]> Git — Sourcephile - sourcephile-nix.git/blob - servers/losurdo.nix
losurdo: enable hardened profile
[sourcephile-nix.git] / servers / losurdo.nix
1 # NixOS configuration of losurdo.sourcephile.fr
2 #
3 # Show configuration options with, for example:
4 # nix-instantiate servers/losurdo.nix --eval -A config.networking.hostName
5 # Install/upgrade with:
6 # nix run install -f servers/losurdo.nix
7 let
8 ipv4 = "80.67.180.251";
9 system = import <nixpkgs/nixos/lib/eval-config.nix> {
10 system = "x86_64-linux";
11 modules = [
12 ../nixos/defaults.nix
13 ../nixos/base/install.nix
14 ../nixos/base/unbound.nix
15 losurdo/acme.nix
16 losurdo/debug.nix
17 losurdo/fileSystems.nix
18 losurdo/hardware.nix
19 losurdo/networking.nix
20 losurdo/postgresql.nix
21 losurdo/sanoid.nix
22 losurdo/shorewall.nix
23 losurdo/syncoid.nix
24 losurdo/system.nix
25 losurdo/transmission.nix
26 losurdo/users.nix
27 ];
28 extraArgs = {
29 name = "losurdo";
30 inherit ipv4;
31 servers = import ../servers.nix;
32 };
33 };
34 inherit (system.config) networking;
35 lib = system.pkgs.lib;
36 in with system; system // {
37 inherit ipv4;
38 install =
39 let target = "root@${networking.hostName}.${networking.domain}";
40 profile = "/nix/var/nix/profiles/system";
41 generations = "+10";
42 nixos = config.system.build.toplevel;
43 in
44 pkgs.writeShellScriptBin "bash" ''
45 PATH="$PATH:${with pkgs; lib.makeBinPath [nix openssh pass]}"
46 set -eux
47 nix ''${TRACE:+-L} copy \
48 --to ssh://${target} --substitute-on-destination \
49 ${nixos}
50 target="${target}"
51 ${config.install.shellHook}
52 ssh ${target} nix-env --profile "${profile}" --set "${nixos}" \
53 '&&' nix-env --profile "${profile}" --delete-generations "${generations}" \
54 '&&' "${profile}"/bin/switch-to-configuration "''${switch:-switch}"
55 '';
56 }