Modularized configuration now kind of works. (still need to do some refactoring)
This commit is contained in:
parent
a0f361425a
commit
14332b2c7b
24 changed files with 144 additions and 85 deletions
|
@ -3,10 +3,12 @@
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
./etc.nix
|
./etc.nix
|
||||||
|
./fonts.nix
|
||||||
./locale.nix
|
./locale.nix
|
||||||
./networking.nix
|
./networking.nix
|
||||||
./nix.nix
|
./nix.nix
|
||||||
|
./security.nix
|
||||||
./users.nix
|
./users.nix
|
||||||
./zsh.nix
|
./zsh.nix
|
||||||
] ++ (if (config.machine.hostName != "Ophanim") then [./fonts.nix] else [./security.nix]);
|
];
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,7 +1,9 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
{
|
{
|
||||||
environment.etc = {
|
environment.etc = mkIf (elem "etcfiles" config.machine.conffiles) {
|
||||||
"i3/config".source = ./etc/i3/config;
|
"i3/config".source = ./etc/i3/config;
|
||||||
"i3/py3status".source = ./etc/i3/py3status;
|
"i3/py3status".source = ./etc/i3/py3status;
|
||||||
"mpv/input.conf".source = ./etc/mpv/input.conf;
|
"mpv/input.conf".source = ./etc/mpv/input.conf;
|
||||||
|
@ -9,7 +11,7 @@
|
||||||
"youtube-dl.conf".source = ./etc/youtube-dl.conf;
|
"youtube-dl.conf".source = ./etc/youtube-dl.conf;
|
||||||
};
|
};
|
||||||
|
|
||||||
environment.variables = {
|
environment.variables = mkIf (elem "etcvars" config.machine.conffiles) {
|
||||||
EDITOR="emacsclient -ca nano";
|
EDITOR="emacsclient -ca nano";
|
||||||
NIXPKGS_ALLOW_UNFREE="1";
|
NIXPKGS_ALLOW_UNFREE="1";
|
||||||
WINEDLLOVERRIDES="winemenubuilder.exe=d";
|
WINEDLLOVERRIDES="winemenubuilder.exe=d";
|
||||||
|
|
|
@ -1,6 +1,8 @@
|
||||||
{ pkgs, config, ... }:
|
{ pkgs, lib, config, ... }:
|
||||||
|
|
||||||
{
|
with lib;
|
||||||
|
|
||||||
|
mkIf (elem "fonts" config.machine.conffiles) {
|
||||||
fonts = {
|
fonts = {
|
||||||
enableFontDir = true;
|
enableFontDir = true;
|
||||||
enableGhostscriptFonts = true;
|
enableGhostscriptFonts = true;
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
firewallcfg = config.machine.networking.firewall;
|
firewallcfg = config.machine.firewall;
|
||||||
in {
|
in {
|
||||||
networking = {
|
networking = {
|
||||||
hostName = config.machine.hostName;
|
hostName = config.machine.hostName;
|
||||||
|
|
|
@ -9,9 +9,9 @@
|
||||||
extraOptions = ''
|
extraOptions = ''
|
||||||
build-timeout = 86400 # 24 hours
|
build-timeout = 86400 # 24 hours
|
||||||
'';
|
'';
|
||||||
sshServe.enable = true;
|
sshServe.enable = if config.services.hydra.enable then true else false;
|
||||||
sshServe.keys = ( if config.networking.hostName == "Ophanim" then [ (builtins.replaceStrings ["\n"] [""] (builtins.readFile /secret/nix-ssh.pub)) ] else []);
|
sshServe.keys = if config.services.hydra.enable then [ (builtins.readFile /secret/nix-ssh.pub) ] else [];
|
||||||
binaryCachePublicKeys = [ (builtins.replaceStrings ["\n"] [""] (builtins.readFile /secret/hydra_cache.pub)) ];
|
binaryCachePublicKeys = if config.services.hydra.enable then [ (builtins.readFile /secret/hydra_cache.pub) ] else [];
|
||||||
trustedBinaryCaches = [
|
trustedBinaryCaches = [
|
||||||
"https://cache.nixos.org"
|
"https://cache.nixos.org"
|
||||||
"https://cache.ophanim.de"
|
"https://cache.ophanim.de"
|
||||||
|
|
|
@ -1,6 +1,8 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
{
|
with lib;
|
||||||
|
|
||||||
|
mkIf (elem "security" config.machine.conffiles) {
|
||||||
security = {
|
security = {
|
||||||
audit.enable = true;
|
audit.enable = true;
|
||||||
auditd.enable = true;
|
auditd.enable = true;
|
||||||
|
|
|
@ -1,6 +1,8 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
{
|
with lib;
|
||||||
|
|
||||||
|
mkIf (elem "zsh" config.machine.conffiles) {
|
||||||
programs.zsh = {
|
programs.zsh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
autosuggestions.enable = true;
|
autosuggestions.enable = true;
|
||||||
|
|
|
@ -8,17 +8,9 @@ let
|
||||||
in rec {
|
in rec {
|
||||||
imports = [
|
imports = [
|
||||||
cfgPath
|
cfgPath
|
||||||
|
./config/default.nix # same problem as above
|
||||||
|
|
||||||
# use
|
|
||||||
# config.machine.confPath
|
|
||||||
# instead of
|
|
||||||
./machines/Lilim/Lilim.nix
|
|
||||||
|
|
||||||
|
|
||||||
# ./config/default.nix # same problem as above
|
|
||||||
./pkgs/nixpkgs.nix
|
./pkgs/nixpkgs.nix
|
||||||
./pkgs/pkgsets.nix
|
./pkgs/pkgsets.nix
|
||||||
# ./services/default.nix # same problem as above
|
./services/default.nix # same problem as above
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
|
@ -3,10 +3,20 @@
|
||||||
with lib;
|
with lib;
|
||||||
|
|
||||||
{
|
{
|
||||||
imports = [ ../../options/machine.nix ];
|
imports = [
|
||||||
|
../../options/machine.nix
|
||||||
|
./Lilim.nix
|
||||||
|
];
|
||||||
|
|
||||||
config.machine = {
|
config.machine = {
|
||||||
confPath = ./Lilim.nix;
|
allowUnfree = true;
|
||||||
|
hostName = "Lilim";
|
||||||
|
conffiles = [
|
||||||
|
"etcfiles"
|
||||||
|
"etcvars"
|
||||||
|
"fonts"
|
||||||
|
"zsh"
|
||||||
|
];
|
||||||
pkgs = [
|
pkgs = [
|
||||||
"base"
|
"base"
|
||||||
"dict"
|
"dict"
|
||||||
|
@ -20,13 +30,11 @@ with lib;
|
||||||
"xpkgs"
|
"xpkgs"
|
||||||
];
|
];
|
||||||
services = [
|
services = [
|
||||||
../../services/xserver.nix
|
"xserver"
|
||||||
../../services/docker.nix
|
"docker"
|
||||||
../../services/udev.nix
|
"udev"
|
||||||
../../services/cups.nix
|
"cups"
|
||||||
];
|
];
|
||||||
allowUnfree = true;
|
|
||||||
hostName = "Lilim";
|
|
||||||
firewall = {
|
firewall = {
|
||||||
allowPing = true;
|
allowPing = true;
|
||||||
allowedUDPPorts = [];
|
allowedUDPPorts = [];
|
||||||
|
|
|
@ -1,30 +1,42 @@
|
||||||
|
{ config, lib }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
{
|
{
|
||||||
confPath = ./Ophanim.nix;
|
imports = [
|
||||||
pkgs = [
|
../../options/machine.nix
|
||||||
"base"
|
./Ophanim.nix
|
||||||
"emacs"
|
|
||||||
"server"
|
|
||||||
];
|
];
|
||||||
services = [
|
|
||||||
../../services/gitea.nix
|
config.machine = {
|
||||||
../../services/hydra.nix
|
hostName = "Ophanim";
|
||||||
../../services/mailserver.nix
|
|
||||||
../../services/mariaDB.nix
|
|
||||||
../../services/nextcloud.nix
|
|
||||||
../../services/nginx.nix
|
|
||||||
../../services/openssh.nix
|
|
||||||
];
|
|
||||||
conf = {
|
|
||||||
allowUnfree = true;
|
allowUnfree = true;
|
||||||
networking = {
|
conffiles = [
|
||||||
hostName = "Ophanim";
|
"etcfiles"
|
||||||
firewall = {
|
"etcvars"
|
||||||
allowPing = false;
|
"fonts"
|
||||||
allowedUDPPorts = [ 22 80 443 ];
|
"zsh"
|
||||||
allowedTCPPorts = [ 80 443 ]; # 5222 5269 ];
|
];
|
||||||
allowedUDPPortRanges = [];
|
pkgs = [
|
||||||
allowedTCPPortRanges = [];
|
"base"
|
||||||
};
|
"emacs"
|
||||||
|
"server"
|
||||||
|
];
|
||||||
|
services = [
|
||||||
|
"gitea"
|
||||||
|
"hydra"
|
||||||
|
"mailserver"
|
||||||
|
"mariaDB"
|
||||||
|
"nextcloud"
|
||||||
|
"nginx"
|
||||||
|
"openssh"
|
||||||
|
];
|
||||||
|
firewall = {
|
||||||
|
allowPing = false;
|
||||||
|
allowedUDPPorts = [ 22 80 443 ];
|
||||||
|
allowedTCPPorts = [ 80 443 ]; # 5222 5269 ];
|
||||||
|
allowedUDPPortRanges = [];
|
||||||
|
allowedTCPPortRanges = [];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
@ -23,11 +23,17 @@ with lib;
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
services = mkOption {
|
services = mkOption {
|
||||||
type = types.listOf types.path;
|
type = types.listOf types.string;
|
||||||
description = ''
|
description = ''
|
||||||
List of services to be enabled.
|
List of services to be enabled.
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
conffiles = mkOption {
|
||||||
|
type = types.listOf types.string;
|
||||||
|
description = ''
|
||||||
|
List of configuration files to be enabled.
|
||||||
|
'';
|
||||||
|
};
|
||||||
hostName = mkOption {
|
hostName = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
description = ''
|
description = ''
|
||||||
|
|
|
@ -43,6 +43,7 @@ let
|
||||||
ntfs3g
|
ntfs3g
|
||||||
oh-my-zsh
|
oh-my-zsh
|
||||||
openssl
|
openssl
|
||||||
|
parted
|
||||||
p7zip
|
p7zip
|
||||||
pciutils
|
pciutils
|
||||||
psmisc
|
psmisc
|
||||||
|
@ -104,7 +105,7 @@ let
|
||||||
pkgs.ledger
|
pkgs.ledger
|
||||||
yaml-mode
|
yaml-mode
|
||||||
company
|
company
|
||||||
/* C/C++ */ clang-format irony company-irony company-irony-c-headers flycheck-irony
|
/* C/C++ */ irony company-irony company-irony-c-headers flycheck-irony
|
||||||
/* Haskell */ haskell-mode flycheck-haskell
|
/* Haskell */ haskell-mode flycheck-haskell
|
||||||
/* Org */ org org-ref pdf-tools org-bullets org-caldav
|
/* Org */ org org-ref pdf-tools org-bullets org-caldav
|
||||||
/* Rust */ rust-mode flycheck-rust racer
|
/* Rust */ rust-mode flycheck-rust racer
|
||||||
|
|
|
@ -1,6 +1,8 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
{
|
with lib;
|
||||||
|
|
||||||
|
mkIf (elem "cups" config.machine.services) {
|
||||||
services.printing = {
|
services.printing = {
|
||||||
enable = true;
|
enable = true;
|
||||||
startWhenNeeded = true;
|
startWhenNeeded = true;
|
||||||
|
|
|
@ -1,7 +1,19 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
with lib;
|
|
||||||
|
|
||||||
{
|
{
|
||||||
imports = config.machine.services;
|
imports = [
|
||||||
|
./cups.nix
|
||||||
|
./docker.nix
|
||||||
|
./fail2ban.nix
|
||||||
|
./gitea.nix
|
||||||
|
./hydra.nix
|
||||||
|
./mailserver/default.nix
|
||||||
|
./mailserver.nix
|
||||||
|
./mariaDB.nix
|
||||||
|
./nextcloud.nix
|
||||||
|
./nginx.nix
|
||||||
|
./openssh.nix
|
||||||
|
./udev.nix
|
||||||
|
./xserver.nix
|
||||||
|
];
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,7 +1,9 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
# Note: add privileged users to docker group for access
|
# Note: add privileged users to docker group for access
|
||||||
{
|
with lib;
|
||||||
|
|
||||||
|
mkIf (elem "docker" config.machine.services) {
|
||||||
virtualisation.docker.enable = true;
|
virtualisation.docker.enable = true;
|
||||||
environment.systemPackages = with pkgs; [ docker-compose docker-machine ];
|
environment.systemPackages = with pkgs; [ docker-compose docker-machine ];
|
||||||
### Docker Image stuff will probably follow here
|
### Docker Image stuff will probably follow here
|
||||||
|
|
|
@ -1,7 +1,9 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
# mostly taken from https://github.com/davidak/nixos-config/blob/master/services/fail2ban.nix
|
# mostly taken from https://github.com/davidak/nixos-config/blob/master/services/fail2ban.nix
|
||||||
{
|
with lib;
|
||||||
|
|
||||||
|
mkIf (elem "fail2ban" config.machine.services) {
|
||||||
services.fail2ban = {
|
services.fail2ban = {
|
||||||
enable = true;
|
enable = true;
|
||||||
jails = {
|
jails = {
|
||||||
|
@ -50,7 +52,7 @@
|
||||||
action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp]
|
action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp]
|
||||||
findtime = 600
|
findtime = 600
|
||||||
bantime = 7200
|
bantime = 7200
|
||||||
''
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
@ -1,6 +1,8 @@
|
||||||
{ stdenv, conf, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
{
|
with lib;
|
||||||
|
|
||||||
|
mkIf (elem "gitea" config.machine.services) {
|
||||||
services.gitea = {
|
services.gitea = {
|
||||||
enable = true;
|
enable = true;
|
||||||
user = "git";
|
user = "git";
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
# hydra user needs to be manually crated
|
# hydra user needs to be manually crated
|
||||||
# sudo -u hydra -s
|
# sudo -u hydra -s
|
||||||
|
@ -8,7 +8,9 @@
|
||||||
# https://github.com/NixOS/nixos-org-configurations/blob/master/delft/hydra.nix
|
# https://github.com/NixOS/nixos-org-configurations/blob/master/delft/hydra.nix
|
||||||
# https://gist.github.com/LnL7/fcd5c0bf772f2165a1ac40be6617d2f4
|
# https://gist.github.com/LnL7/fcd5c0bf772f2165a1ac40be6617d2f4
|
||||||
|
|
||||||
{
|
with lib;
|
||||||
|
|
||||||
|
mkIf (elem "hydra" config.machine.services) {
|
||||||
# also take a look at ../conf/nix.nix
|
# also take a look at ../conf/nix.nix
|
||||||
nix.buildMachines = [
|
nix.buildMachines = [
|
||||||
{
|
{
|
||||||
|
|
|
@ -1,17 +1,15 @@
|
||||||
{ lib, config, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
{
|
with lib;
|
||||||
imports = [
|
|
||||||
./mailserver/default.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
|
mkIf (elem "mailserver" config.machine.services) {
|
||||||
mailserver = rec {
|
mailserver = rec {
|
||||||
enable = true;
|
enable = true;
|
||||||
fqdn = "mail.ophanim.de";
|
fqdn = "mail.ophanim.de";
|
||||||
domains = [ "ophanim.de" ];
|
domains = [ "ophanim.de" ];
|
||||||
loginAccounts = {
|
loginAccounts = {
|
||||||
"derped@ophanim.de" = {
|
"derped@ophanim.de" = {
|
||||||
hashedPassword = (builtins.replaceStrings ["\n"] [""] (builtins.readFile /secret/derped.mail));
|
hashedPassword = (builtins.readFile /secret/derped.mail);
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
# Use Let's Encrypt certificates. Note that this needs to set up a stripped
|
# Use Let's Encrypt certificates. Note that this needs to set up a stripped
|
||||||
|
@ -24,9 +22,9 @@
|
||||||
|
|
||||||
# Enable IMAP and POP3
|
# Enable IMAP and POP3
|
||||||
enableImap = true;
|
enableImap = true;
|
||||||
enablePop3 = true;
|
enablePop3 = false;
|
||||||
enableImapSsl = true;
|
enableImapSsl = true;
|
||||||
enablePop3Ssl = true;
|
enablePop3Ssl = false;
|
||||||
|
|
||||||
# Enable the ManageSieve protocol
|
# Enable the ManageSieve protocol
|
||||||
enableManageSieve = true;
|
enableManageSieve = true;
|
||||||
|
|
|
@ -1,12 +1,14 @@
|
||||||
{ config, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
let
|
let
|
||||||
giteapwd = (builtins.replaceStrings ["\n"] [""] (builtins.readFile /secret/gitea));
|
giteapwd = if config.services.gitea.enable then (builtins.readFile /secret/gitea) else "";
|
||||||
in {
|
in mkIf (elem "mariaDB" config.machine.services) {
|
||||||
services.mysql = {
|
services.mysql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = pkgs.mariadb;
|
package = pkgs.mariadb;
|
||||||
initialDatabases = [ {
|
initialDatabases = [ mkIf config.services.gitea.enable {
|
||||||
name = "gitea";
|
name = "gitea";
|
||||||
schema = pkgs.writeText "gitea.sql"
|
schema = pkgs.writeText "gitea.sql"
|
||||||
''
|
''
|
||||||
|
@ -16,3 +18,4 @@ in {
|
||||||
} ];
|
} ];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -1,6 +1,8 @@
|
||||||
{ conf, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
{
|
with lib;
|
||||||
|
|
||||||
|
mkIf (elem "nextcloud" config.machine.services) {
|
||||||
services.nextcloud = {
|
services.nextcloud = {
|
||||||
enable = true;
|
enable = true;
|
||||||
home = "/var/lib/nextcloud";
|
home = "/var/lib/nextcloud";
|
||||||
|
|
|
@ -8,9 +8,9 @@
|
||||||
|
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
let
|
with lib;
|
||||||
gitpkgs = import /nixpkgs/default.nix {};
|
|
||||||
in {
|
mkIf (elem "nginx" config.machine.services) {
|
||||||
services.nginx = {
|
services.nginx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
recommendedGzipSettings = true;
|
recommendedGzipSettings = true;
|
||||||
|
|
|
@ -3,7 +3,10 @@
|
||||||
# For reference:
|
# For reference:
|
||||||
# https://infosec.mozilla.org/guidelines/openssh.html
|
# https://infosec.mozilla.org/guidelines/openssh.html
|
||||||
# https://stribika.github.io/2015/01/04/secure-secure-shell.html
|
# https://stribika.github.io/2015/01/04/secure-secure-shell.html
|
||||||
{
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
mkIf (elem "openssh" config.machine.services) {
|
||||||
services.openssh = {
|
services.openssh = {
|
||||||
enable = true;
|
enable = true;
|
||||||
sftpFlags = [ "-f AUTHPRIV" "-l INFO" ];
|
sftpFlags = [ "-f AUTHPRIV" "-l INFO" ];
|
||||||
|
|
|
@ -1,6 +1,8 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
{
|
with lib;
|
||||||
|
|
||||||
|
mkIf (elem "udev" config.machine.services) {
|
||||||
services.udev.extraRules = ''
|
services.udev.extraRules = ''
|
||||||
Valve USB devices
|
Valve USB devices
|
||||||
SUBSYSTEM=="usb", ATTRS{idVendor}=="28de", TAG+="uaccess", TAG+="udev-acl"
|
SUBSYSTEM=="usb", ATTRS{idVendor}=="28de", TAG+="uaccess", TAG+="udev-acl"
|
||||||
|
|
Loading…
Reference in a new issue