]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/configuration.nix
gitweb: cleanly disable UTF-8 encoding fix in git_blob_plain() and git_snapshot()
[sourcephile-nix.git] / servers / mermet / configuration.nix
1 # This is the root configuration of the target machine.
2 # Usable by nixos-install and used by nixops.
3 # It is NOT copied nor usable on the target machine,
4 # only the resulting closure is copied to the target machine.
5 { pkgs, lib, config, options, ... }@attrs:
6 let
7 inherit (builtins) getEnv hasAttr readFile;
8 inherit (builtins.extraBuiltins) pass pass-chomp;
9 in
10 {
11 # This value determines the NixOS release with which your system is to be
12 # compatible, in order to avoid breaking some software such as database servers.
13 # You should change this only after NixOS release notes say you should.
14 system.stateVersion = "19.09"; # Did you read the comment?
15
16 nix = {
17 trustedUsers = [ "julm" ];
18 };
19
20 imports = [
21 (./. + ("/" + getEnv "MERMET_DEPLOYMENT" + ".nix"))
22 ../../defaults.nix
23 ../../base/unbound.nix
24 #./nsd.nix
25 ./knot.nix
26 ./openldap.nix
27 ./gitolite.nix
28 ./nginx.nix
29 ./postfix.nix
30 ./dovecot.nix
31 ./redis.nix
32 ./rspamd.nix
33 ] ++ lib.optional (hasAttr "nodes" attrs) (pkgs.nixops + "/share/nix/nixops/options.nix");
34
35 networking = rec {
36 hostName = "mermet";
37 domainBase = "sourcephile";
38 domain = "${domainBase}.fr";
39 };
40
41 /*
42 environment.etc."sudo.conf".text = ''
43 Debug sudo /var/log/sudo_debug.log all@debug
44 Debug sudoers.so /var/log/sudo_debug.log all@debug
45 '';
46 */
47
48 users = {
49 mutableUsers = false;
50 users = {
51 root = {
52 openssh.authorizedKeys.keys = [
53 (readFile ../../../sec/ssh/julm.pub)
54 (readFile ../../../sec/ssh/julm-mob.pub)
55 ];
56 };
57 julm = {
58 uid = 1000;
59 hashedPassword = pass-chomp "servers/mermet/login/julm/hashedPassword";
60 isNormalUser = true;
61 openssh.authorizedKeys.keys = [
62 (readFile ../../../sec/ssh/julm.pub)
63 (readFile ../../../sec/ssh/julm-mob.pub)
64 (readFile ../../../sec/ssh/julm-mermet.pub)
65 ];
66 };
67 };
68 groups = {
69 wheel = {
70 members = [ "julm" ];
71 };
72 julm = {
73 members = [ "julm" ];
74 gid = 1000;
75 };
76 };
77 };
78
79 systemd.coredump.enable = true;
80
81 environment = {
82 enableDebugInfo = true;
83 systemPackages = with pkgs; [
84 cryptsetup
85 direnv
86 file
87 fio
88 gdb
89 git
90 gptfdisk
91 #hey
92 home-manager
93 lm_sensors
94 rsync
95 smartctl-tbw
96 socat
97 ];
98 };
99 }