servers/mermet/configuration.nix

   1 # This is the root configuration of the target machine.
   2 # Usable by nixos-install and used by nixops.
   3 # It is NOT copied nor usable on the target machine,
   4 # only the resulting closure is copied to the target machine.
   5 { pkgs, lib, config, options, ... }@attrs:
   6 let
   7   inherit (builtins) getEnv hasAttr readFile;
   8   inherit (builtins.extraBuiltins) pass pass-chomp;
   9 in
  10 {
  11 # This value determines the NixOS release with which your system is to be
  12 # compatible, in order to avoid breaking some software such as database servers.
  13 # You should change this only after NixOS release notes say you should.
  14 system.stateVersion = "19.09"; # Did you read the comment?
  15
  16 nix = {
  17   trustedUsers = [ "julm" ];
  18 };
  19
  20 imports = [
  21   (./. + ("/" + getEnv "MERMET_DEPLOYMENT" + ".nix"))
  22   ../../defaults.nix
  23   ../../base/unbound.nix
  24   #./nsd.nix
  25   ./knot.nix
  26   ./openldap.nix
  27   ./gitolite.nix
  28   ./nginx.nix
  29   ./postfix.nix
  30   ./dovecot.nix
  31   ./redis.nix
  32   ./rspamd.nix
  33 ] ++ lib.optional (hasAttr "nodes" attrs) (pkgs.nixops + "/share/nix/nixops/options.nix");
  34
  35 networking = rec {
  36   hostName   = "mermet";
  37   domainBase = "sourcephile";
  38   domain     = "${domainBase}.fr";
  39 };
  40
  41 /*
  42 environment.etc."sudo.conf".text = ''
  43   Debug sudo /var/log/sudo_debug.log all@debug
  44   Debug sudoers.so /var/log/sudo_debug.log all@debug
  45 '';
  46 */
  47
  48 users = {
  49   mutableUsers = false;
  50   users = {
  51     root = {
  52       openssh.authorizedKeys.keys = [
  53         (readFile ../../../sec/ssh/julm.pub)
  54         (readFile ../../../sec/ssh/julm-mob.pub)
  55       ];
  56     };
  57     julm = {
  58       uid = 1000;
  59       hashedPassword = pass-chomp "servers/mermet/login/julm/hashedPassword";
  60       isNormalUser = true;
  61       openssh.authorizedKeys.keys = [
  62         (readFile ../../../sec/ssh/julm.pub)
  63         (readFile ../../../sec/ssh/julm-mob.pub)
  64         (readFile ../../../sec/ssh/julm-mermet.pub)
  65       ];
  66     };
  67   };
  68   groups = {
  69     wheel = {
  70       members = [ "julm" ];
  71     };
  72     julm = {
  73       members = [ "julm" ];
  74       gid = 1000;
  75     };
  76   };
  77 };
  78
  79 systemd.coredump.enable = true;
  80
  81 environment = {
  82   enableDebugInfo = true;
  83   systemPackages = with pkgs; [
  84     cryptsetup
  85     direnv
  86     file
  87     fio
  88     gdb
  89     git
  90     gptfdisk
  91     #hey
  92     home-manager
  93     lm_sensors
  94     rsync
  95     smartctl-tbw
  96     socat
  97   ];
  98 };
  99 }