summaryrefslogtreecommitdiffstats
path: root/system/services
diff options
context:
space:
mode:
Diffstat (limited to 'system/services')
-rw-r--r--system/services/default.nix7
-rw-r--r--system/services/fail2ban/default.nix4
-rw-r--r--system/services/keycloak/default.nix2
-rw-r--r--system/services/mail/default.nix43
-rw-r--r--system/services/mail/users.nixbin0 -> 486 bytes
-rw-r--r--system/services/minecraft/default.nix2
-rw-r--r--system/services/nginx/default.nix10
-rw-r--r--system/services/nginx/hosts.nixbin1027 -> 989 bytes
-rw-r--r--system/services/nix-sync/default.nix159
-rw-r--r--system/services/openssh/default.nix17
-rw-r--r--system/services/opensshd/default.nix13
11 files changed, 190 insertions, 67 deletions
diff --git a/system/services/default.nix b/system/services/default.nix
index 2e2b751..13e1c0a 100644
--- a/system/services/default.nix
+++ b/system/services/default.nix
@@ -1,12 +1,13 @@
{...}: {
imports = [
+ ./fail2ban
./keycloak
+ ./mail
./minecraft
./nginx
./nix
- ./opensshd
+ ./nix-sync
+ ./openssh
./rust-motd
- ./fail2ban
- ./git-sync
];
}
diff --git a/system/services/fail2ban/default.nix b/system/services/fail2ban/default.nix
index 5aee097..3e6244b 100644
--- a/system/services/fail2ban/default.nix
+++ b/system/services/fail2ban/default.nix
@@ -1,4 +1,3 @@
-# vim: ts=2
{...}: {
services.fail2ban = {
enable = true;
@@ -8,7 +7,7 @@
logtarget = SYSLOG
socket = /run/fail2ban/fail2ban.sock
pidfile = /run/fail2ban/fail2ban.pid
- dbfile = /srv/fail2ban/fail2ban.sqlite3
+ dbfile = /var/lib/fail2ban/db.sqlite3
'';
bantime-increment = {
enable = true;
@@ -28,3 +27,4 @@
};
};
}
+
diff --git a/system/services/keycloak/default.nix b/system/services/keycloak/default.nix
index dfeabc3..5f21b90 100644
--- a/system/services/keycloak/default.nix
+++ b/system/services/keycloak/default.nix
@@ -31,7 +31,7 @@
createLocally = true;
username = "keycloak";
- passwordFile = "/srv/keycloak/password";
+ passwordFile = "${config.age.secrets.keycloak.path}";
};
settings = {
diff --git a/system/services/mail/default.nix b/system/services/mail/default.nix
new file mode 100644
index 0000000..0640fc7
--- /dev/null
+++ b/system/services/mail/default.nix
@@ -0,0 +1,43 @@
+{lib, ...}: let
+ all_admins = [
+ "sils@vhack.eu"
+ "soispha@vhack.eu"
+ "nightingale@vhack.eu"
+ ];
+ users = import ./users.nix {};
+in {
+ mailserver =
+ lib.recursiveUpdate {
+ enable = true;
+ fqdn = "server1.vhack.eu";
+
+ useFsLayout = true;
+
+ extraVirtualAliases = {
+ "abuse@vhack.eu" = all_admins;
+ "postmaster@vhack.eu" = all_admins;
+ "admin@vhack.eu" = all_admins;
+ };
+
+ mailDirectory = "/var/lib/mail/vmail";
+ dkimKeyDirectory = "/var/lib/mail/dkim";
+ sieveDirectory = "/var/lib/mail/sieve";
+ backup.snapshotRoot = "/var/lib/mail/backup";
+
+ enableImap = false;
+ enableImapSsl = true;
+ enablePop3 = false;
+ enablePop3Ssl = true;
+ # SMTP
+ enableSubmission = false;
+ enableSubmissionSsl = true;
+ openFirewall = true;
+
+ keyFile = "/var/lib/acme/server1.vhack.eu/key.pem";
+ certificateScheme = "acme";
+ certificateFile = "/var/lib/acme/server1.vhack.eu/fullchain.pem";
+ }
+ users;
+}
+# vim: ts=2
+
diff --git a/system/services/mail/users.nix b/system/services/mail/users.nix
new file mode 100644
index 0000000..f3264a1
--- /dev/null
+++ b/system/services/mail/users.nix
Binary files differ
diff --git a/system/services/minecraft/default.nix b/system/services/minecraft/default.nix
index e69ffb1..e659af0 100644
--- a/system/services/minecraft/default.nix
+++ b/system/services/minecraft/default.nix
@@ -7,7 +7,7 @@
enable = true;
declarative = true;
eula = true;
- dataDir = "/srv/minecraft";
+ dataDir = "/var/lib/minecraft";
openFirewall = true;
jvmOpts = "-Xmx8192M -Xms8192M";
whitelist = {
diff --git a/system/services/nginx/default.nix b/system/services/nginx/default.nix
index 3eb98d3..b9a0754 100644
--- a/system/services/nginx/default.nix
+++ b/system/services/nginx/default.nix
@@ -2,9 +2,13 @@
imports = [
./hosts.nix
];
- security.acme.acceptTerms = true;
- security.acme.defaults.email = "admin@vhack.eu";
- security.acme.defaults.webroot = "/srv/acme/";
+ security.acme = {
+ acceptTerms = true;
+ defaults = {
+ email = "admin@vhack.eu";
+ webroot = "/var/lib/acme/acme-challenge";
+ };
+ };
networking.firewall = {
allowedTCPPorts = [80 443];
diff --git a/system/services/nginx/hosts.nix b/system/services/nginx/hosts.nix
index 94fae9f..03806c0 100644
--- a/system/services/nginx/hosts.nix
+++ b/system/services/nginx/hosts.nix
Binary files differ
diff --git a/system/services/nix-sync/default.nix b/system/services/nix-sync/default.nix
index 18511b3..5c2ed80 100644
--- a/system/services/nix-sync/default.nix
+++ b/system/services/nix-sync/default.nix
@@ -6,47 +6,85 @@
}: let
cfg = config.services.nix-sync;
+ mkTimer = name: repo: {
+ description = "Nix sync ${name} timer";
+ wantedBy = ["timers.target"];
+ timerConfig = {
+ OnActiveSec = repo.interval;
+ };
+ after = ["network-online.target"];
+ };
+
+ parents = path: let
+ split_path = builtins.split "/" path;
+ filename = builtins.elemAt split_path (builtins.length split_path - 1);
+ in
+ lib.strings.removeSuffix "/" (builtins.replaceStrings [filename] [""] path);
+ esa = lib.strings.escapeShellArg;
mkUnit = name: repo: let
- esa = lib.strings.escapeShellArg;
- execStartScript = lib.writeShellScript "git-sync-exec" ''
- cd ${esa cfg.cachePath}/${esa repo.path};
+ optionalPathSeparator =
+ if lib.strings.hasPrefix "/" repo.path
+ then ""
+ else "/";
+ repoCachePath = cfg.cachePath + optionalPathSeparator + repo.path;
+ execStartScript = pkgs.writeScript "nix-sync-exec" ''
+ #! /usr/bin/env dash
+ export XDG_CACHE_HOME="$CACHE_DIRECTORY";
+ cd ${esa repoCachePath};
- while true; do
- origin="$(git rev-parse @{u})";
- branch="$(git rev-parse @)";
+ git fetch
+ origin="$(git rev-parse @{u})";
+ branch="$(git rev-parse @)";
- if ! [ "$origin" = "$branch" ]; then
- git pull;
+ if ! [ "$origin" = "$branch" ]; then
+ git pull;
- out_paths=$(mktemp);
- nix build . --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
- [ "$(wc -l < "$out_paths")" -gt 1 ] && (echo "To many out-paths"; exit 1)
- out_path="$(cat "$out_paths")";
- rm -r ${esa repo.path};
- ln -s "$out_path" ${esa repo.path};
- rm "$out-paths";
- fi
- sleep ${esa repo.interval};
- done
+ out_paths=$(mktemp);
+ nix build . --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
+ [ "$(wc -l < "$out_paths")" -gt 1 ] && (echo "To many out-paths"; exit 1)
+ out_path="$(cat "$out_paths")";
+ rm ${esa repo.path};
+ ln -s "$out_path" ${esa repo.path};
+ rm "$out_paths";
+ fi
'';
execStartPreScript = ''
- if ! stat ${esa cfg.cachePath}/${esa repo.path}/.git; then
- mkdir --parents ${esa cfg.cachePath}/${esa repo.path};
- git clone ${esa repo.uri} ${esa cfg.cachePath}/${esa repo.path};
+ export XDG_CACHE_HOME="$CACHE_DIRECTORY";
+
+ if ! [ -d ${esa repoCachePath}/.git ]; then
+ mkdir --parents ${esa repoCachePath};
+ git clone ${esa repo.uri} ${esa repoCachePath};
out_paths=$(mktemp);
- nix build ${esa cfg.cachePath}/${esa repo.path} --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
+ nix build ${esa repoCachePath} --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
[ "$(wc -l < "$out_paths")" -gt 1 ] && (echo "To many out-paths"; exit 1)
out_path="$(cat "$out_paths")";
ln -s "$out_path" ${esa repo.path};
- rm "$out-paths";
+ rm "$out_paths";
+ fi
+
+ if ! [ -L ${esa repo.path} ]; then
+ cd ${esa repoCachePath};
+
+ git pull;
+
+ out_paths=$(mktemp);
+ nix build . --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
+ [ "$(wc -l < "$out_paths")" -gt 1 ] && (echo "To many out-paths"; exit 1)
+ out_path="$(cat "$out_paths")";
+
+ [ -d ${esa repo.path} ] && rm -d ${esa repo.path};
+ [ -e ${esa repo.path} ] && rm ${esa repo.path};
+
+ ln -s "$out_path" ${esa repo.path};
+ rm "$out_paths";
fi
'';
in {
description = "Nix Sync ${name}";
wantedBy = ["default.target"];
after = ["network.target"];
- path = with pkgs; [openssh git nix mktemp coreutils];
+ path = with pkgs; [openssh git nix mktemp coreutils dash];
preStart = execStartPreScript;
serviceConfig = {
@@ -56,16 +94,16 @@
User = cfg.user;
Group = cfg.group;
# Runtime directory and mode
- RuntimeDirectory = "nginx";
+ RuntimeDirectory = "nix-sync";
RuntimeDirectoryMode = "0750";
# Cache directory and mode
- CacheDirectory = "nginx";
+ CacheDirectory = "nix-sync";
CacheDirectoryMode = "0750";
# Logs directory and mode
- LogsDirectory = "nginx";
+ LogsDirectory = "nix-sync";
LogsDirectoryMode = "0750";
# Proc filesystem
- ProcSubset = "pid";
+ ProcSubset = "all";
ProtectProc = "invisible";
# New file permissions
UMask = "0027"; # 0640 / 0750
@@ -75,7 +113,8 @@
# Security
NoNewPrivileges = true;
# Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
- ReadWritePaths = ["${repo.path}" "${cfg.cachePath}/${repo.path}"];
+ ReadWritePaths = ["${esa (parents repo.path)}" "-${esa repoCachePath}" "-${esa cfg.cachePath}"];
+ ReadOnlyPaths = ["/nix"];
ProtectSystem = "strict";
ProtectHome = true;
PrivateTmp = true;
@@ -102,10 +141,23 @@
services =
lib.mapAttrs' (name: repo: {
- name = "git-sync-${name}";
+ name = "nix-sync-${name}";
value = mkUnit name repo;
})
cfg.repositories;
+ timers =
+ lib.mapAttrs' (name: repo: {
+ name = "nix-sync-${name}";
+ value = mkTimer name repo;
+ })
+ cfg.repositories;
+
+ # generate the websites directory, so systemd can mount it read write
+ generatedDirectories =
+ lib.mapAttrsToList (
+ _: repo: "d ${esa (parents repo.path)} 0755 ${cfg.user} ${cfg.group}"
+ )
+ cfg.repositories;
repositoryType = lib.types.submodule ({name, ...}: {
options = {
@@ -123,7 +175,7 @@
uri = lib.mkOption {
type = lib.types.str;
- example = "git+ssh://user@example.com:/~[user]/path/to/repo.git";
+ example = "ssh://user@example.com:/~[user]/path/to/repo.git";
description = ''
The URI of the remote to be synchronized. This is only used in the
event that the directory does not already exist. See
@@ -137,24 +189,15 @@
default = 500;
description = ''
The interval, specified in seconds, at which the synchronization will
- be triggered even without filesystem changes.
+ be triggered.
'';
};
};
});
in {
options = {
- services.git-sync = {
- enable = lib.mkEnableOption "git-sync services";
-
- package = lib.mkOption {
- type = lib.types.package;
- default = pkgs.git-sync;
- defaultText = lib.literalExpression "pkgs.git-sync";
- description = ''
- Package containing the <command>git-sync</command> program.
- '';
- };
+ services.nix-sync = {
+ enable = lib.mkEnableOption "nix-sync services";
user = lib.mkOption {
type = lib.types.str;
@@ -172,7 +215,7 @@ in {
type = lib.types.str;
default = "/var/lib/nix-sync";
description = lib.mdDoc ''
- Where to cache git directories.
+ Where to cache git directories. Should not end with a slash ("/")
'';
};
@@ -186,7 +229,35 @@ in {
};
config = lib.mkIf cfg.enable {
+ assertions = [
+ {
+ assertion = !lib.strings.hasSuffix "/" cfg.cachePath;
+ message = "Your cachePath ('${cfg.cachePath}') ends with a slash ('/'), please use: '${lib.strings.removeSuffix "/" cfg.cachePath}'.";
+ }
+ ];
+
+ systemd.tmpfiles.rules =
+ generatedDirectories;
+
systemd.services = services;
+ systemd.timers = timers;
+ users.users =
+ if cfg.user == "nix-sync"
+ then {
+ nix-sync = {
+ group = "${cfg.group}";
+ isSystemUser = true;
+ };
+ }
+ else lib.warnIf (cfg.user != "nix-sync") "The user (${cfg.user}) is not \"nix-sync\", thus you are responible for generating it.";
+ users.groups =
+ if cfg.group == "nix-sync"
+ then {
+ nix-sync = {
+ members = ["${cfg.user}"];
+ };
+ }
+ else lib.warnIf (cfg.group != "nix-sync") "The group (${cfg.group}) is not \"nix-sync\", thus you are responible for generating it.";
};
}
# vim: ts=2
diff --git a/system/services/openssh/default.nix b/system/services/openssh/default.nix
new file mode 100644
index 0000000..46b7ffd
--- /dev/null
+++ b/system/services/openssh/default.nix
@@ -0,0 +1,17 @@
+{...}: {
+ services.openssh = {
+ enable = true;
+ settings.PasswordAuthentication = false;
+ hostKeys = [
+ {
+ # See the explanation for this in /system/impermanence/mods/openssh.nix
+ # path = "/var/lib/sshd/ssh_host_ed25519_key";
+
+ # FIXME: Remove this workaround
+ path = "/srv/var/lib/sshd/ssh_host_ed25519_key";
+ rounds = 1000;
+ type = "ed25519";
+ }
+ ];
+ };
+}
diff --git a/system/services/opensshd/default.nix b/system/services/opensshd/default.nix
deleted file mode 100644
index 1bb37ee..0000000
--- a/system/services/opensshd/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{...}: {
- services.openssh = {
- enable = true;
- settings.PasswordAuthentication = false;
- hostKeys = [
- {
- path = "/srv/sshd/ssh_host_ed25519_key";
- rounds = 1000;
- type = "ed25519";
- }
- ];
- };
-}
generated by cgit v1.3.1 (git 2.54.0) at 2026-06-09 08:59:32 +0000