]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet.nix
mermet: add rspamd
[sourcephile-nix.git] / servers / mermet.nix
1 # This is the root configuration of the target machine.
2 # Usable by nixos-install and used by nixops.
3 # It is NOT copied nor usable on the target machine,
4 # only the resulting closure is copied to the target machine.
5 { pkgs, lib, config, options, ... }:
6 let
7 inherit (builtins) readFile;
8 inherit (builtins.extraBuiltins) pass pass-chomp;
9 in
10 {
11 # This value determines the NixOS release with which your system is to be
12 # compatible, in order to avoid breaking some software such as database servers.
13 # You should change this only after NixOS release notes say you should.
14 system.stateVersion = "19.09"; # Did you read the comment?
15
16 nix = {
17 autoOptimiseStore = true;
18 trustedUsers = [ "julm" ];
19 };
20
21 nixpkgs.overlays = import ../overlays.nix;
22
23 imports =
24 [ ../nixos/defaults.nix
25 mermet/unbound.nix
26 mermet/nsd.nix
27 mermet/openldap.nix
28 mermet/gitolite.nix
29 mermet/nginx.nix
30 mermet/postfix.nix
31 mermet/dovecot.nix
32 mermet/rspamd.nix
33 ];
34
35 networking = rec {
36 hostName = "mermet";
37 domainBase = "sourcephile";
38 domain = "${domainBase}.fr";
39 };
40
41 /*
42 environment.etc."sudo.conf".text = ''
43 Debug sudo /var/log/sudo_debug.log all@debug
44 Debug sudoers.so /var/log/sudo_debug.log all@debug
45 '';
46 */
47
48 users = {
49 mutableUsers = false;
50 users = {
51 root = {
52 hashedPassword = pass-chomp "servers/mermet/login/root/hashedPassword";
53 openssh.authorizedKeys.keys = [
54 (readFile ../../sec/ssh/julm.pub)
55 (readFile ../../sec/ssh/julm-mob.pub)
56 ];
57 };
58 julm = {
59 uid = 1000;
60 hashedPassword = pass-chomp "servers/mermet/login/julm/hashedPassword";
61 isNormalUser = true;
62 openssh.authorizedKeys.keys = [
63 (readFile ../../sec/ssh/julm.pub)
64 (readFile ../../sec/ssh/julm-mob.pub)
65 (readFile ../../sec/ssh/julm-mermet.pub)
66 ];
67 };
68 };
69 groups = {
70 wheel = {
71 members = [ "julm" ];
72 };
73 julm = {
74 members = [ "julm" ];
75 gid = 1000;
76 };
77 };
78 };
79
80 programs = {
81 mosh.enable = true;
82 };
83
84 environment = {
85 systemPackages = with pkgs; [
86 cryptsetup
87 direnv
88 fio
89 git
90 gptfdisk
91 lm_sensors
92 rsync
93 smartctl-tbw
94 socat
95 ];
96 };
97 }