nix-serve: add on losurdo

diff --git a/flake.lock b/flake.lock
index 6e94697732baf1b89d09a938fc2de9e348ea96c6..a80f581db1362ab10048424fe36ad2b32bc0b245 100644 (file)
--- a/flake.lock
+++ b/flake.lock
@@ -55,7 +55,7 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "narHash": "sha256-OQepJ4d1tyMPGI5ZPK3M6PTEE/hS3HYTEEhBdTJ+xdc=",
+        "narHash": "sha256-qpBUNjaf26xiKyArfPDtAKkakVS0tMriMUfoeIsrvf0=",
         "path": "./sec",
         "type": "path"
       },

diff --git a/flake.nix b/flake.nix
index afa6e64d84ffcb78a42667ed7192fcc2d497c2da..c340cfcf0d5eee9546c69f356d90d86435d87112 100644 (file)
--- a/flake.nix
+++ b/flake.nix
@@ -118,7 +118,11 @@ outputs = inputs: let
       # Example: nix run .#losurdo.sendkeys
       "sendkeys" = {
         type = "app";
-        program = config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys";
+        #program = config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys";
+        program = (pkgs.writeShellScript "sendkeys" ''
+          set -eux
+          ${pkgs.bash}/bin/bash -eux ${config.security.gnupg.agent.sendKeys + "/bin/gnupg-agent-sendKeys"}
+        '').outPath;
       };
     }) inputs.self.nixosConfigurations;}
   );

diff --git a/hosts/losurdo/nginx/sourcephile.fr.nix b/hosts/losurdo/nginx/sourcephile.fr.nix
index c0510e937505d43278d483a2fc8732cb5a42a1d0..2f242718a055196c0994dfa8dfc81aa32dc79bb8 100644 (file)
--- a/hosts/losurdo/nginx/sourcephile.fr.nix
+++ b/hosts/losurdo/nginx/sourcephile.fr.nix
@@ -2,8 +2,9 @@
 let domain = "sourcephile.fr"; in
 {
 imports = map (m: import m {inherit domain;}) [
-  sourcephile.fr/losurdo.nix
   sourcephile.fr/cryptpad.nix
+  sourcephile.fr/losurdo.nix
+  sourcephile.fr/nix-serve.nix
 ];
 security.acme.certs."${domain}" = {
   postRun = "systemctl reload nginx";

diff --git a/hosts/losurdo/nginx/sourcephile.fr/nix-serve.nix b/hosts/losurdo/nginx/sourcephile.fr/nix-serve.nix
new file mode 100644 (file)
index 0000000..d39c1fd
--- /dev/null
+++ b/hosts/losurdo/nginx/sourcephile.fr/nix-serve.nix
@@ -0,0 +1,63 @@
+{ domain, ... }:
+{ pkgs, lib, config, hostName, ... }:
+let
+  inherit (config) networking;
+  inherit (config.security) gnupg;
+  inherit (config.services) nginx nix-serve;
+  inherit (config.users) users groups;
+  srv = "nix-serve";
+in
+{
+nix.trustedUsers = [ users."nix-serve".name ];
+users.users."nix-serve".extraGroups = [ groups."keys".name ];
+security.gnupg.secrets."nix/binary-cache-key/1" = {
+  user = users."nix-serve".name;
+  systemdConfig = {
+    before = [ "nix-serve.service" ];
+    wantedBy = [ "nix-serve.service" ];
+  };
+};
+services.nix-serve = {
+  enable = true;
+  secretKeyFile = gnupg.secrets."nix/binary-cache-key/1".path;
+  bindAddress = "127.0.0.1";
+};
+services.nginx = let vhostConfig = priority:
+  {
+    #onlySSL = true;
+    #addSSL = true;
+    forceSSL = true;
+    useACMEHost = domain;
+    extraConfig = ''
+      #access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
+      #error_log  /var/log/nginx/${domain}/${srv}/error.log warn;
+      access_log off;
+      error_log  /dev/null crit;
+    '';
+    locations."/nix-cache-info" = {
+      # cache.nixos.org has priority 40
+      return = ''200 "StoreDir: ${builtins.storeDir}\nWantMassQuery: 1\nPriority: ${toString priority}\n"'';
+      extraConfig = ''
+        ${nginx.configs.https_add_headers}
+        add_header Content-Type text/plain;
+      '';
+    };
+    locations."/".extraConfig = ''
+      proxy_pass http://localhost:${toString nix-serve.port};
+      proxy_set_header Host $host;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    '';
+  };
+  in {
+  virtualHosts."nix-localcache.${domain}" = vhostConfig 30;
+  virtualHosts."nix-extracache.${domain}" = vhostConfig 60 // {
+    serverAliases = [ "${srv}.${domain}" ];
+  };
+};
+systemd.services.nginx = {
+  serviceConfig = {
+    LogsDirectory = lib.mkForce ["nginx/${domain}/${srv}"];
+  };
+};
+}

diff --git a/hosts/losurdo/system.nix b/hosts/losurdo/system.nix
index 3f8b750ca9a8d1acd976eda8d5666692df05355e..b34136177d802841473abc7b62453952aaa344ed 100644 (file)
--- a/hosts/losurdo/system.nix
+++ b/hosts/losurdo/system.nix
@@ -9,22 +9,13 @@ in
 # You should change this only after NixOS release notes say you should.
 system.stateVersion = "19.09"; # Did you read the comment?
 
+nix.gc.dates = "weekly";
+nix.gc.options = "--delete-older-than 7d";
+
 # Avoid the use of systemd-run --user --scope tmux
 # and let mosh work smoothly.
 services.logind.killUserProcesses = false;
 
-nix.gc.dates = "weekly";
-nix.gc.options = "--delete-older-than 7d";
-nix.extraOptions = ''
-  secret-key-files = ${gnupg.secrets."nix/binary-cache-key/1".path}
-'';
-security.gnupg.secrets."nix/binary-cache-key/1" = {
-  systemdConfig = {
-    before = [ "nix-daemon.service" ];
-    wantedBy = [ "nix-daemon.service" ];
-  };
-};
-
 documentation.nixos = {
   enable = false; # NOTE: useless on a server, and CPU intensive.
 };

diff --git a/hosts/losurdo/unbound.nix b/hosts/losurdo/unbound.nix
index 5983472f19a76b8da3b53e39e2cbcbe7e77da5d3..5c5d6afe828d84b07d431da3ee49209da2b2b619 100644 (file)
--- a/hosts/losurdo/unbound.nix
+++ b/hosts/losurdo/unbound.nix
@@ -19,7 +19,7 @@ services.unbound = {
       verbosity: 1
       interface: 127.0.0.1
       interface: ::1
-
+      ${lib.optionalString (!config.networking.enableIPv6) "prefer-ip4: yes"}
       port: 53
 
       # The file which contains the listing of primary root DNS servers.

diff --git a/hosts/mermet/knot/sourcephile.fr.nix b/hosts/mermet/knot/sourcephile.fr.nix
index 56bd653349287e065c26b9ae37eaf7d47361b289..f76e52e22190380e048c77387a7d12f061ae37fe 100644 (file)
--- a/hosts/mermet/knot/sourcephile.fr.nix
+++ b/hosts/mermet/knot/sourcephile.fr.nix
@@ -117,6 +117,9 @@ services.knot.zones."${domain}" = {
     cryptpad-sandbox CNAME losurdo
     mumble           CNAME mermet
     freeciv          CNAME losurdo
+    nix-serve        CNAME losurdo
+    nix-extracache   CNAME losurdo
+    nix-localcache   CNAME lan.losurdo
 
     ; SPF (Sender Policy Framework)
     @ 3600 IN SPF "v=spf1 mx ip4:${hosts.mermet.extraArgs.ipv4} -all"

diff --git a/hosts/mermet/system.nix b/hosts/mermet/system.nix
index 7bf6c0069a99443325ec521b01b84564837230c9..f5577edf63e87e9890c57e6cb9d17a25fa7f3efe 100644 (file)
--- a/hosts/mermet/system.nix
+++ b/hosts/mermet/system.nix
@@ -1,4 +1,5 @@
-{ pkgs, lib, config, ... }:
+{ pkgs, lib, config, inputs, hostName, ... }:
+let inherit (config) networking; in
 {
 # This value determines the NixOS release with which your system is to be
 # compatible, in order to avoid breaking some software such as database servers.
@@ -9,6 +10,10 @@ services.unbound.enable = true;
 
 nix.gc.dates = "daily";
 nix.gc.options = "--delete-older-than 2d";
+nix.extraOptions = ''
+  trusted-public-keys = ${builtins.readFile (inputs.secrets + "/hosts/losurdo/nix/binary-cache-key/1.pub")}
+  substituters = https://nix-extracache.${networking.domain}
+'';
 
 environment.systemPackages = with pkgs; [
   cryptsetup

diff --git a/hosts/mermet/unbound.nix b/hosts/mermet/unbound.nix
index 5983472f19a76b8da3b53e39e2cbcbe7e77da5d3..5c5d6afe828d84b07d431da3ee49209da2b2b619 100644 (file)
--- a/hosts/mermet/unbound.nix
+++ b/hosts/mermet/unbound.nix
@@ -19,7 +19,7 @@ services.unbound = {
       verbosity: 1
       interface: 127.0.0.1
       interface: ::1
-
+      ${lib.optionalString (!config.networking.enableIPv6) "prefer-ip4: yes"}
       port: 53
 
       # The file which contains the listing of primary root DNS servers.