servers/mermet.nix

   1 # This is the root configuration of the target machine.
   2 # Usable by nixos-install and used by nixops.
   3 # It is NOT copied nor usable on the target machine,
   4 # only the resulting closure is copied to the target machine.
   5 { pkgs, lib, config, options, ... }:
   6 let
   7   inherit (builtins) readFile;
   8   inherit (builtins.extraBuiltins) pass pass-chomp;
   9 in
  10 {
  11   # This value determines the NixOS release with which your system is to be
  12   # compatible, in order to avoid breaking some software such as database servers.
  13   # You should change this only after NixOS release notes say you should.
  14   system.stateVersion = "19.09"; # Did you read the comment?
  15
  16   nix = {
  17     trustedUsers = [ "julm" ];
  18   };
  19
  20   nixpkgs.overlays = import ../overlays.nix;
  21
  22   imports =
  23     [ ../nixos/defaults.nix
  24       mermet/unbound.nix
  25       mermet/nsd.nix
  26       mermet/openldap.nix
  27       mermet/gitolite.nix
  28       mermet/nginx.nix
  29       mermet/postfix.nix
  30       mermet/dovecot.nix
  31       mermet/rspamd.nix
  32     ];
  33
  34   networking = rec {
  35     hostName   = "mermet";
  36     domainBase = "sourcephile";
  37     domain     = "${domainBase}.fr";
  38   };
  39
  40   /*
  41   environment.etc."sudo.conf".text = ''
  42     Debug sudo /var/log/sudo_debug.log all@debug
  43     Debug sudoers.so /var/log/sudo_debug.log all@debug
  44   '';
  45   */
  46
  47   users = {
  48     mutableUsers = false;
  49     users = {
  50       root = {
  51         hashedPassword = pass-chomp "servers/mermet/login/root/hashedPassword";
  52         openssh.authorizedKeys.keys = [
  53           (readFile ../../sec/ssh/julm.pub)
  54           (readFile ../../sec/ssh/julm-mob.pub)
  55         ];
  56       };
  57       julm = {
  58         uid = 1000;
  59         hashedPassword = pass-chomp "servers/mermet/login/julm/hashedPassword";
  60         isNormalUser = true;
  61         openssh.authorizedKeys.keys = [
  62           (readFile ../../sec/ssh/julm.pub)
  63           (readFile ../../sec/ssh/julm-mob.pub)
  64           (readFile ../../sec/ssh/julm-mermet.pub)
  65         ];
  66       };
  67     };
  68     groups = {
  69       wheel = {
  70         members = [ "julm" ];
  71       };
  72       julm = {
  73         members = [ "julm" ];
  74         gid = 1000;
  75       };
  76     };
  77   };
  78
  79   programs = {
  80     mosh.enable = true;
  81   };
  82
  83   systemd.coredump.enable = true;
  84
  85   environment = {
  86     enableDebugInfo = true;
  87     systemPackages = with pkgs; [
  88       cryptsetup
  89       direnv
  90       file
  91       gdb
  92       fio
  93       git
  94       gptfdisk
  95       lm_sensors
  96       rsync
  97       smartctl-tbw
  98       socat
  99     ];
 100   };
 101 }