nix: revamp nixos/{base => profiles}/

diff --git a/nixos/modules.nix b/nixos/modules.nix
index 4085238d90aa502c6b9d13e1f77b363ec1fa3117..02227287b5ec16728c45f9447aa2fce6ed4d6531 100644 (file)
--- a/nixos/modules.nix
+++ b/nixos/modules.nix
@@ -3,6 +3,7 @@
 # its clearer, safer and more flexible if not quicker.
 {
 imports = [
+  modules/security/install.nix
   modules/services/networking/domains.nix
   #modules/services/networking/knot.nix
   modules/services/databases/openldap.nix

diff --git a/nixos/base/install.nix b/nixos/modules/security/install.nix
similarity index 75%
rename from nixos/base/install.nix
rename to nixos/modules/security/install.nix
index df8c50912299500d64efe030cf90409ceedaf976..898c89e704e101a420b2c81ae71aa6a8afa62e1e 100644 (file)
--- a/nixos/base/install.nix
+++ b/nixos/modules/security/install.nix
@@ -1,8 +1,8 @@
 { pkgs, lib, config, ... }:
 let inherit (lib) types; in
 {
-options = {
-  install.shellHook = lib.mkOption {
+options.security.install = {
+  shellHook = lib.mkOption {
     type = types.lines;
     default = "";
   };

diff --git a/nixos/base/apu2e4.nix b/nixos/profiles/hardware/apu2e4.nix
similarity index 96%
rename from nixos/base/apu2e4.nix
rename to nixos/profiles/hardware/apu2e4.nix
index 68de7f1596e1e76b4904232291a844154664b9d1..af318228752fa1e5e1b30005346e1ca01cb58aeb 100644 (file)
--- a/nixos/base/apu2e4.nix
+++ b/nixos/profiles/hardware/apu2e4.nix
@@ -62,8 +62,7 @@ boot.initrd = {
     "igb"
   ];
 };
-boot.kernelModules = [];
-boot.extraModulePackages = [];
+
 boot.kernelParams = [
   "gfxpayload=text"
   #"console=tty0"

diff --git a/nixos/base/dl10j.nix b/nixos/profiles/hardware/dl10j.nix
similarity index 100%
rename from nixos/base/dl10j.nix
rename to nixos/profiles/hardware/dl10j.nix

diff --git a/nixos/base/unbound.nix b/nixos/profiles/services/unbound.nix
similarity index 100%
rename from nixos/base/unbound.nix
rename to nixos/profiles/services/unbound.nix

diff --git a/nixos/base/unbound/named.root b/nixos/profiles/services/unbound/named.root
similarity index 100%
rename from nixos/base/unbound/named.root
rename to nixos/profiles/services/unbound/named.root

diff --git a/nixos/base/zfs.nix b/nixos/profiles/systems/zfs.nix
similarity index 100%
rename from nixos/base/zfs.nix
rename to nixos/profiles/systems/zfs.nix

diff --git a/servers/losurdo.nix b/servers/losurdo.nix
index 8853546aa92d30401536716a89c1f91902aa2741..fe9299448464d0e94981ea20e593e3e46139e482 100644 (file)
--- a/servers/losurdo.nix
+++ b/servers/losurdo.nix
@@ -9,9 +9,9 @@ let
   system = import <nixpkgs/nixos/lib/eval-config.nix> {
     system = "x86_64-linux";
     modules = [
+      <nixpkgs/nixos/modules/profiles/hardened.nix>
       ../nixos/defaults.nix
-      ../nixos/base/install.nix
-      ../nixos/base/unbound.nix
+      ../nixos/profiles/services/unbound.nix
       losurdo/acme.nix
       losurdo/debug.nix
       losurdo/fail2ban.nix
@@ -48,7 +48,7 @@ install =
    --to ssh://${target} --substitute-on-destination \
    ${nixos}
   target="${target}"
-  ${config.install.shellHook}
+  ${config.security.install.shellHook}
   ssh ${target} nix-env --profile "${profile}" --set "${nixos}" \
    '&&' nix-env --profile "${profile}" --delete-generations "${generations}" \
    '&&' "${profile}"/bin/switch-to-configuration "''${switch:-switch}"

diff --git a/servers/losurdo/acme/autogeree.net.nix b/servers/losurdo/acme/autogeree.net.nix
index 7a54d09cbe386b888e1753ba3b5499d593ed1b81..bd95905fc66d584bdb72cdae0b48848fc29bca98 100644 (file)
--- a/servers/losurdo/acme/autogeree.net.nix
+++ b/servers/losurdo/acme/autogeree.net.nix
@@ -35,7 +35,7 @@ security.acme.certs."${domain}" = {
   #dnsPropagationCheck = false;
   inherit credentialsFile;
 };
-install.shellHook = ''
+security.install.shellHook = ''
   {
   cat <<-EOF
   RFC2136_NAMESERVER=ns.${domain}:53

diff --git a/servers/losurdo/acme/sourcephile.fr.nix b/servers/losurdo/acme/sourcephile.fr.nix
index 37d7454f602f4bc2166337fcfaf77a57b66961ed..a71f9ead579671bfb791f75fdd3b2ef45183a5a5 100644 (file)
--- a/servers/losurdo/acme/sourcephile.fr.nix
+++ b/servers/losurdo/acme/sourcephile.fr.nix
@@ -32,7 +32,7 @@ security.acme.certs."${domain}" = {
   #dnsPropagationCheck = false;
   inherit credentialsFile;
 };
-install.shellHook = ''
+security.install.shellHook = ''
   {
   cat <<-EOF
   RFC2136_NAMESERVER=ns.${domain}:53

diff --git a/servers/losurdo/fileSystems.nix b/servers/losurdo/fileSystems.nix
index da7f4299866de93a1e908c027f3d9d66ab4ba007..b1df24bda2e96783b1b9492fd0be2269e9bff9e4 100644 (file)
--- a/servers/losurdo/fileSystems.nix
+++ b/servers/losurdo/fileSystems.nix
@@ -1,7 +1,7 @@
 { pkgs, lib, config, ... }:
 {
 imports = [
-  ../../nixos/base/zfs.nix
+  ../../nixos/profiles/systems/zfs.nix
 ];
 
 /*

diff --git a/servers/losurdo/hardware.nix b/servers/losurdo/hardware.nix
index 7527de92cf363df6e0a378d6062013e987e7ad55..5c8fc7313d760d6317b700c25fe1efeb9b3590f0 100644 (file)
--- a/servers/losurdo/hardware.nix
+++ b/servers/losurdo/hardware.nix
@@ -1,7 +1,7 @@
 { pkgs, lib, config, ... }:
 {
 imports = [
-  ../../nixos/base/dl10j.nix
+  ../../nixos/profiles/hardware/dl10j.nix
 ];
 
 # The 32-bit host id of the machine, formatted as 8 hexadecimal characters.

diff --git a/servers/losurdo/postgresql/openconcerto.nix b/servers/losurdo/postgresql/openconcerto.nix
index bca40bd726eee2a92cc65dd93cfbdb0689e0c133..b593ec0794f88212f8b3eb5fff3829924314b115 100644 (file)
--- a/servers/losurdo/postgresql/openconcerto.nix
+++ b/servers/losurdo/postgresql/openconcerto.nix
@@ -66,7 +66,7 @@ services.postgresql = {
     user       root             ${owner}
   '';
 };
-install.shellHook = ''
+security.install.shellHook = ''
   pass "servers/losurdo/postgresql/pass/${owner}" |
   ssh "$target" install -D -m 0400 -o root -g root /dev/stdin \
    /run/keys/postgresql_pass_${owner}

diff --git a/servers/losurdo/system.nix b/servers/losurdo/system.nix
index e82414e4797819ab754eb197fa4a41af140f1384..8b0f87f8520c73d430fabfbf5a31782268954b0b 100644 (file)
--- a/servers/losurdo/system.nix
+++ b/servers/losurdo/system.nix
@@ -1,9 +1,5 @@
 { pkgs, lib, config, ... }:
 {
-imports = [
-  <nixpkgs/nixos/modules/profiles/hardened.nix>
-];
-
 # This value determines the NixOS release with which your system is to be
 # compatible, in order to avoid breaking some software such as database servers.
 # You should change this only after NixOS release notes say you should.
@@ -13,6 +9,8 @@ system.stateVersion = "19.09"; # Did you read the comment?
 # and let mosh work smoothly.
 services.logind.killUserProcesses = false;
 
+services.unbound.enable = true;
+
 environment.systemPackages = with pkgs; [
   cryptsetup
   direnv
@@ -28,6 +26,6 @@ environment.systemPackages = with pkgs; [
   smartctl-tbw
   socat
   sanoid
-  iptables-nftables-compat
+  #iptables-nftables-compat
 ];
 }

diff --git a/servers/losurdo/test.nix b/servers/losurdo/test.nix
index 026d26fb8ada2aeb7f8168f458a1e6681f6a3eda..1c8ee2f6d4898c08810842d722dbdb14c7a7a2d0 100644 (file)
--- a/servers/losurdo/test.nix
+++ b/servers/losurdo/test.nix
@@ -2,8 +2,8 @@
 imports = [
   <nixops/options.nix>
   <nixops/resource.nix>
-  ../../nixos/base/unbound.nix
   ../../nixos/defaults.nix
+  ../../nixos/profiles/services/unbound.nix
   ./users.nix
   ./system.nix
 ];

diff --git a/servers/losurdo/users.nix b/servers/losurdo/users.nix
index 316176bbabdedd8eeea59129334431636e467a82..a9ecb91c19b973ebc2a21a2f96af8a3978307712 100644 (file)
--- a/servers/losurdo/users.nix
+++ b/servers/losurdo/users.nix
@@ -39,7 +39,7 @@ users = {
   };
 };
 
-install.shellHook = ''
+security.install.shellHook = ''
   pass "servers/losurdo/root/ssh/id_ed25519" |
   ssh "$target" install -m 0400 -o root -g root /dev/stdin \
    /root/.ssh/id_ed25519

diff --git a/servers/mermet.nix b/servers/mermet.nix
index 6edc3978e899acf058516f0dec42d0587ee02544..2c602b5a879cd121792393e7575c1404ec2b0496 100644 (file)
--- a/servers/mermet.nix
+++ b/servers/mermet.nix
@@ -14,8 +14,7 @@ let
     system = "x86_64-linux";
     modules = [
       ../nixos/defaults.nix
-      ../nixos/base/install.nix
-      ../nixos/base/unbound.nix
+      ../nixos/profiles/services/unbound.nix
       mermet/acme.nix
       mermet/debug.nix
       mermet/dovecot.nix
@@ -59,7 +58,7 @@ install =
    --to ssh://${target} --substitute-on-destination \
    ${nixos}
   target="${target}"
-  ${config.install.shellHook}
+  ${config.security.install.shellHook}
   ssh ${target} nix-env --profile "${profile}" --set "${nixos}" \
    '&&' nix-env --profile "${profile}" --delete-generations "${generations}" \
    '&&' "${profile}"/bin/switch-to-configuration "''${switch:-switch}"

diff --git a/servers/mermet/fileSystems.nix b/servers/mermet/fileSystems.nix
index 9e64d41cb38b30ab334c1a60727e0cc9bb2566b9..7d2e82fbe3d5ee417f8c29594fedb06cf61cd616 100644 (file)
--- a/servers/mermet/fileSystems.nix
+++ b/servers/mermet/fileSystems.nix
@@ -1,7 +1,7 @@
 { pkgs, lib, config, ... }:
 {
 imports = [
-  ../../nixos/base/zfs.nix
+  ../../nixos/profiles/systems/zfs.nix
 ];
 
 /*

diff --git a/servers/mermet/hardware.nix b/servers/mermet/hardware.nix
index 636c336a536fe0cb79f9335ea1d80eb301c274df..f8b0f4f71631b45f2a7845868827c7ece0c07dfb 100644 (file)
--- a/servers/mermet/hardware.nix
+++ b/servers/mermet/hardware.nix
@@ -1,7 +1,7 @@
 { pkgs, lib, config, ... }:
 {
 imports = [
-  ../../nixos/base/apu2e4.nix
+  ../../nixos/profiles/hardware/apu2e4.nix
 ];
 
 # The 32-bit host id of the machine, formatted as 8 hexadecimal characters.

diff --git a/servers/mermet/knot/autogeree.net.nix b/servers/mermet/knot/autogeree.net.nix
index f3840e18f172eb6b10045afc03974158b38bebeb..de8a75a50ed33537132a555b4e29e6eac93728bc 100644 (file)
--- a/servers/mermet/knot/autogeree.net.nix
+++ b/servers/mermet/knot/autogeree.net.nix
@@ -16,7 +16,7 @@ let
   };
 in
 {
-install.shellHook = ''
+security.install.shellHook = ''
   # Generated with: keymgr -t acme_${domain}
   pass "servers/mermet/knot/${domain}/acme.conf" |
   ssh "$target" install -D -m 0400 -o ${users."knot".name} -g root /dev/stdin \

diff --git a/servers/mermet/knot/sourcephile.fr.nix b/servers/mermet/knot/sourcephile.fr.nix
index bab450acd96a610c6df90828c3b85280d206e2a2..571a5b2c2bf951aa7b6cf80085b3f52c784ff9fb 100644 (file)
--- a/servers/mermet/knot/sourcephile.fr.nix
+++ b/servers/mermet/knot/sourcephile.fr.nix
@@ -16,7 +16,7 @@ let
   };
 in
 {
-install.shellHook = ''
+security.install.shellHook = ''
   # Generated with: keymgr -t acme_${domainID}
   pass "servers/mermet/knot/${domain}/acme.conf" |
   ssh "$target" install -D -m 0400 -o ${users."knot".name} -g root /dev/stdin \

diff --git a/servers/mermet/rspamd/autogeree.net.nix b/servers/mermet/rspamd/autogeree.net.nix
index 4da351575466edf68037a7dfe1c3c1d0d00ebf21..b072e06d7ab016d763e3e649d488ffaa167cffc0 100644 (file)
--- a/servers/mermet/rspamd/autogeree.net.nix
+++ b/servers/mermet/rspamd/autogeree.net.nix
@@ -27,7 +27,7 @@ services.nsd.zones."${domain}".data = ''
     "+hH+Mr/4V1wnKtdosk/7+3VIQ6clTIfWhD6PlnWd78Uo5lfWnYxTem7EMc2q7j6tzGwj+Q+b4Li9fdhLqxGuD0V64/nVZit90b0HyfiV5srln2lK6Hczrwqr0gOEBGQ4YeLjOF6ldaV01mFWR9ddr9a5/gVCqw8vw7vhqXvU7yK8VHW2rdsvkNZ0bDOa66MCveD7pH2vyljrfZq9k0T/NLHrsu8CAwEAAQ=="
   )
 '';
-install.shellHook = ''
+security.install.shellHook = ''
   pass "dkim/${domain}/${selector}.key" |
   ssh "$target" install -D -m 0400 -o ${rspamd.user} -g root /dev/stdin \
    /run/keys/"dkim.${domain}.${selector}.key"

diff --git a/servers/mermet/rspamd/sourcephile.fr.nix b/servers/mermet/rspamd/sourcephile.fr.nix
index a0cc5670f6adc51b05516f4c70c87b7abe7dae5b..9307d12cd9580f3753cb8d53678edcf92f40bd28 100644 (file)
--- a/servers/mermet/rspamd/sourcephile.fr.nix
+++ b/servers/mermet/rspamd/sourcephile.fr.nix
@@ -33,7 +33,7 @@ services.nsd.zones."${domain}".data = ''
     "rWWtSTdO8DilDqN8CAwEAAQ=="
   )
 '';
-install.shellHook = ''
+security.install.shellHook = ''
   pass "dkim/${domain}/${selector}.key" |
   ssh "$target" install -D -m 0400 -o ${rspamd.user} -g root /dev/stdin \
    /run/keys/"dkim.${domain}.${selector}.key"

diff --git a/servers/mermet/system.nix b/servers/mermet/system.nix
index b65bd7373e728a749098eb80c47b380a954d8862..91cffc94e0d18fd67a1d23101b0a4669f83c372a 100644 (file)
--- a/servers/mermet/system.nix
+++ b/servers/mermet/system.nix
@@ -5,6 +5,8 @@
 # You should change this only after NixOS release notes say you should.
 system.stateVersion = "19.09"; # Did you read the comment?
 
+services.unbound.enable = true;
+
 environment.systemPackages = with pkgs; [
   cryptsetup
   direnv