nix_version=2.3
nix_openpgp=B541D55301270E0BCF15CA5D8170B4726D7198DE
nixpkgs_channel=nixos-19.09-small
-nixshell_sources=(shell.nix $(test ! -d shell || find shell -type f | sort))
+nixshell_sources=(shell.nix $(test ! -d shell || find shell -type f -not -name "*~" | sort))
# nix
if ! has nix || test "$(nix --version)" != "nix (Nix) $nix_version"
${OFFLINE:+--option substituters ""} \
--realise $(nix-store --query --references .cache/nix-shell/"$hash"/shell.drv)
# Dump the environment from within the nix-shell
- local tmp_cache
- tmp_cache="$(mktemp .cache/nix-shell/dump-XXXXXXXX)"
+ local dump
+ dump="$(mktemp .cache/nix-shell/dump-XXXXXXXX)"
if nix-shell ${TRACE:+--show-trace} --pure \
- --run "$(command -v direnv) dump" >"$tmp_cache" \
+ --run "$(command -v direnv) dump" >"$dump" \
${OFFLINE:+--option substituters ""}
- then mv -f "$tmp_cache" .cache/nix-shell/"$hash"/dump
- else rm -f "$tmp_cache"; false
+ then mv -f "$dump" .cache/nix-shell/"$hash"/dump
+ else rm -f "$dump"; false
fi
trap "" EXIT
fi
all: init
-include .lib/nix/Makefile.make
include .lib/nixops/Makefile.make
#
-Subproject commit 003cd2b6ae1642056c2127d0fd80761444039817
+Subproject commit 679912ca101c07a1c064aee611f935fd96c95688
# Usable by nixos-install and used by nixops.
# It is NOT copied nor usable on the target machine,
# only the resulting closure is copied to the target machine.
-{ pkgs, lib, config, options
-# NixOps extra module inputs
-, nodes, name, uuid, resources
-, ... }:
+{ pkgs, lib, config, options, ... }:
let
inherit (builtins) readFile;
inherit (builtins.extraBuiltins) pass pass-chomp;
imports =
[ ../nixos/defaults.nix
- mermet/apu2e4.nix
- mermet/zfs.nix
- mermet/lesptts.nix
- mermet/shorewall.nix
mermet/unbound.nix
mermet/nsd.nix
mermet/openldap.nix
ipv6 = true;
verbosity = 5;
#zones = {};
+ /*
interfaces = lib.unique [
- (builtins.elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address
- (builtins.elemAt networking.interfaces.enp2s0.ipv4.addresses 0).address
- #("["+(builtins.elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address+"]")
+ #(builtins.elemAt networking.interfaces."${networking.defaultGateway.interface}".ipv4.addresses 0).address
+ #networking.privateIPv4
];
+ */
# SEE: http://www.nlnetlabs.nl/blog/2012/10/11/nsd-ratelimit/
ratelimit.enable = true;
# 100 less than the default to preserve a few Mio of RAM
*/
# FIXME: make dedicated config options
#ipv4 = (elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address;
- ipv4 = "80.67.180.251";
- ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address;
+ ipv4 = "80.67.180.129";
+ #ipv6 = (elemAt networking.interfaces.enp1s0.ipv6.addresses 0).address;
sourcephileZone = domain: ''
; A (DNS -> IPv4)
@ A ${ipv4}
--- /dev/null
+{ pkgs, lib, config, options
+# NixOps extra module inputs
+, nodes, name, uuid, resources
+, ... }:
+let inherit (config) networking; in
+{
+imports =
+ [ production/apu2e4.nix
+ production/lesptts.nix
+ production/zfs.nix
+ production/shorewall.nix
+ ];
+deployment = {
+ targetEnv = "none";
+ targetHost = (builtins.elemAt networking.interfaces.enp1s0.ipv4.addresses 0).address;
+};
+}
let
inherit (builtins.extraBuiltins) pass pass-to-file;
inherit (config) networking users;
- netIPv4 = "91.216.110.35";
- netIPv4Gateway = "91.216.110.1";
- netIPv6 = "2001:912:400:104::35";
- netIPv6Gateway = "2001:912:400:104::1";
+ netIPv4 = "80.67.180.129";
+ netIPv4Gateway = "80.67.180.134";
+ #netIPv6 = "2001:912:400:104::35";
+ #netIPv6Gateway = "2001:912:400:104::1";
lanIPv4 = "192.168.1.214";
lanNet = "192.168.1.0/24";
lanIPv4Gateway = "192.168.1.1";
# NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
# IPv6 net
- ip -6 address add ${netIPv6} dev enp1s0
- ip -6 route add ${netIPv6Gateway} dev enp1s0
- ip -6 route add default via ${netIPv6Gateway} dev enp1s0
+ #ip -6 address add ''${netIPv6} dev enp1s0
+ #ip -6 route add ''${netIPv6Gateway} dev enp1s0
+ #ip -6 route add default via ''${netIPv6Gateway} dev enp1s0
ip -4 address
ip -4 route
- ip -6 address
- ip -6 route
+ #ip -6 address
+ #ip -6 route
set +x
${config.boot.initrd.network.postCommands}
'';
# Workaround https://github.com/NixOS/nixpkgs/issues/56822
- boot.initrd.kernelModules = [ "ipv6" ];
+ #boot.initrd.kernelModules = [ "ipv6" ];
# This is a remote headless server: always try to start all the units (default.target)
# systemd's emergency shell does not try to start sshd, hence is no help.
# (though / may still be encrypted at this point).
# boot.kernelParams = [ "boot.shell_on_fail" ];
+ services.nsd.interfaces = [ netIPv4 ];
networking = {
useDHCP = false;
defaultGateway = {
address = netIPv4Gateway;
interface = "enp1s0";
};
+ /*
defaultGateway6 = {
address = netIPv6Gateway;
interface = "enp1s0";
};
+ */
#nameservers = [ ];
interfaces.enp1s0 = {
useDHCP = false;
ipv4.addresses = [ { address = netIPv4; prefixLength = 32; } ];
ipv4.routes = [ { address = networking.defaultGateway.address; prefixLength = 32; } ];
+ /*
ipv6.addresses = [ { address = netIPv6; prefixLength = 64; }
{ address = "fe80::1"; prefixLength = 10; }
];
ipv6.routes = [ { address = networking.defaultGateway6.address; prefixLength = 64; } ];
+ */
};
interfaces.enp2s0 = {
useDHCP = false;
ipv4.addresses = [ { address = lanIPv4; prefixLength = 24; } ];
+ /*
# FIXME: remove this /1 hack when the machine will be racked at PTT
ipv4.routes = [ { address = "0.0.0.0"; prefixLength = 1; via = "192.168.1.1"; }
{ address = "128.0.0.0"; prefixLength = 1; via = "192.168.1.1"; }
];
+ */
+ /*
ipv6.addresses = [ { address = "fe80::1"; prefixLength = 10; } ];
ipv6.routes = [ ];
+ */
};
interfaces.enp3s0 = {
useDHCP = false;
};
};
- deployment = {
- targetHost = (elemAt networking.interfaces.enp2s0.ipv4.addresses 0).address;
- };
}
# DOC: shorewall-interfaces(5)
?FORMAT 2
net enp1s0 arp_filter,nosmurfs,routefilter=1,tcpflags
- lan enp2s0 arp_filter,nosmurfs,routefilter=1,tcpflags,dhcp
+ lan enp2s0 arp_filter,nosmurfs,routefilter=1,tcpflags
unused enp3s0 arp_filter,nosmurfs,routefilter=1,tcpflags
'';
policy = ''
--- /dev/null
+{ pkgs, lib, config, options
+# NixOps extra module inputs
+, nodes, name, uuid, resources
+, ... }:
+let inherit (config) networking; in
+{
+imports =
+ [ staging/shorewall.nix
+ ];
+config = {
+ services.nsd.interfaces = [ networking.privateIPv4 ];
+ deployment = /*lib.mkIf (builtins.hasAttr "mermet" nodes)*/ {
+ targetEnv = "virtualbox";
+ virtualbox.headless = true;
+ virtualbox.memorySize = 1024;
+ virtualbox.vcpu = 2;
+ virtualbox.disks.disk1.baseImage = ../../.cache/nixops/virtualbox/nixops.vmdk;
+ # NOTE: resize not yet supported.
+ #virtualbox.disks.disk1.size = 6024;
+ #storeKeysOnMachine = true;
+ };
+};
+}
--- /dev/null
+{ pkgs, lib, config, ... }:
+let
+ inherit (builtins) hasAttr readFile;
+ inherit (pkgs.lib) unlinesAttrs;
+ inherit (config.services) shorewall shorewall6;
+ fw2net = ''
+ # By protocol
+ Ping(ACCEPT) $FW net
+
+ # By port
+ DNS(ACCEPT) $FW net
+ Git(ACCEPT) $FW net
+ HTTP(ACCEPT) $FW net
+ HTTPS(ACCEPT) $FW net
+ SMTP(ACCEPT) $FW net
+ SMTPS(ACCEPT) $FW net
+ SSH(ACCEPT) $FW net
+ '';
+ net2fw = ''
+ # By protocol
+ Ping(ACCEPT) net $FW
+
+ # By port
+ #HTTPS(ACCEPT) net $FW
+ DNS(ACCEPT) net $FW
+ IMAPS(ACCEPT) net $FW
+ Mosh(ACCEPT) net $FW
+ POP3S(ACCEPT) net $FW
+ SMTP(ACCEPT) net $FW
+ SMTPS(ACCEPT) net $FW
+ SSH(ACCEPT) net $FW
+ '';
+ fw2lan = ''
+ Ping(ACCEPT) $FW lan
+ DNS(ACCEPT) $FW lan
+ HTTPS(ACCEPT) $FW lan
+ '';
+ lan2fw = ''
+ Ping(ACCEPT) lan $FW
+ SSH(ACCEPT) lan $FW
+ HTTP(ACCEPT) lan $FW
+ HTTPS(ACCEPT) lan $FW
+ DNS(ACCEPT) lan $FW
+ '';
+ macros = {
+ "macro.Git" = ''
+ ?FORMAT 2
+ #ACTION SOURCE DEST PROTO DEST SOURCE RATE USER/
+ # PORT(S) PORT(S) LIMIT GROUP
+ PARAM - - tcp 9418
+ '';
+ "macro.Mosh" = ''
+ ?FORMAT 2
+ #ACTION SOURCE DEST PROTO DEST SOURCE RATE USER/
+ # PORT(S) PORT(S) LIMIT GROUP
+ PARAM - - udp 60000-61000
+ '';
+ };
+in
+{
+ services.shorewall = {
+ enable = true;
+ configs = macros // {
+ "shorewall.conf" = ''
+ ${readFile "${shorewall.package}/etc-example/shorewall/shorewall.conf"}
+ #
+ ## Custom config
+ ###
+ STARTUP_ENABLED=Yes
+ ZONE2ZONE=2
+ '';
+ zones = ''
+ # DOC: shorewall-zones(5)
+ fw firewall
+ net ipv4
+ lan ipv4
+ '';
+ interfaces = ''
+ # DOC: shorewall-interfaces(5)
+ ?FORMAT 2
+ net enp0s3 arp_filter,nosmurfs,routefilter=1,tcpflags,dhcp
+ lan enp0s8 arp_filter,nosmurfs,routefilter=1,tcpflags,dhcp
+ '';
+ policy = ''
+ # DOC: shorewall-policy(5)
+ $FW all DROP
+ lan all DROP none
+ net all DROP none
+ # WARNING: the following policy must be last
+ all all REJECT none
+ '';
+ rules = ''
+ # DOC: shorewall-rules(5)
+ #SECTION ALL
+ #SECTION ESTABLISHED
+ #SECTION RELATED
+ ?SECTION NEW
+
+ ${fw2net}
+ ${net2fw}
+
+ ${fw2lan}
+ ${lan2fw}
+ '';
+ };
+ };
+ services.shorewall6 = {
+ enable = true;
+ configs = macros // {
+ "shorewall6.conf" = ''
+ ${readFile "${shorewall6.package}/etc-example/shorewall6/shorewall6.conf"}
+ #
+ ## Custom config
+ ###
+ STARTUP_ENABLED=Yes
+ ZONE2ZONE=2
+ '';
+ zones = ''
+ # DOC: shorewall-zones(5)
+ fw firewall
+ net ipv6
+ lan ipv6
+ '';
+ interfaces = ''
+ # DOC: shorewall-interfaces(5)
+ ?FORMAT 2
+ net enp0s3 nosmurfs,tcpflags
+ lan enp0s8 nosmurfs,tcpflags
+ '';
+ policy = ''
+ # DOC: shorewall-policy(5)
+ $FW all DROP
+ lan all DROP none
+ net all DROP none
+ # WARNING: the following policy must be last
+ all all REJECT none
+ '';
+ rules = ''
+ # DOC: shorewall-rules(5)
+ #SECTION ALL
+ #SECTION ESTABLISHED
+ #SECTION RELATED
+ ?SECTION NEW
+
+ ${fw2net}
+ ${net2fw}
+
+ ${fw2lan}
+ ${lan2fw}
+ '';
+ };
+ };
+}
+++ /dev/null
-{ pkgs, lib, config, options, nodes, ... }:
-{
- deployment = lib.mkIf (builtins.hasAttr "mermet" nodes) {
- targetEnv = "virtualbox";
- virtualbox.headless = true;
- virtualbox.memorySize = 1024;
- virtualbox.vcpu = 2;
- virtualbox.disks.disk1.baseImage = ../../../.cache/nixops/virtualbox/nixops.vmdk;
- # NOTE: resize not yet supported.
- #virtualbox.disks.disk1.size = 6024;
- storeKeysOnMachine = true;
- };
-}
--- /dev/null
+{
+ mermet = import mermet/production.nix;
+}
--- /dev/null
+{
+ mermet = import mermet/staging.nix;
+}
UserKnownHostsFile ${builtins.toString ../sec/ssh/known_hosts}
'';
};
+ virtualbox = {
+ enable = true;
+ };
};
# Using modules enables to separate specific configurations
#pkgs.rxvt_unicode.terminfo
#pkgs.sqlite
pkgs.sqlite
- pkgs.sudo
+ #pkgs.sudo
pkgs.tig
pkgs.time
#pkgs.tmux
# (or when… entering the directory with direnv
# which spawns a nix-shell just to get the env).
trap "cd '$PWD' && find ../sec/tmp -type f -exec shred -fu {} +" EXIT
-
+
${modules.nix-shell.shellHook}
# nix
# executables
PATH_NIX="$(dirname "$(PATH="${builtins.getEnv "PATH"}"; which nix)")"
PATH_NIXOS=/run/wrappers/bin
- PATH_FHS="$PWD"/.config/nix/fhs-bin
- PATH_FHS_VBOX="$PWD"/.config/fhs-vbox-bin
- export PATH="$PATH_NIXOS:$PATH_FHS_VBOX:$PATH_FHS:$PATH:$PATH_NIX"
+ export PATH="$PATH_NIXOS:$PATH:$PATH_NIX:/usr/sbin:/usr/bin:/bin"
# NOTE: sudo needs to be own by root with the setuid bit,
# but this won't be the case for the sudo provided by Nix outside NixOS,
# password-store
export PASSWORD_STORE_DIR="$PWD"/../sec/pass
-
+
# gpg
export GPG_TTY=$(tty)
gpg-connect-agent updatestartuptty /bye >/dev/null
--- /dev/null
+{ pkgs, lib, config, ... }:
+let
+ inherit (lib) types;
+ inherit (config) virtualbox;
+ virtualbox-init = pkgs.writeShellScriptBin "virtualbox-init" ''
+ set -eu
+ TMPDIR=/tmp \
+ time ${pkgs.nix}/bin/nix build \
+ -I nixpkgs=${pkgs.path} \
+ --out-link .cache/nixops/virtualbox \
+ --argstr system ${virtualbox.system} \
+ -f pkgs/installer/nixops-virtualbox
+ '';
+in
+{
+options.virtualbox = {
+ enable = lib.mkEnableOption "VirtualBox image for NixOps";
+ system = lib.mkOption {
+ type = types.str;
+ example = "x86_64-linux";
+ default = pkgs.stdenv.hostPlatform.system;
+ };
+};
+config = lib.mkIf virtualbox.enable {
+ nix-shell.buildInputs = [
+ virtualbox-init
+ ];
+ nix-shell.shellHook = ''
+ '';
+};
+}
sourcephile / git / sourcephile-nix.git / commitdiff