install/logical/friot.nix

   1 {pkgs, lib, config, system, ...}:
   2 let inherit (builtins.extraBuiltins) pass;
   3     inherit (lib) types;
   4     inherit (config) networking;
   5     inherit (config.services) dovecot2;
   6     userPass = name: pass "${networking.domainBase}/${networking.hostName}/login/${name}";
   7 in {
   8 imports = [
   9   <nixpkgs-commonsoft/install/modules.nix>
  10   ../overlays/tools/networking/shorewall/service.nix
  11   ../overlays/tools/networking/shorewall6/service.nix
  12   friot/dovecot.nix
  13   friot/gitolite.nix
  14   friot/nginx.nix
  15   friot/nsd.nix
  16   friot/postfix.nix
  17   friot/postgrey.nix
  18   friot/postgresql.nix
  19   friot/rmilter.nix
  20   #friot/redmine.nix
  21   friot/shorewall.nix
  22   friot/openldap.nix
  23   #friot/discourse.nix
  24 ];
  25 options = {
  26   enable = lib.mkEnableOption "friot";
  27   networking.domainBase = lib.mkOption {
  28     type        = types.str;
  29     description = "Base network name.";
  30     example     = "example";
  31   };
  32   networking.domainAliases = lib.mkOption {
  33     type        = types.listOf types.str;
  34     description = "Domain aliases.";
  35     example     = [ "example.org" "example.net" ];
  36   };
  37   networking.zones = lib.mkOption {
  38     type = types.attrsOf (types.submodule ({name, options, config, ...}: {
  39       options = {
  40         iface = lib.mkOption {
  41           type        = types.str;
  42           description = "Interface name.";
  43           example     = "eth0";
  44         };
  45         ipv4 = lib.mkOption {
  46           type        = types.str;
  47           description = "Static IPv4 address of the machine.";
  48           example     = "1.2.3.4";
  49         };
  50         ipv6 = lib.mkOption {
  51           type        = types.str;
  52           description = "Static IPv6 address of the machine.";
  53           example     = "fe80::1";
  54         };
  55       };
  56     }));
  57   };
  58 };
  59 config = {
  60   nix = {
  61     extraOptions = ''
  62       auto-optimise-store = true
  63     '';
  64     gc = {
  65       automatic = true;
  66       dates = "weekly";
  67       options = "--delete-older-than 30d";
  68     };
  69   };
  70
  71   nixpkgs = {
  72     config = {
  73       allowUnfree = false;
  74     };
  75     overlays = import ../overlays.nix;
  76   };
  77
  78   time = {
  79     timeZone = "Europe/Paris";
  80   };
  81
  82   i18n = {
  83     consoleFont   = "Lat2-Terminus16";
  84     consoleKeyMap = "fr";
  85     defaultLocale = "fr_FR.UTF-8";
  86   };
  87
  88   networking = {
  89     domainBase    = "commonsoft";
  90     domain        = "${networking.domainBase}.org";
  91     domainAliases = [
  92      "${networking.domainBase}.net"
  93      "${networking.domainBase}.coop"
  94     ];
  95   };
  96
  97   users = {
  98     mutableUsers = false;
  99     users = {
 100         root.initialPassword = userPass "root";
 101         root.password        = config.users.users.root.initialPassword;
 102         julm = {
 103           uid             = 1000;
 104           extraGroups     = [ "sudo" ];
 105           description     = "Julien Moutinho";
 106           home            = "/home/julm";
 107           shell           = lib.mkDefault config.users.defaultUserShell;
 108           group           = "julm"; # FIXME: unknown group
 109           initialPassword = userPass "julm";
 110           password        = config.users.users.julm.initialPassword;
 111         };
 112     };
 113     groups = {
 114       julm = {
 115         gid = config.users.users.julm.uid;
 116       };
 117     };
 118   };
 119
 120   boot.initrd = {
 121     network = {
 122       enable = config.deployment.targetEnv != "virtualbox";
 123       ssh = {
 124         enable = true;
 125         authorizedKeys = [ (pass "${networking.domain}/ssh/pub/julm") ];
 126       };
 127     };
 128   };
 129
 130   services = {
 131     nixosManual = {
 132       enable = false; # NOTE: useless on this machine, and CPU intensive.
 133     };
 134     redis = {
 135       enable = true;
 136     };
 137     disnix = {
 138       enable = false;
 139     };
 140     openssh = {
 141       enable = true;
 142       extraConfig = ''
 143       '';
 144     };
 145     gitea = {
 146       enable = false;
 147     };
 148     sssd = {
 149       enable = false;
 150     };
 151     dovecot2 = {
 152       #debug = true;
 153     };
 154     journald = {
 155       extraConfig = ''
 156         SystemMaxUse=50M
 157       '';
 158     };
 159     x509 = {
 160       domains =
 161         lib.concatMap
 162          (dom: map (sub: "${sub}.${dom}")
 163            ["www" "git" "mail"])
 164          ([networking.domain] ++ networking.domainAliases)
 165         ++ networking.domainAliases;
 166     };
 167     #postfix.aliases = {
 168     #        "root@${networking.domain}" = [ "test@${networking.domain}" ];
 169     #  "postmaster@${networking.domain}" = [ "test@${networking.domain}" ];
 170     #       "abuse@${networking.domain}" = [ "test@${networking.domain}" ];
 171     #};
 172     #dovecot2.domains = {
 173     #  "${networking.domain}" = {
 174     #    accounts = {
 175     #      julm = {
 176     #        password = pass "${networking.domain}/mail/julm";
 177     #         # "${networking.domain}/dovecot2/julm";
 178     #           #  "{SSHA512}uyjL1KYx4z7HpfNvnKzuVxpMLD2KVueGGBvOcj7AF1EZCTVhT++IIKUVOC4xpZtWdqVD0OVmZqgYr2qpn/3t3Aj4oU0=";
 179     #        aliases  = ["julien.moutinho@${networking.domain}"];
 180     #        quota    = "512M";
 181     #      };
 182     #      test = {
 183     #        password = pass "${networking.domain}/mail/test";
 184     #         # "${networking.domain}/dovecot2/test";
 185     #           #  "{SSHA512}uyjL1KYx4z7HpfNvnKzuVxpMLD2KVueGGBvOcj7AF1EZCTVhT++IIKUVOC4xpZtWdqVD0OVmZqgYr2qpn/3t3Aj4oU0=";
 186     #        aliases  = ["test-alias@${networking.domain}"];
 187     #        quota    = "512M";
 188     #      };
 189     #    };
 190     #  };
 191     #};
 192   };
 193
 194   environment = {
 195     systemPackages = with pkgs; [
 196       htop
 197       tree
 198       vim
 199       tcpdump
 200       #mysql
 201       #procmail
 202       postgrey
 203       duplicity
 204       pypolicyd-spf
 205       unbound
 206       dropbear
 207       cryptsetup
 208       openssl
 209       postgresql
 210       openldap
 211       #mail
 212       #sympa
 213       multitail
 214       dnsutils
 215       inetutils
 216       binutils
 217       mailutils
 218       ncdu
 219       cgit
 220       #sssd
 221       #docker
 222       #nss_ldap
 223       #nss_pam_ldapd
 224       tmux
 225       socat
 226       users-init
 227       which
 228     ];
 229     etc."inputrc".text = ''
 230       # /etc/inputrc - global inputrc for libreadline
 231       # See readline(3readline) and `info rluserman' for more information.
 232
 233       # Be 8 bit clean.
 234       set input-meta on
 235       set output-meta on
 236
 237       # To allow the use of 8bit-characters like the german umlauts, uncomment
 238       # the line below. However this makes the meta key not work as a meta key,
 239       # which is annoying to those which don't need to type in 8-bit characters.
 240
 241       # set convert-meta off
 242
 243       # try to enable the application keypad when it is called.  Some systems
 244       # need this to enable the arrow keys.
 245       # set enable-keypad on
 246
 247       # see /usr/share/doc/bash/inputrc.arrows for other codes of arrow keys
 248
 249       # do not bell on tab-completion
 250       # set bell-style none
 251       # set bell-style visible
 252
 253       # some defaults / modifications for the emacs mode
 254       $if mode=emacs
 255
 256       # allow the use of the Home/End keys
 257       "\e[1~": beginning-of-line
 258       "\e[4~": end-of-line
 259
 260       # allow the use of the Delete/Insert keys
 261       "\e[3~": delete-char
 262       "\e[2~": quoted-insert
 263
 264       # mappings for "page up" and "page down" to step to the beginning/end
 265       # of the history
 266       # "\e[5~": beginning-of-history
 267       # "\e[6~": end-of-history
 268
 269       # alternate mappings for "page up" and "page down" to search the history
 270       # "\e[5~": history-search-backward
 271       # "\e[6~": history-search-forward
 272
 273       # mappings for Ctrl-left-arrow and Ctrl-right-arrow for word moving
 274       "\e[1;5C": forward-word
 275       "\e[1;5D": backward-word
 276       "\e[5C": forward-word
 277       "\e[5D": backward-word
 278       "\e\e[C": forward-word
 279       "\e\e[D": backward-word
 280
 281       $if term=rxvt
 282       "\e[7~": beginning-of-line
 283       "\e[8~": end-of-line
 284       "\eOc": forward-word
 285       "\eOd": backward-word
 286       $endif
 287
 288       # for non RH/Debian xterm, can't hurt for RH/Debian xterm
 289       # "\eOH": beginning-of-line
 290       # "\eOF": end-of-line
 291
 292       # for freebsd console
 293       # "\e[H": beginning-of-line
 294       # "\e[F": end-of-line
 295
 296       $endif
 297     '';
 298   };
 299
 300   programs = {
 301     bash = {
 302       interactiveShellInit = ''
 303         bind '"\e[A":history-search-backward'
 304         bind '"\e[B":history-search-forward'
 305
 306         # Ignore duplicate commands, ignore commands starting with a space
 307         export HISTCONTROL=erasedups:ignorespace
 308         export HISTSIZE=42000
 309         # Append to the history instead of overwriting (good for multiple connections)
 310         shopt -s histappend
 311       '';
 312       shellAliases = {
 313         cl = "clear";
 314         l  = "ls -alh";
 315         ll = "ls -l";
 316         ls = "ls --color=tty";
 317
 318         s="sudo systemctl";
 319         s-u="systemctl --user";
 320
 321         nix-clean="sudo nix-collect-garbage -d";
 322         nix-history="sudo nix-env --list-generations --profile /nix/var/nix/profiles/system";
 323         nix-rollback="sudo nixos-rebuild switch --rollback";
 324         nix-update="sudo nix-channel --update";
 325         nix-upgrade="sudo nixos-rebuild switch";
 326         nix-upstream="sudo nix-channel --list";
 327         nix-config="gvim ~/.config/nixos/*.nix";
 328       };
 329     };
 330
 331     /*
 332     dconf.enable = true;
 333
 334     gnupg.agent = {
 335       enable = true;
 336       enableSSHSupport = true;
 337     };
 338     */
 339
 340     mtr.enable = true;
 341   };
 342 };
 343 }