update

diff --git a/build/modules/gnupg.nix b/build/modules/gnupg.nix
index 09c63e8ebb43d3acfd43a2202345008f88268d3b..79a7fc883133fe6ff368f0f85c85077925aa1b0a 100644 (file)
--- a/build/modules/gnupg.nix
+++ b/build/modules/gnupg.nix
@@ -4,12 +4,12 @@
     gnupg = {
       enable = true;
       keys = {
-        "Millogic, Coop. <contact@millogic.coop>" = {
-          uid = "Millogic, Coop. <contact@millogic.coop>";
+        "Cologic, Coop. <contact@cologic.coop>" = {
+          uid = "Cologic, Coop. <contact@cologic.coop>";
           algo   = "rsa4096";
           expire = "1y";
           usage  = ["cert" "sign"];
-          passPath = "millogic.coop/gnupg/contact@";
+          passPath = "cologic.coop/gnupg/contact@";
           subKeys = [
             { algo = "rsa4096"; expire = "1y"; usage = ["sign"];}
             { algo = "rsa4096"; expire = "1y"; usage = ["encrypt"];}

diff --git a/build/modules/nix-plugins.nix b/build/modules/nix-plugins.nix
index 79345e345d98166d94d1e6451b0e7c3a38da4d30..9afbcf52e94f9f718e3c137175466b98192403e4 100644 (file)
--- a/build/modules/nix-plugins.nix
+++ b/build/modules/nix-plugins.nix
@@ -3,11 +3,6 @@
   config = {
     nix-plugins = {
       enable = true;
-      extra-builtins = ''
-        pass     = path: exec [ "${config.nix-plugins.nix-pass}/bin/nix-pass" path ];
-        git      = dir: args: exec ([ "${config.nix-plugins.nix-git}/bin/nix-git" (builtins.toPath dir) ] ++ args);
-        git-time = dir: path: exec [ "${config.nix-plugins.nix-git}/bin/nix-git" (builtins.toPath dir) "log" "-1" "--format=%ct" "--" path ];
-        '';
     };
   };
 }

diff --git a/install/logical.nix b/install/logical.nix
index 1983961dbfd0167fefd79215fb49e08ba7e7adfa..8807342caea5b32bf33268cf0e0682d88f6e319d 100644 (file)
--- a/install/logical.nix
+++ b/install/logical.nix
@@ -1,4 +1,4 @@
 {
-network.description = "Millogic Network";
-machine1 = import logical/machine1.nix;
+network.description = "Cologic Network";
+machine1 = import logical/spof.nix;
 }

diff --git a/install/logical/machine1.nix b/install/logical/spof.nix
similarity index 83%
rename from install/logical/machine1.nix
rename to install/logical/spof.nix
index d6010660270f52bdc8b1bddddd10e422b6d4c446..0874058559f389bb0e58386f0b97994bd838aa3e 100644 (file)
--- a/install/logical/machine1.nix
+++ b/install/logical/spof.nix
@@ -25,9 +25,8 @@ options = {
     default     = "${config.networking.hostName}.${config.networking.domain}";
     description = "Fully Qualified Domain Name of the machine.";
   };
-  networking.net = lib.mkOption {
-    default = null;
-    type    = types.nullOr (types.submodule {
+  networking.zones = lib.mkOption {
+    type = types.attrsOf (types.submodule ({zone, ...}: {
       options = {
         iface = lib.mkOption {
           type        = types.str;
@@ -39,31 +38,19 @@ options = {
           description = "Static IPv4 address of the machine.";
           example     = "1.2.3.4";
         };
-      };
-    });
-  };
-  networking.lan = lib.mkOption {
-    default = null;
-    type    = types.nullOr (types.submodule {
-      options = {
-        iface = lib.mkOption {
-          type        = types.str;
-          description = "Interface name.";
-          example     = "eth0";
-        };
-        ipv4 = lib.mkOption {
+        ipv6 = lib.mkOption {
           type        = types.str;
-          description = "Static IPv4 address of the machine.";
-          example     = "192.168.1.1";
+          description = "Static IPv6 address of the machine.";
+          example     = "fe80::1";
         };
       };
-    });
+    }));
   };
 };
 config = {
-  fqdn = "millogic.coop";
+  fqdn = "cologic.coop";
   networking = {
-    domain = "millogic.coop";
+    domain = "cologic.coop";
   };
   #fqdn   = "machine1.logic.coop";
 

diff --git a/install/logical/machine1/dovecot.nix b/install/logical/spof/dovecot.nix
similarity index 100%
rename from install/logical/machine1/dovecot.nix
rename to install/logical/spof/dovecot.nix

diff --git a/install/logical/machine1/nginx.nix b/install/logical/spof/nginx.nix
similarity index 100%
rename from install/logical/machine1/nginx.nix
rename to install/logical/spof/nginx.nix

diff --git a/install/logical/machine1/nsd.nix b/install/logical/spof/nsd.nix
similarity index 72%
rename from install/logical/machine1/nsd.nix
rename to install/logical/spof/nsd.nix
index 986109c298908d5000d5d964e750cb96a45a136c..a74d926c7ededf9fc5fb34d6d392f0f8ae7777df 100644 (file)
--- a/install/logical/machine1/nsd.nix
+++ b/install/logical/spof/nsd.nix
@@ -15,10 +15,10 @@ in
       interfaces = lib.unique [
         "127.0.0.1"
         "::1"
-        config.networking.lan.ipv4
-        config.networking.net.ipv4
+        config.networking.zones.lan.ipv4
+        config.networking.zones.net.ipv4
       ];
-      zones = import nsd/millogic.coop.nix { inherit pkgs lib config; };
+      zones = import nsd/cologic.coop.nix { inherit pkgs lib config; };
     };
   };
 }

diff --git a/install/logical/machine1/nsd/millogic.coop.nix b/install/logical/spof/nsd/cologic.coop.nix
similarity index 97%
rename from install/logical/machine1/nsd/millogic.coop.nix
rename to install/logical/spof/nsd/cologic.coop.nix
index 5446e63b36c62cc5abd16da45394349849264759..0753a1c77980aa8666ae3821f3857e0b27f172a2 100644 (file)
--- a/install/logical/machine1/nsd/millogic.coop.nix
+++ b/install/logical/spof/nsd/cologic.coop.nix
@@ -14,7 +14,7 @@ let inherit (builtins) toString toPath readFile;
         ${pkgs.git}/bin/git log -1 --format="%ct" -- ${file} >$out
       ''));
     */
-    ipv4 = config.networking.net.ipv4;
+    ipv4 = config.networking.zones.net.ipv4;
 in
 {
 "${config.networking.domain}" = {

diff --git a/install/logical/machine1/postfix.nix b/install/logical/spof/postfix.nix
similarity index 100%
rename from install/logical/machine1/postfix.nix
rename to install/logical/spof/postfix.nix

diff --git a/install/logical/machine1/postgrey.nix b/install/logical/spof/postgrey.nix
similarity index 100%
rename from install/logical/machine1/postgrey.nix
rename to install/logical/spof/postgrey.nix

diff --git a/install/logical/machine1/rmilter.nix b/install/logical/spof/rmilter.nix
similarity index 100%
rename from install/logical/machine1/rmilter.nix
rename to install/logical/spof/rmilter.nix

diff --git a/install/logical/machine1/shorewall.nix b/install/logical/spof/shorewall.nix
similarity index 70%
rename from install/logical/machine1/shorewall.nix
rename to install/logical/spof/shorewall.nix
index f7f89ba6c8960cd18fc54e2167cbd538133bcaa6..a77e6f499a97f9a9a6cbba05e8f72f8eaa5f04a2 100644 (file)
--- a/install/logical/machine1/shorewall.nix
+++ b/install/logical/spof/shorewall.nix
@@ -1,6 +1,9 @@
 {pkgs, lib, config, ...}:
-let inherit (config.services) shorewall shorewall6;
-    when = x: y: if x == null then "" else y;
+let inherit (builtins) hasAttr;
+    inherit (config.services) shorewall shorewall6;
+    unlines = lib.concatStringsSep "\n";
+    zones4 = config.networking.zones;
+    zones6 = config.networking.zones;
 in
 {
 config = {
@@ -18,20 +21,18 @@ config = {
       zones = ''
         # DOC: shorewall-zones(5)
         fw firewall
-        ${when config.networking.net "net ipv4"}
-        ${when config.networking.lan "lan ipv4"}
-        '';
+        '' + unlines (lib.mapAttrsToList (zone: _: "${zone} ipv4") zones4);
       interfaces = ''
         # DOC: shorewall-interfaces(5)
         ?FORMAT 2
-        ${when config.networking.net "net ${config.networking.net.iface} arp_filter,nosmurfs,routefilter,tcpflags"}
-        ${when config.networking.lan "lan ${config.networking.lan.iface} arp_filter,nosmurfs,routefilter,tcpflags"}
-        '';
+        '' + unlines (lib.mapAttrsToList (zone: {iface, ...}:
+          "${zone} ${iface} arp_filter,nosmurfs,routefilter,tcpflags") zones4);
       policy = ''
         # DOC: shorewall-policy(5)
         $FW all DROP
-        ${when config.networking.net "net all DROP none"}
-        ${when config.networking.lan "lan all DROP none"}
+        '' + unlines (lib.mapAttrsToList (zone: _:
+          "${zone} all DROP none") zones4)
+        + ''
         # XXX: the following policy must be last
         all all REJECT none
         '';
@@ -42,18 +43,18 @@ config = {
         #SECTION RELATED
         ?SECTION NEW
         ''
-        + when config.networking.lan ''
+        + lib.optionalString (hasAttr "lan" zones4) ''
         # ----------
         # $FW -> lan
         # ----------
-        ACCEPT $FW lan:${config.networking.lan.ipv4}/24
+        ACCEPT $FW lan:${config.networking.zones.lan.ipv4}/24
         
         # ----------
         # lan -> $FW
         # ----------
-        ACCEPT lan:${config.networking.lan.ipv4}/24 $FW
+        ACCEPT lan:${config.networking.zones.lan.ipv4}/24 $FW
         ''
-        + when config.networking.net ''
+        + lib.optionalString (hasAttr "net" zones4) ''
         # ----------
         # $FW -> net
         # ----------
@@ -107,20 +108,18 @@ config = {
       zones = ''
         # DOC: shorewall-zones(5)
         fw firewall
-        ${when config.networking.net "net ipv6"}
-        ${when config.networking.lan "lan ipv6"}
-        '';
+        '' + unlines (lib.mapAttrsToList (zone: _: "${zone} ipv6") zones6);
       interfaces = ''
         # DOC: shorewall-interfaces(5)
         ?FORMAT 2
-        ${when config.networking.net "net ${config.networking.net.iface} nosmurfs,tcpflags"}
-        ${when config.networking.lan "lan ${config.networking.lan.iface} nosmurfs,tcpflags"}
-        '';
+        '' + unlines (lib.mapAttrsToList (zone: {iface, ...}:
+          "${zone} ${iface} nosmurfs,tcpflags") zones6);
       policy = ''
         # DOC: shorewall-policy(5)
         $FW all DROP
-        ${when config.networking.net "net all DROP none"}
-        ${when config.networking.lan "lan all DROP none"}
+        '' + unlines (lib.mapAttrsToList (zone: _:
+          "${zone} all DROP none") zones6)
+        + ''
         # XXX: the following policy must be last
         all all REJECT none
         '';
@@ -131,7 +130,7 @@ config = {
         #SECTION RELATED
         ?SECTION NEW
         ''
-        + when config.networking.lan ''
+        + lib.optionalString (hasAttr "lan" zones6) ''
         # ----------
         # $FW -> lan
         # ----------

diff --git a/install/physical/nixos.nix b/install/physical/nixos.nix
index 4b56136d39de56e0de14eb063b28e1d3d0f68464..b2a19cca13faf9c41e813d76a3bea926b81d5fff 100644 (file)
--- a/install/physical/nixos.nix
+++ b/install/physical/nixos.nix
@@ -1,7 +1,7 @@
 {
 machine1 = {pkgs, config, ...}: {
   deployment.targetHost = "1.2.3.4";
-  networking = {
+  networking.zones = {
     net = {
       iface = null;
       ipv4  = null;

diff --git a/install/physical/virtualbox.nix b/install/physical/virtualbox.nix
index 1549abc6d6737241e90869e2cfe91690f0fb3d7f..a5ab389062b0bcc03c89fcc3ed73acf2e3480fa8 100644 (file)
--- a/install/physical/virtualbox.nix
+++ b/install/physical/virtualbox.nix
@@ -31,14 +31,16 @@ in
         ipv4.addresses = [ { address = ipv4; prefixLength = 32; } ];
         ipv6.addresses = [ { address = "fe80::1"; prefixLength = 64; } ];
       };
-      net = {
-        iface = "enp0s3";
-        ipv4  = ipv4;
-      };
-      lan = {
-        iface = "enp0s8";
-        ipv4  = ipv4;
-        #ipv6  = "fe80::1";
+      zones = {
+        net = {
+          iface = "enp0s3";
+          ipv4  = ipv4;
+        };
+        lan = {
+          iface = "enp0s8";
+          ipv4  = ipv4;
+          #ipv6  = "fe80::1";
+        };
       };
     };
   };