install/logical/friot.nix

   1 {pkgs, lib, config, system, ...}:
   2 let inherit (builtins.extraBuiltins) pass;
   3     inherit (lib) types;
   4     inherit (config) networking;
   5     inherit (config.services) dovecot2;
   6     userPass = name: pass "${networking.domainBase}/${networking.hostName}/login/${name}";
   7 in {
   8 imports = [
   9   <nixpkgs-plurasoft/install/modules.nix>
  10   ../overlays/tools/networking/shorewall/service.nix
  11   ../overlays/tools/networking/shorewall6/service.nix
  12   ../overlays/servers/mail/rspamd/service.nix
  13   friot/dovecot.nix
  14   friot/gitolite.nix
  15   friot/nginx.nix
  16   friot/nsd.nix
  17   friot/postfix.nix
  18   friot/postgrey.nix
  19   friot/postgresql.nix
  20   #friot/rmilter.nix
  21   friot/rspamd.nix
  22   #friot/redmine.nix
  23   friot/shorewall.nix
  24   friot/openldap.nix
  25   #friot/discourse.nix
  26 ];
  27 options = {
  28   enable = lib.mkEnableOption "friot";
  29   networking.domainBase = lib.mkOption {
  30     type        = types.str;
  31     description = "Base network name.";
  32     example     = "example";
  33   };
  34   networking.domainAliases = lib.mkOption {
  35     type        = types.listOf types.str;
  36     description = "Domain aliases.";
  37     example     = [ "example.org" "example.net" ];
  38   };
  39   networking.zones = lib.mkOption {
  40     type = types.attrsOf (types.submodule ({name, options, config, ...}: {
  41       options = {
  42         iface = lib.mkOption {
  43           type        = types.str;
  44           description = "Interface name.";
  45           example     = "eth0";
  46         };
  47         ipv4 = lib.mkOption {
  48           type        = types.str;
  49           description = "Static IPv4 address of the machine.";
  50           example     = "1.2.3.4";
  51         };
  52         ipv6 = lib.mkOption {
  53           type        = types.str;
  54           description = "Static IPv6 address of the machine.";
  55           example     = "fe80::1";
  56         };
  57       };
  58     }));
  59   };
  60 };
  61 config = {
  62   nix = {
  63     extraOptions = ''
  64       auto-optimise-store = true
  65     '';
  66     gc = {
  67       automatic = true;
  68       dates = "weekly";
  69       options = "--delete-older-than 30d";
  70     };
  71   };
  72
  73   nixpkgs = {
  74     config = {
  75       allowUnfree = false;
  76       packageOverrides = pkgs: {
  77         postfix = pkgs.postfix.override {
  78           withLDAP = true;
  79         };
  80       };
  81     };
  82     overlays = import ../overlays.nix;
  83   };
  84
  85   boot = {
  86     initrd = {
  87       network = {
  88         enable = config.deployment.targetEnv != "virtualbox";
  89         ssh = {
  90           enable = true;
  91           authorizedKeys = [ (pass "${networking.domain}/ssh/pub/julm") ];
  92         };
  93       };
  94     };
  95     kernel = {
  96       sysctl = {
  97         "vm.swappiness" = 10;
  98         "vm.vfs_cache_pressure" = 50;
  99       };
 100     };
 101   };
 102
 103   time = {
 104     timeZone = "Europe/Paris";
 105   };
 106
 107   i18n = {
 108     consoleFont   = "Lat2-Terminus16";
 109     consoleKeyMap = "fr";
 110     defaultLocale = "fr_FR.UTF-8";
 111   };
 112
 113   networking = {
 114     domainBase    = "plurasoft";
 115     domain        = "${networking.domainBase}.fr";
 116     domainAliases = [
 117      "plura.fr"
 118      "${networking.domainBase}.org"
 119      "${networking.domainBase}.net"
 120      "${networking.domainBase}.coop"
 121     ];
 122   };
 123
 124   users = {
 125     mutableUsers = false;
 126     users = {
 127         root.initialPassword = userPass "root";
 128         root.password        = config.users.users.root.initialPassword;
 129         julm = {
 130           uid             = 1000;
 131           extraGroups     = [ "sudo" ];
 132           description     = "Julien Moutinho";
 133           home            = "/home/julm";
 134           shell           = lib.mkDefault config.users.defaultUserShell;
 135           group           = "users"; # FIXME: unknown group
 136           initialPassword = userPass "julm";
 137           password        = config.users.users.julm.initialPassword;
 138         };
 139     };
 140     groups = {
 141       julm = {
 142         gid = config.users.users.julm.uid;
 143       };
 144     };
 145   };
 146
 147   documentation.nixos = {
 148     enable = false; # NOTE: useless on this machine, and CPU intensive.
 149   };
 150
 151   services = {
 152     redis = {
 153       enable = true;
 154     };
 155     disnix = {
 156       enable = false;
 157     };
 158     openssh = {
 159       enable = true;
 160       extraConfig = ''
 161       '';
 162     };
 163     gitea = {
 164       enable = false;
 165     };
 166     sssd = {
 167       enable = false;
 168     };
 169     dovecot2 = {
 170       #debug = true;
 171     };
 172     journald = {
 173       extraConfig = ''
 174         SystemMaxUse=50M
 175       '';
 176     };
 177     x509 = {
 178       domains =
 179         lib.concatMap
 180          (dom: map (sub: "${sub}.${dom}")
 181            ["www" "git" "mail"])
 182          ([networking.domain] ++ networking.domainAliases)
 183         ++ networking.domainAliases;
 184     };
 185     #postfix.aliases = {
 186     #        "root@${networking.domain}" = [ "test@${networking.domain}" ];
 187     #  "postmaster@${networking.domain}" = [ "test@${networking.domain}" ];
 188     #       "abuse@${networking.domain}" = [ "test@${networking.domain}" ];
 189     #};
 190     #dovecot2.domains = {
 191     #  "${networking.domain}" = {
 192     #    accounts = {
 193     #      julm = {
 194     #        password = pass "${networking.domain}/mail/julm";
 195     #         # "${networking.domain}/dovecot2/julm";
 196     #           #  "{SSHA512}uyjL1KYx4z7HpfNvnKzuVxpMLD2KVueGGBvOcj7AF1EZCTVhT++IIKUVOC4xpZtWdqVD0OVmZqgYr2qpn/3t3Aj4oU0=";
 197     #        aliases  = ["julien.moutinho@${networking.domain}"];
 198     #        quota    = "512M";
 199     #      };
 200     #      test = {
 201     #        password = pass "${networking.domain}/mail/test";
 202     #         # "${networking.domain}/dovecot2/test";
 203     #           #  "{SSHA512}uyjL1KYx4z7HpfNvnKzuVxpMLD2KVueGGBvOcj7AF1EZCTVhT++IIKUVOC4xpZtWdqVD0OVmZqgYr2qpn/3t3Aj4oU0=";
 204     #        aliases  = ["test-alias@${networking.domain}"];
 205     #        quota    = "512M";
 206     #      };
 207     #    };
 208     #  };
 209     #};
 210   };
 211
 212   environment = {
 213     systemPackages = with pkgs; [
 214       htop
 215       tree
 216       vim
 217       tcpdump
 218       #mysql
 219       #procmail
 220       postgrey
 221       duplicity
 222       pypolicyd-spf
 223       unbound
 224       dropbear
 225       cryptsetup
 226       openssl
 227       postgresql
 228       openldap
 229       #mail
 230       #sympa
 231       multitail
 232       dnsutils
 233       inetutils
 234       binutils
 235       mailutils
 236       ncdu
 237       cgit
 238       #sssd
 239       #docker
 240       #nss_ldap
 241       #nss_pam_ldapd
 242       tmux
 243       socat
 244       users-init
 245       which
 246     ];
 247     etc."inputrc".text = ''
 248       # /etc/inputrc - global inputrc for libreadline
 249       # See readline(3readline) and `info rluserman' for more information.
 250
 251       # Be 8 bit clean.
 252       set input-meta on
 253       set output-meta on
 254
 255       # To allow the use of 8bit-characters like the german umlauts, uncomment
 256       # the line below. However this makes the meta key not work as a meta key,
 257       # which is annoying to those which don't need to type in 8-bit characters.
 258
 259       # set convert-meta off
 260
 261       # try to enable the application keypad when it is called.  Some systems
 262       # need this to enable the arrow keys.
 263       # set enable-keypad on
 264
 265       # see /usr/share/doc/bash/inputrc.arrows for other codes of arrow keys
 266
 267       # do not bell on tab-completion
 268       # set bell-style none
 269       # set bell-style visible
 270
 271       # some defaults / modifications for the emacs mode
 272       $if mode=emacs
 273
 274       # allow the use of the Home/End keys
 275       "\e[1~": beginning-of-line
 276       "\e[4~": end-of-line
 277
 278       # allow the use of the Delete/Insert keys
 279       "\e[3~": delete-char
 280       "\e[2~": quoted-insert
 281
 282       # mappings for "page up" and "page down" to step to the beginning/end
 283       # of the history
 284       # "\e[5~": beginning-of-history
 285       # "\e[6~": end-of-history
 286
 287       # alternate mappings for "page up" and "page down" to search the history
 288       # "\e[5~": history-search-backward
 289       # "\e[6~": history-search-forward
 290
 291       # mappings for Ctrl-left-arrow and Ctrl-right-arrow for word moving
 292       "\e[1;5C": forward-word
 293       "\e[1;5D": backward-word
 294       "\e[5C": forward-word
 295       "\e[5D": backward-word
 296       "\e\e[C": forward-word
 297       "\e\e[D": backward-word
 298
 299       $if term=rxvt
 300       "\e[7~": beginning-of-line
 301       "\e[8~": end-of-line
 302       "\eOc": forward-word
 303       "\eOd": backward-word
 304       $endif
 305
 306       # for non RH/Debian xterm, can't hurt for RH/Debian xterm
 307       # "\eOH": beginning-of-line
 308       # "\eOF": end-of-line
 309
 310       # for freebsd console
 311       # "\e[H": beginning-of-line
 312       # "\e[F": end-of-line
 313
 314       $endif
 315     '';
 316   };
 317
 318   programs = {
 319     bash = {
 320       interactiveShellInit = ''
 321         bind '"\e[A":history-search-backward'
 322         bind '"\e[B":history-search-forward'
 323
 324         # Ignore duplicate commands, ignore commands starting with a space
 325         export HISTCONTROL=erasedups:ignorespace
 326         export HISTSIZE=42000
 327         # Append to the history instead of overwriting (good for multiple connections)
 328         shopt -s histappend
 329       '';
 330       shellAliases = {
 331         cl = "clear";
 332         l  = "ls -alh";
 333         ll = "ls -l";
 334         ls = "ls --color=tty";
 335
 336         s="sudo systemctl";
 337         s-u="systemctl --user";
 338
 339         nix-clean="sudo nix-collect-garbage -d";
 340         nix-history="sudo nix-env --list-generations --profile /nix/var/nix/profiles/system";
 341         nix-rollback="sudo nixos-rebuild switch --rollback";
 342         nix-update="sudo nix-channel --update";
 343         nix-upgrade="sudo nixos-rebuild switch";
 344         nix-upstream="sudo nix-channel --list";
 345         nix-config="gvim ~/.config/nixos/*.nix";
 346       };
 347     };
 348
 349     /*
 350     dconf.enable = true;
 351
 352     gnupg.agent = {
 353       enable = true;
 354       enableSSHSupport = true;
 355     };
 356     */
 357
 358     mtr.enable = true;
 359   };
 360 };
 361 }