]> Git — Sourcephile - sourcephile-nix.git/blob - install/logical/friot.nix
rspamd: brittle install
[sourcephile-nix.git] / install / logical / friot.nix
1 {pkgs, lib, config, system, ...}:
2 let inherit (builtins.extraBuiltins) pass;
3 inherit (lib) types;
4 inherit (config) networking;
5 inherit (config.services) dovecot2;
6 userPass = name: pass "${networking.domainBase}/${networking.hostName}/login/${name}";
7 in {
8 imports = [
9 <nixpkgs-commonsoft/install/modules.nix>
10 ../overlays/tools/networking/shorewall/service.nix
11 ../overlays/tools/networking/shorewall6/service.nix
12 ../overlays/servers/mail/rspamd/service.nix
13 friot/dovecot.nix
14 friot/gitolite.nix
15 friot/nginx.nix
16 friot/nsd.nix
17 friot/postfix.nix
18 friot/postgrey.nix
19 friot/postgresql.nix
20 #friot/rmilter.nix
21 friot/rspamd.nix
22 #friot/redmine.nix
23 friot/shorewall.nix
24 friot/openldap.nix
25 #friot/discourse.nix
26 ];
27 options = {
28 enable = lib.mkEnableOption "friot";
29 networking.domainBase = lib.mkOption {
30 type = types.str;
31 description = "Base network name.";
32 example = "example";
33 };
34 networking.domainAliases = lib.mkOption {
35 type = types.listOf types.str;
36 description = "Domain aliases.";
37 example = [ "example.org" "example.net" ];
38 };
39 networking.zones = lib.mkOption {
40 type = types.attrsOf (types.submodule ({name, options, config, ...}: {
41 options = {
42 iface = lib.mkOption {
43 type = types.str;
44 description = "Interface name.";
45 example = "eth0";
46 };
47 ipv4 = lib.mkOption {
48 type = types.str;
49 description = "Static IPv4 address of the machine.";
50 example = "1.2.3.4";
51 };
52 ipv6 = lib.mkOption {
53 type = types.str;
54 description = "Static IPv6 address of the machine.";
55 example = "fe80::1";
56 };
57 };
58 }));
59 };
60 };
61 config = {
62 nix = {
63 extraOptions = ''
64 auto-optimise-store = true
65 '';
66 gc = {
67 automatic = true;
68 dates = "weekly";
69 options = "--delete-older-than 30d";
70 };
71 };
72
73 nixpkgs = {
74 config = {
75 allowUnfree = false;
76 packageOverrides = pkgs: {
77 postfix = pkgs.postfix.override {
78 withLDAP = true;
79 };
80 };
81 };
82 overlays = import ../overlays.nix;
83 };
84
85 boot = {
86 initrd = {
87 network = {
88 enable = config.deployment.targetEnv != "virtualbox";
89 ssh = {
90 enable = true;
91 authorizedKeys = [ (pass "${networking.domain}/ssh/pub/julm") ];
92 };
93 };
94 };
95 kernel = {
96 sysctl = {
97 "vm.swappiness" = 10;
98 "vm.vfs_cache_pressure" = 50;
99 };
100 };
101 };
102
103 time = {
104 timeZone = "Europe/Paris";
105 };
106
107 i18n = {
108 consoleFont = "Lat2-Terminus16";
109 consoleKeyMap = "fr";
110 defaultLocale = "fr_FR.UTF-8";
111 };
112
113 networking = {
114 domainBase = "commonsoft";
115 domain = "${networking.domainBase}.org";
116 domainAliases = [
117 "${networking.domainBase}.net"
118 "${networking.domainBase}.coop"
119 ];
120 };
121
122 users = {
123 mutableUsers = false;
124 users = {
125 root.initialPassword = userPass "root";
126 root.password = config.users.users.root.initialPassword;
127 julm = {
128 uid = 1000;
129 extraGroups = [ "sudo" ];
130 description = "Julien Moutinho";
131 home = "/home/julm";
132 shell = lib.mkDefault config.users.defaultUserShell;
133 group = "users"; # FIXME: unknown group
134 initialPassword = userPass "julm";
135 password = config.users.users.julm.initialPassword;
136 };
137 };
138 groups = {
139 julm = {
140 gid = config.users.users.julm.uid;
141 };
142 };
143 };
144
145 services = {
146 nixosManual = {
147 enable = false; # NOTE: useless on this machine, and CPU intensive.
148 };
149 redis = {
150 enable = true;
151 };
152 disnix = {
153 enable = false;
154 };
155 openssh = {
156 enable = true;
157 extraConfig = ''
158 '';
159 };
160 gitea = {
161 enable = false;
162 };
163 sssd = {
164 enable = false;
165 };
166 dovecot2 = {
167 #debug = true;
168 };
169 journald = {
170 extraConfig = ''
171 SystemMaxUse=50M
172 '';
173 };
174 x509 = {
175 domains =
176 lib.concatMap
177 (dom: map (sub: "${sub}.${dom}")
178 ["www" "git" "mail"])
179 ([networking.domain] ++ networking.domainAliases)
180 ++ networking.domainAliases;
181 };
182 #postfix.aliases = {
183 # "root@${networking.domain}" = [ "test@${networking.domain}" ];
184 # "postmaster@${networking.domain}" = [ "test@${networking.domain}" ];
185 # "abuse@${networking.domain}" = [ "test@${networking.domain}" ];
186 #};
187 #dovecot2.domains = {
188 # "${networking.domain}" = {
189 # accounts = {
190 # julm = {
191 # password = pass "${networking.domain}/mail/julm";
192 # # "${networking.domain}/dovecot2/julm";
193 # # "{SSHA512}uyjL1KYx4z7HpfNvnKzuVxpMLD2KVueGGBvOcj7AF1EZCTVhT++IIKUVOC4xpZtWdqVD0OVmZqgYr2qpn/3t3Aj4oU0=";
194 # aliases = ["julien.moutinho@${networking.domain}"];
195 # quota = "512M";
196 # };
197 # test = {
198 # password = pass "${networking.domain}/mail/test";
199 # # "${networking.domain}/dovecot2/test";
200 # # "{SSHA512}uyjL1KYx4z7HpfNvnKzuVxpMLD2KVueGGBvOcj7AF1EZCTVhT++IIKUVOC4xpZtWdqVD0OVmZqgYr2qpn/3t3Aj4oU0=";
201 # aliases = ["test-alias@${networking.domain}"];
202 # quota = "512M";
203 # };
204 # };
205 # };
206 #};
207 };
208
209 environment = {
210 systemPackages = with pkgs; [
211 htop
212 tree
213 vim
214 tcpdump
215 #mysql
216 #procmail
217 postgrey
218 duplicity
219 pypolicyd-spf
220 unbound
221 dropbear
222 cryptsetup
223 openssl
224 postgresql
225 openldap
226 #mail
227 #sympa
228 multitail
229 dnsutils
230 inetutils
231 binutils
232 mailutils
233 ncdu
234 cgit
235 #sssd
236 #docker
237 #nss_ldap
238 #nss_pam_ldapd
239 tmux
240 socat
241 users-init
242 which
243 ];
244 etc."inputrc".text = ''
245 # /etc/inputrc - global inputrc for libreadline
246 # See readline(3readline) and `info rluserman' for more information.
247
248 # Be 8 bit clean.
249 set input-meta on
250 set output-meta on
251
252 # To allow the use of 8bit-characters like the german umlauts, uncomment
253 # the line below. However this makes the meta key not work as a meta key,
254 # which is annoying to those which don't need to type in 8-bit characters.
255
256 # set convert-meta off
257
258 # try to enable the application keypad when it is called. Some systems
259 # need this to enable the arrow keys.
260 # set enable-keypad on
261
262 # see /usr/share/doc/bash/inputrc.arrows for other codes of arrow keys
263
264 # do not bell on tab-completion
265 # set bell-style none
266 # set bell-style visible
267
268 # some defaults / modifications for the emacs mode
269 $if mode=emacs
270
271 # allow the use of the Home/End keys
272 "\e[1~": beginning-of-line
273 "\e[4~": end-of-line
274
275 # allow the use of the Delete/Insert keys
276 "\e[3~": delete-char
277 "\e[2~": quoted-insert
278
279 # mappings for "page up" and "page down" to step to the beginning/end
280 # of the history
281 # "\e[5~": beginning-of-history
282 # "\e[6~": end-of-history
283
284 # alternate mappings for "page up" and "page down" to search the history
285 # "\e[5~": history-search-backward
286 # "\e[6~": history-search-forward
287
288 # mappings for Ctrl-left-arrow and Ctrl-right-arrow for word moving
289 "\e[1;5C": forward-word
290 "\e[1;5D": backward-word
291 "\e[5C": forward-word
292 "\e[5D": backward-word
293 "\e\e[C": forward-word
294 "\e\e[D": backward-word
295
296 $if term=rxvt
297 "\e[7~": beginning-of-line
298 "\e[8~": end-of-line
299 "\eOc": forward-word
300 "\eOd": backward-word
301 $endif
302
303 # for non RH/Debian xterm, can't hurt for RH/Debian xterm
304 # "\eOH": beginning-of-line
305 # "\eOF": end-of-line
306
307 # for freebsd console
308 # "\e[H": beginning-of-line
309 # "\e[F": end-of-line
310
311 $endif
312 '';
313 };
314
315 programs = {
316 bash = {
317 interactiveShellInit = ''
318 bind '"\e[A":history-search-backward'
319 bind '"\e[B":history-search-forward'
320
321 # Ignore duplicate commands, ignore commands starting with a space
322 export HISTCONTROL=erasedups:ignorespace
323 export HISTSIZE=42000
324 # Append to the history instead of overwriting (good for multiple connections)
325 shopt -s histappend
326 '';
327 shellAliases = {
328 cl = "clear";
329 l = "ls -alh";
330 ll = "ls -l";
331 ls = "ls --color=tty";
332
333 s="sudo systemctl";
334 s-u="systemctl --user";
335
336 nix-clean="sudo nix-collect-garbage -d";
337 nix-history="sudo nix-env --list-generations --profile /nix/var/nix/profiles/system";
338 nix-rollback="sudo nixos-rebuild switch --rollback";
339 nix-update="sudo nix-channel --update";
340 nix-upgrade="sudo nixos-rebuild switch";
341 nix-upstream="sudo nix-channel --list";
342 nix-config="gvim ~/.config/nixos/*.nix";
343 };
344 };
345
346 /*
347 dconf.enable = true;
348
349 gnupg.agent = {
350 enable = true;
351 enableSSHSupport = true;
352 };
353 */
354
355 mtr.enable = true;
356 };
357 };
358 }