }) ]; }; pkgs = (import (fetchTarball "https://github.com/NixOS/nixpkgs-channels/archive/nixos-20.03.tar.gz") nixpkgsOptions); presets = { base = (import ./presets/base.nix); kvm = (import ./presets/kvm.nix); }; nginxPresets = { phpDisabled = (import ./presets/nginx/php-disabled.nix); reverseProxy = (import ./presets/nginx/reverse-proxy.nix); letsEncrypt = (import ./presets/nginx/lets-encrypt.nix); }; nodes = (import ./data/nodes.nix); tincConfiguration = (import ./lib/tinc-configuration.nix); in { network = { inherit pkgs; description = "Cryto"; }; "machine-borg2-01.cryto.net" = { pkgs, lib, ... }: { system.stateVersion = "18.09"; # FIXME: Why is this needed? nixpkgs.overlays = []; imports = [ presets.base presets.kvm ./hardware-configurations/machine-borg2-01.nix (tincConfiguration { hostname = "machine-borg2-01.cryto.net"; nodes = nodes; }) ]; boot.loader.grub.device = lib.mkForce "/dev/vda"; users.extraUsers = { backup-f0x = { createHome = true; home = "/home/backup-f0x"; }; backup-haless = { createHome = true; home = "/home/backup-haless"; }; }; users.extraGroups = { backup-f0x = { members = [ "backup-f0x" ]; }; backup-haless = { members = [ "backup-haless" ]; }; }; services.borgbackup.repos = { "f0x" = { allowSubRepos = true; quota = "400G"; path = "/home/backup-f0x"; user = "backup-f0x"; group = "backup-f0x"; authorizedKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjJDP2TDyj1X/L6gNgHCXASIWoW/VnJ77FQy39VRTi8 f0x@elephantus" ]; authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG7WSUY6Y2lsIawo8dPBu4/Omx6c7/1SMD9ve/vpcorN borg-backup@terra" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeMWPR38zXAbURVTJs+yGDnld5kO7bcgp/70l4wJG0k borg-backup@luna" ]; }; "haless" = { allowSubRepos = true; path = "/home/backup-haless"; user = "backup-haless"; group = "backup-haless"; authorizedKeys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzV5dI01NhwuL6ayiO0STcSQiDf7lEtu63NuLZKQUdZVuVHIqyt3Gquks2OI1NZGrJdXA315yw89ZqyMo+z7gSGHEV6P0fAXKW6G78JOFWsA5lGpaLxTsZ6Q7r0Z9FMqDvA5Jlsyznyj9hhO1cz01WPLzB92ypd9ifldtrAQIYQItxGXOuRkBJiShuIRqtr4Q2chXiOoRZKb4v4Gyt/UPxTpvfM/zcOz0zi1d4ijSbLqgIUJhxvrWADfdgEQ77unepDoD+HT51QBX7dj8RuYivxLSA3vpfNeCgt2CYBf6FYnmWkWSnN1RCtQPJNxsMuLzC2ZBbIkz0tDgcIBPbHxGr sven@linux-rfa7.site" ]; authorizedKeysAppendOnly = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFAOpXsDxE7SXeSw/kjgzdwEkNsL9REMabMqYVPM9rem root@machine-haless-03.cryto.net" ]; }; }; }; "machine-haless-03.cryto.net" = { pkgs, lib, config, ... }@args: { system.stateVersion = "19.03"; imports = [ presets.base presets.kvm ./hardware-configurations/machine-haless-03.nix (tincConfiguration { hostname = "machine-haless-03.cryto.net"; nodes = nodes; }) ]; deployment.healthChecks.http = let makeHostChecker = { protocol, port }: host: { scheme = protocol; port = port; path = "/"; host = host; description = "${host} (${protocol} :${toString port}) is up"; }; httpHosts = hosts: map (makeHostChecker { protocol = "http"; port = 80; }) hosts; httpsHosts = hosts: map (makeHostChecker { protocol = "https"; port = 443; }) hosts; in lib.mkMerge [ (httpHosts [ "iomfats.cryto.net" "castleroland.cryto.net" "awesomedude.cryto.net" "matrix-rooms.cryto.net" "validatem.cryto.net" ]) (httpsHosts [ "iomfats.cryto.net" "castleroland.cryto.net" "awesomedude.cryto.net" "matrix-rooms.cryto.net" "validatem.cryto.net" ]) ]; networking.firewall.allowedTCPPorts = [ 80 443 ]; services.borgbackup.jobs.system = { paths = "/"; exclude = [ "/nix" "/boot" "/sys" "/run" "/tmp" "/dev" "/proc" ]; repo = "backup-haless@machine-borg2-01.cryto.net:haless-03"; encryption = { mode = "repokey-blake2"; passphrase = (import ../private/machine-haless-03.cryto.net/borg-passphrase.nix); }; compression = "auto,zlib"; startAt = "daily"; }; services.nginx = { enable = true; virtualHosts = { "404.cryto.net" = { default = true; extraConfig = '' return 404; ''; }; "modular-matrix.cryto.net" = lib.mkMerge [ (nginxPresets.letsEncrypt) { root = ./sources/modular-matrix; } ]; "validatem.cryto.net" = lib.mkMerge [ (nginxPresets.letsEncrypt) { root = ./sources/validatem-site; } ]; "haless.cryto.net" = lib.mkMerge [ (nginxPresets.letsEncrypt) { locations."/shadow/" = { alias = ./sources/shadow-generator; }; locations."/knex-mirror/" = { alias = ./sources/knex-mirror; }; } ]; "books.cryto.net" = lib.mkMerge [ (nginxPresets.letsEncrypt) (nginxPresets.phpDisabled) ]; "todo.cryto.net" = lib.mkMerge [ (nginxPresets.phpDisabled) ]; "learn.cryto.net" = lib.mkMerge [ (nginxPresets.phpDisabled) ]; "vps-list.cryto.net" = lib.mkMerge [ (nginxPresets.letsEncrypt) (nginxPresets.phpDisabled) ]; "iomfats.cryto.net" = lib.mkMerge [ (nginxPresets.letsEncrypt) (nginxPresets.reverseProxy "http://127.0.0.1:3000/") ]; "castleroland.cryto.net" = lib.mkMerge [ (nginxPresets.letsEncrypt) (nginxPresets.reverseProxy "http://127.0.0.1:3000/") ]; "awesomedude.cryto.net" = lib.mkMerge [ (nginxPresets.letsEncrypt) (nginxPresets.reverseProxy "http://127.0.0.1:3000/") ]; "matrix-rooms.cryto.net" = lib.mkMerge [ (nginxPresets.letsEncrypt) (nginxPresets.reverseProxy "http://127.0.0.1:3842/") ]; }; }; users.extraUsers.mobile-proxy = { description = "mobile-proxy Service User"; }; systemd.services.mobile-proxy = let package = pkgs.cryto.mobileProxy.override { configFile = ./data/mobile-proxy/config.jsx; }; in { description = "Mobile Proxy"; wantedBy = ["multi-user.target"]; after = ["network.target"]; serviceConfig = { ExecStart = "${package}/bin/mobile-proxy"; User = "mobile-proxy"; Restart = "on-failure"; PermissionsStartOnly = true; }; preStart = '' mkdir -m 0700 -p /tmp/mobile-proxy-home chown mobile-proxy /tmp/mobile-proxy-home ''; environment = { HOME = "/tmp/mobile-proxy-home"; }; }; users.extraUsers.matrix-rooms = { description = "mobile-proxy Service User"; }; systemd.services.matrix-rooms = let package = pkgs.cryto.matrixRooms; in { description = "Matrix Room List Viewer"; wantedBy = ["multi-user.target"]; after = ["network.target"]; serviceConfig = { ExecStart = "${package}/bin/matrix-room-list-viewer"; /* FIXME: Change binary name in its package.json at some point */ User = "matrix-rooms"; Restart = "on-failure"; PermissionsStartOnly = true; }; # FIXME: Is a fake homes necessary for this application? preStart = '' mkdir -m 0700 -p /tmp/matrix-rooms-home chown matrix-rooms /tmp/matrix-rooms-home ''; environment = { HOME = "/tmp/matrix-rooms-home"; NODE_ENV = "production"; }; }; }; }