Modularized configuration now kind of works. (still need to do some refactoring)

This commit is contained in:
Kevin Baensch 2019-03-20 02:57:59 +01:00
parent a0f361425a
commit 14332b2c7b
24 changed files with 144 additions and 85 deletions

View file

@ -3,10 +3,12 @@
{ {
imports = [ imports = [
./etc.nix ./etc.nix
./fonts.nix
./locale.nix ./locale.nix
./networking.nix ./networking.nix
./nix.nix ./nix.nix
./security.nix
./users.nix ./users.nix
./zsh.nix ./zsh.nix
] ++ (if (config.machine.hostName != "Ophanim") then [./fonts.nix] else [./security.nix]); ];
} }

View file

@ -1,7 +1,9 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
with lib;
{ {
environment.etc = { environment.etc = mkIf (elem "etcfiles" config.machine.conffiles) {
"i3/config".source = ./etc/i3/config; "i3/config".source = ./etc/i3/config;
"i3/py3status".source = ./etc/i3/py3status; "i3/py3status".source = ./etc/i3/py3status;
"mpv/input.conf".source = ./etc/mpv/input.conf; "mpv/input.conf".source = ./etc/mpv/input.conf;
@ -9,7 +11,7 @@
"youtube-dl.conf".source = ./etc/youtube-dl.conf; "youtube-dl.conf".source = ./etc/youtube-dl.conf;
}; };
environment.variables = { environment.variables = mkIf (elem "etcvars" config.machine.conffiles) {
EDITOR="emacsclient -ca nano"; EDITOR="emacsclient -ca nano";
NIXPKGS_ALLOW_UNFREE="1"; NIXPKGS_ALLOW_UNFREE="1";
WINEDLLOVERRIDES="winemenubuilder.exe=d"; WINEDLLOVERRIDES="winemenubuilder.exe=d";

View file

@ -1,6 +1,8 @@
{ pkgs, config, ... }: { pkgs, lib, config, ... }:
{ with lib;
mkIf (elem "fonts" config.machine.conffiles) {
fonts = { fonts = {
enableFontDir = true; enableFontDir = true;
enableGhostscriptFonts = true; enableGhostscriptFonts = true;

View file

@ -1,7 +1,7 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let let
firewallcfg = config.machine.networking.firewall; firewallcfg = config.machine.firewall;
in { in {
networking = { networking = {
hostName = config.machine.hostName; hostName = config.machine.hostName;

View file

@ -9,9 +9,9 @@
extraOptions = '' extraOptions = ''
build-timeout = 86400 # 24 hours build-timeout = 86400 # 24 hours
''; '';
sshServe.enable = true; sshServe.enable = if config.services.hydra.enable then true else false;
sshServe.keys = ( if config.networking.hostName == "Ophanim" then [ (builtins.replaceStrings ["\n"] [""] (builtins.readFile /secret/nix-ssh.pub)) ] else []); sshServe.keys = if config.services.hydra.enable then [ (builtins.readFile /secret/nix-ssh.pub) ] else [];
binaryCachePublicKeys = [ (builtins.replaceStrings ["\n"] [""] (builtins.readFile /secret/hydra_cache.pub)) ]; binaryCachePublicKeys = if config.services.hydra.enable then [ (builtins.readFile /secret/hydra_cache.pub) ] else [];
trustedBinaryCaches = [ trustedBinaryCaches = [
"https://cache.nixos.org" "https://cache.nixos.org"
"https://cache.ophanim.de" "https://cache.ophanim.de"

View file

@ -1,6 +1,8 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
{ with lib;
mkIf (elem "security" config.machine.conffiles) {
security = { security = {
audit.enable = true; audit.enable = true;
auditd.enable = true; auditd.enable = true;

View file

@ -1,6 +1,8 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
{ with lib;
mkIf (elem "zsh" config.machine.conffiles) {
programs.zsh = { programs.zsh = {
enable = true; enable = true;
autosuggestions.enable = true; autosuggestions.enable = true;

View file

@ -8,17 +8,9 @@ let
in rec { in rec {
imports = [ imports = [
cfgPath cfgPath
./config/default.nix # same problem as above
# use
# config.machine.confPath
# instead of
./machines/Lilim/Lilim.nix
# ./config/default.nix # same problem as above
./pkgs/nixpkgs.nix ./pkgs/nixpkgs.nix
./pkgs/pkgsets.nix ./pkgs/pkgsets.nix
# ./services/default.nix # same problem as above ./services/default.nix # same problem as above
]; ];
} }

View file

@ -3,10 +3,20 @@
with lib; with lib;
{ {
imports = [ ../../options/machine.nix ]; imports = [
../../options/machine.nix
./Lilim.nix
];
config.machine = { config.machine = {
confPath = ./Lilim.nix; allowUnfree = true;
hostName = "Lilim";
conffiles = [
"etcfiles"
"etcvars"
"fonts"
"zsh"
];
pkgs = [ pkgs = [
"base" "base"
"dict" "dict"
@ -20,13 +30,11 @@ with lib;
"xpkgs" "xpkgs"
]; ];
services = [ services = [
../../services/xserver.nix "xserver"
../../services/docker.nix "docker"
../../services/udev.nix "udev"
../../services/cups.nix "cups"
]; ];
allowUnfree = true;
hostName = "Lilim";
firewall = { firewall = {
allowPing = true; allowPing = true;
allowedUDPPorts = []; allowedUDPPorts = [];

View file

@ -1,23 +1,36 @@
{ config, lib }:
with lib;
{ {
confPath = ./Ophanim.nix; imports = [
../../options/machine.nix
./Ophanim.nix
];
config.machine = {
hostName = "Ophanim";
allowUnfree = true;
conffiles = [
"etcfiles"
"etcvars"
"fonts"
"zsh"
];
pkgs = [ pkgs = [
"base" "base"
"emacs" "emacs"
"server" "server"
]; ];
services = [ services = [
../../services/gitea.nix "gitea"
../../services/hydra.nix "hydra"
../../services/mailserver.nix "mailserver"
../../services/mariaDB.nix "mariaDB"
../../services/nextcloud.nix "nextcloud"
../../services/nginx.nix "nginx"
../../services/openssh.nix "openssh"
]; ];
conf = {
allowUnfree = true;
networking = {
hostName = "Ophanim";
firewall = { firewall = {
allowPing = false; allowPing = false;
allowedUDPPorts = [ 22 80 443 ]; allowedUDPPorts = [ 22 80 443 ];
@ -26,5 +39,4 @@
allowedTCPPortRanges = []; allowedTCPPortRanges = [];
}; };
}; };
};
} }

View file

@ -23,11 +23,17 @@ with lib;
''; '';
}; };
services = mkOption { services = mkOption {
type = types.listOf types.path; type = types.listOf types.string;
description = '' description = ''
List of services to be enabled. List of services to be enabled.
''; '';
}; };
conffiles = mkOption {
type = types.listOf types.string;
description = ''
List of configuration files to be enabled.
'';
};
hostName = mkOption { hostName = mkOption {
type = types.str; type = types.str;
description = '' description = ''

View file

@ -43,6 +43,7 @@ let
ntfs3g ntfs3g
oh-my-zsh oh-my-zsh
openssl openssl
parted
p7zip p7zip
pciutils pciutils
psmisc psmisc
@ -104,7 +105,7 @@ let
pkgs.ledger pkgs.ledger
yaml-mode yaml-mode
company company
/* C/C++ */ clang-format irony company-irony company-irony-c-headers flycheck-irony /* C/C++ */ irony company-irony company-irony-c-headers flycheck-irony
/* Haskell */ haskell-mode flycheck-haskell /* Haskell */ haskell-mode flycheck-haskell
/* Org */ org org-ref pdf-tools org-bullets org-caldav /* Org */ org org-ref pdf-tools org-bullets org-caldav
/* Rust */ rust-mode flycheck-rust racer /* Rust */ rust-mode flycheck-rust racer

View file

@ -1,6 +1,8 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
{ with lib;
mkIf (elem "cups" config.machine.services) {
services.printing = { services.printing = {
enable = true; enable = true;
startWhenNeeded = true; startWhenNeeded = true;

View file

@ -1,7 +1,19 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
with lib;
{ {
imports = config.machine.services; imports = [
./cups.nix
./docker.nix
./fail2ban.nix
./gitea.nix
./hydra.nix
./mailserver/default.nix
./mailserver.nix
./mariaDB.nix
./nextcloud.nix
./nginx.nix
./openssh.nix
./udev.nix
./xserver.nix
];
} }

View file

@ -1,7 +1,9 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
# Note: add privileged users to docker group for access # Note: add privileged users to docker group for access
{ with lib;
mkIf (elem "docker" config.machine.services) {
virtualisation.docker.enable = true; virtualisation.docker.enable = true;
environment.systemPackages = with pkgs; [ docker-compose docker-machine ]; environment.systemPackages = with pkgs; [ docker-compose docker-machine ];
### Docker Image stuff will probably follow here ### Docker Image stuff will probably follow here

View file

@ -1,7 +1,9 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
# mostly taken from https://github.com/davidak/nixos-config/blob/master/services/fail2ban.nix # mostly taken from https://github.com/davidak/nixos-config/blob/master/services/fail2ban.nix
{ with lib;
mkIf (elem "fail2ban" config.machine.services) {
services.fail2ban = { services.fail2ban = {
enable = true; enable = true;
jails = { jails = {
@ -50,7 +52,7 @@
action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp] action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp]
findtime = 600 findtime = 600
bantime = 7200 bantime = 7200
'' '';
}; };
}; };

View file

@ -1,6 +1,8 @@
{ stdenv, conf, pkgs, ... }: { config, lib, pkgs, ... }:
{ with lib;
mkIf (elem "gitea" config.machine.services) {
services.gitea = { services.gitea = {
enable = true; enable = true;
user = "git"; user = "git";

View file

@ -1,4 +1,4 @@
{ config, pkgs, ... }: { config, lib, pkgs, ... }:
# hydra user needs to be manually crated # hydra user needs to be manually crated
# sudo -u hydra -s # sudo -u hydra -s
@ -8,7 +8,9 @@
# https://github.com/NixOS/nixos-org-configurations/blob/master/delft/hydra.nix # https://github.com/NixOS/nixos-org-configurations/blob/master/delft/hydra.nix
# https://gist.github.com/LnL7/fcd5c0bf772f2165a1ac40be6617d2f4 # https://gist.github.com/LnL7/fcd5c0bf772f2165a1ac40be6617d2f4
{ with lib;
mkIf (elem "hydra" config.machine.services) {
# also take a look at ../conf/nix.nix # also take a look at ../conf/nix.nix
nix.buildMachines = [ nix.buildMachines = [
{ {

View file

@ -1,17 +1,15 @@
{ lib, config, pkgs, ... }: { config, lib, pkgs, ... }:
{ with lib;
imports = [
./mailserver/default.nix
];
mkIf (elem "mailserver" config.machine.services) {
mailserver = rec { mailserver = rec {
enable = true; enable = true;
fqdn = "mail.ophanim.de"; fqdn = "mail.ophanim.de";
domains = [ "ophanim.de" ]; domains = [ "ophanim.de" ];
loginAccounts = { loginAccounts = {
"derped@ophanim.de" = { "derped@ophanim.de" = {
hashedPassword = (builtins.replaceStrings ["\n"] [""] (builtins.readFile /secret/derped.mail)); hashedPassword = (builtins.readFile /secret/derped.mail);
}; };
}; };
# Use Let's Encrypt certificates. Note that this needs to set up a stripped # Use Let's Encrypt certificates. Note that this needs to set up a stripped
@ -24,9 +22,9 @@
# Enable IMAP and POP3 # Enable IMAP and POP3
enableImap = true; enableImap = true;
enablePop3 = true; enablePop3 = false;
enableImapSsl = true; enableImapSsl = true;
enablePop3Ssl = true; enablePop3Ssl = false;
# Enable the ManageSieve protocol # Enable the ManageSieve protocol
enableManageSieve = true; enableManageSieve = true;

View file

@ -1,12 +1,14 @@
{ config, pkgs, ... }: { config, lib, pkgs, ... }:
with lib;
let let
giteapwd = (builtins.replaceStrings ["\n"] [""] (builtins.readFile /secret/gitea)); giteapwd = if config.services.gitea.enable then (builtins.readFile /secret/gitea) else "";
in { in mkIf (elem "mariaDB" config.machine.services) {
services.mysql = { services.mysql = {
enable = true; enable = true;
package = pkgs.mariadb; package = pkgs.mariadb;
initialDatabases = [ { initialDatabases = [ mkIf config.services.gitea.enable {
name = "gitea"; name = "gitea";
schema = pkgs.writeText "gitea.sql" schema = pkgs.writeText "gitea.sql"
'' ''
@ -16,3 +18,4 @@ in {
} ]; } ];
}; };
} }

View file

@ -1,6 +1,8 @@
{ conf, pkgs, ... }: { config, lib, pkgs, ... }:
{ with lib;
mkIf (elem "nextcloud" config.machine.services) {
services.nextcloud = { services.nextcloud = {
enable = true; enable = true;
home = "/var/lib/nextcloud"; home = "/var/lib/nextcloud";

View file

@ -8,9 +8,9 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let with lib;
gitpkgs = import /nixpkgs/default.nix {};
in { mkIf (elem "nginx" config.machine.services) {
services.nginx = { services.nginx = {
enable = true; enable = true;
recommendedGzipSettings = true; recommendedGzipSettings = true;

View file

@ -3,7 +3,10 @@
# For reference: # For reference:
# https://infosec.mozilla.org/guidelines/openssh.html # https://infosec.mozilla.org/guidelines/openssh.html
# https://stribika.github.io/2015/01/04/secure-secure-shell.html # https://stribika.github.io/2015/01/04/secure-secure-shell.html
{
with lib;
mkIf (elem "openssh" config.machine.services) {
services.openssh = { services.openssh = {
enable = true; enable = true;
sftpFlags = [ "-f AUTHPRIV" "-l INFO" ]; sftpFlags = [ "-f AUTHPRIV" "-l INFO" ];

View file

@ -1,6 +1,8 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
{ with lib;
mkIf (elem "udev" config.machine.services) {
services.udev.extraRules = '' services.udev.extraRules = ''
Valve USB devices Valve USB devices
SUBSYSTEM=="usb", ATTRS{idVendor}=="28de", TAG+="uaccess", TAG+="udev-acl" SUBSYSTEM=="usb", ATTRS{idVendor}=="28de", TAG+="uaccess", TAG+="udev-acl"