summary refs log tree commit diff stats
path: root/system/services
diff options
context:
space:
mode:
Diffstat (limited to 'system/services')
-rw-r--r--system/services/acme/default.nix38
-rw-r--r--system/services/acme/domains.nixbin130 -> 0 bytes
-rw-r--r--system/services/default.nix8
-rw-r--r--system/services/fail2ban/default.nix3
-rw-r--r--system/services/git-sync/default.nix104
-rw-r--r--system/services/keycloak/default.nix2
-rw-r--r--system/services/mail/default.nix41
-rw-r--r--system/services/mail/users.nixbin0 -> 486 bytes
-rw-r--r--system/services/matrix/default.nix1
-rw-r--r--system/services/minecraft/default.nix2
-rw-r--r--system/services/nginx/default.nix8
-rw-r--r--system/services/nginx/hosts.nixbin630 -> 976 bytes
-rw-r--r--system/services/nix-sync/default.nix262
-rw-r--r--system/services/openssh/default.nix17
-rw-r--r--system/services/opensshd/default.nix13
15 files changed, 335 insertions, 164 deletions
diff --git a/system/services/acme/default.nix b/system/services/acme/default.nix
deleted file mode 100644
index 0a0c4ce..0000000
--- a/system/services/acme/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{lib, ...}: let
-  domains = import ./domains.nix {};
-
-  virtualHosts = builtins.listToAttrs (
-    builtins.map (domain_name: {
-      name = "acmechallenge.${domain_name}";
-      value = {
-        serverAliases = ["*.${domain_name}"];
-        locations."/.well-known/acme-challenge" = {
-          root = "/var/lib/acme/.challenges";
-        };
-        locations."/" = {
-          return = "301 https://$host$request_uri";
-        };
-      };
-    })
-    domains
-  );
-  certs = lib.attrsets.genAttrs domains (
-    domain_name: {
-      webroot = "/var/lib/acme/.challenges";
-      group = "nginx";
-    }
-  );
-in {
-  users.users.nginx.extraGroups = ["acme"];
-
-  services.nginx = {
-    enable = true;
-    inherit virtualHosts;
-  };
-
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "admin@vhack.eu";
-    inherit certs;
-  };
-}
diff --git a/system/services/acme/domains.nix b/system/services/acme/domains.nix
deleted file mode 100644
index 8f0930d..0000000
--- a/system/services/acme/domains.nix
+++ /dev/null
Binary files differdiff --git a/system/services/default.nix b/system/services/default.nix
index 19a531f..7bf26c3 100644
--- a/system/services/default.nix
+++ b/system/services/default.nix
@@ -1,14 +1,14 @@
 {...}: {
   imports = [
-    ./acme
+    ./fail2ban
     ./keycloak
+    ./mail
     ./matrix
     ./minecraft
     ./nginx
     ./nix
-    ./opensshd
+    ./nix-sync
+    ./openssh
     ./rust-motd
-    ./fail2ban
-    ./git-sync
   ];
 }
diff --git a/system/services/fail2ban/default.nix b/system/services/fail2ban/default.nix
index 5aee097..43fd674 100644
--- a/system/services/fail2ban/default.nix
+++ b/system/services/fail2ban/default.nix
@@ -1,4 +1,3 @@
-# vim: ts=2
 {...}: {
   services.fail2ban = {
     enable = true;
@@ -8,7 +7,7 @@
       logtarget = SYSLOG
       socket    = /run/fail2ban/fail2ban.sock
       pidfile   = /run/fail2ban/fail2ban.pid
-      dbfile    = /srv/fail2ban/fail2ban.sqlite3
+      dbfile    = /var/lib/fail2ban/db.sqlite3
     '';
     bantime-increment = {
       enable = true;
diff --git a/system/services/git-sync/default.nix b/system/services/git-sync/default.nix
deleted file mode 100644
index 776ca60..0000000
--- a/system/services/git-sync/default.nix
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
-Taken from:
-https://github.com/nix-community/home-manager/blob/9ba7b3990eb1f4782ea3f5fe7ac4f3c88dd7a32c/modules/services/git-sync.nix
-*/
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: let
-  cfg = config.services.git-sync;
-
-  mkUnit = name: repo: {
-    Unit.Description = "Git Sync ${name}";
-
-    Install.WantedBy = ["default.target"];
-
-    Service = {
-      Environment = [
-        "PATH=${lib.makeBinPath (with pkgs; [openssh git])}"
-        "GIT_SYNC_DIRECTORY=${repo.path}"
-        "GIT_SYNC_COMMAND=${cfg.package}/bin/git-sync"
-        "GIT_SYNC_REPOSITORY=${repo.uri}"
-        "GIT_SYNC_INTERVAL=${toString repo.interval}"
-      ];
-      ExecStart = "${cfg.package}/bin/git-sync-on-inotify";
-      Restart = "on-abort";
-    };
-  };
-
-  services =
-    lib.mapAttrs' (name: repo: {
-      name = "git-sync-${name}";
-      value = mkUnit name repo;
-    })
-    cfg.repositories;
-
-  repositoryType = lib.types.submodule ({name, ...}: {
-    options = {
-      name = lib.mkOption {
-        internal = true;
-        default = name;
-        type = lib.types.str;
-        description = "The name that should be given to this unit.";
-      };
-
-      path = lib.mkOption {
-        type = lib.types.path;
-        description = "The path at which to sync the repository";
-      };
-
-      uri = lib.mkOption {
-        type = lib.types.str;
-        example = "git+ssh://user@example.com:/~[user]/path/to/repo.git";
-        description = ''
-          The URI of the remote to be synchronized. This is only used in the
-          event that the directory does not already exist. See
-          <link xlink:href="https://git-scm.com/docs/git-clone#_git_urls"/>
-          for the supported URIs.
-        '';
-      };
-
-      interval = lib.mkOption {
-        type = lib.types.int;
-        default = 500;
-        description = ''
-          The interval, specified in seconds, at which the synchronization will
-          be triggered even without filesystem changes.
-        '';
-      };
-    };
-  });
-in {
-  options = {
-    services.git-sync = {
-      enable = lib.mkEnableOption "git-sync services";
-
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.git-sync;
-        defaultText = lib.literalExpression "pkgs.git-sync";
-        description = ''
-          Package containing the <command>git-sync</command> program.
-        '';
-      };
-
-      repositories = lib.mkOption {
-        type = with lib.types; attrsOf repositoryType;
-        description = ''
-          The repositories that should be synchronized.
-        '';
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      (lib.hm.assertions.assertPlatform "services.git-sync" pkgs
-        lib.platforms.linux)
-    ];
-
-    systemd.user.services = services;
-  };
-}
diff --git a/system/services/keycloak/default.nix b/system/services/keycloak/default.nix
index dfeabc3..5f21b90 100644
--- a/system/services/keycloak/default.nix
+++ b/system/services/keycloak/default.nix
@@ -31,7 +31,7 @@
       createLocally = true;
 
       username = "keycloak";
-      passwordFile = "/srv/keycloak/password";
+      passwordFile = "${config.age.secrets.keycloak.path}";
     };
 
     settings = {
diff --git a/system/services/mail/default.nix b/system/services/mail/default.nix
new file mode 100644
index 0000000..382a87f
--- /dev/null
+++ b/system/services/mail/default.nix
@@ -0,0 +1,41 @@
+{lib, ...}: let
+  all_admins = [
+    "sils@vhack.eu"
+    "soispha@vhack.eu"
+    "nightingale@vhack.eu"
+  ];
+  users = import ./users.nix {};
+in {
+  mailserver =
+    lib.recursiveUpdate {
+      enable = true;
+      fqdn = "server1.vhack.eu";
+
+      useFsLayout = true;
+
+      extraVirtualAliases = {
+        "abuse@vhack.eu" = all_admins;
+        "postmaster@vhack.eu" = all_admins;
+        "admin@vhack.eu" = all_admins;
+      };
+
+      mailDirectory = "/var/lib/mail/vmail";
+      dkimKeyDirectory = "/var/lib/mail/dkim";
+      sieveDirectory = "/var/lib/mail/sieve";
+      backup.snapshotRoot = "/var/lib/mail/backup";
+
+      enableImap = false;
+      enableImapSsl = true;
+      enablePop3 = false;
+      enablePop3Ssl = true;
+      # SMTP
+      enableSubmission = false;
+      enableSubmissionSsl = true;
+      openFirewall = true;
+
+      keyFile = "/var/lib/acme/server1.vhack.eu/key.pem";
+      certificateScheme = "acme";
+      certificateFile = "/var/lib/acme/server1.vhack.eu/fullchain.pem";
+    }
+    users;
+}
diff --git a/system/services/mail/users.nix b/system/services/mail/users.nix
new file mode 100644
index 0000000..f3264a1
--- /dev/null
+++ b/system/services/mail/users.nix
Binary files differdiff --git a/system/services/matrix/default.nix b/system/services/matrix/default.nix
index d49fda2..e35c129 100644
--- a/system/services/matrix/default.nix
+++ b/system/services/matrix/default.nix
@@ -55,7 +55,6 @@ in {
     enable = true;
     dataDir = "/srv/matrix/data";
     configFile = "/srv/matrix";
-    extraConfigFiles = ["/srv/matrix/oid/config.yaml"];
     settings = {
       media_store_path = "/srv/matrix/media_store";
       server_name = "vhack.eu";
diff --git a/system/services/minecraft/default.nix b/system/services/minecraft/default.nix
index e69ffb1..e659af0 100644
--- a/system/services/minecraft/default.nix
+++ b/system/services/minecraft/default.nix
@@ -7,7 +7,7 @@
     enable = true;
     declarative = true;
     eula = true;
-    dataDir = "/srv/minecraft";
+    dataDir = "/var/lib/minecraft";
     openFirewall = true;
     jvmOpts = "-Xmx8192M -Xms8192M";
     whitelist = {
diff --git a/system/services/nginx/default.nix b/system/services/nginx/default.nix
index 6753fb0..404c167 100644
--- a/system/services/nginx/default.nix
+++ b/system/services/nginx/default.nix
@@ -2,6 +2,14 @@
   imports = [
     ./hosts.nix
   ];
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "admin@vhack.eu";
+      webroot = "/var/lib/acme/acme-challenge";
+    };
+  };
+
   networking.firewall = {
     allowedTCPPorts = [80 443];
   };
diff --git a/system/services/nginx/hosts.nix b/system/services/nginx/hosts.nix
index 684bb68..1590756 100644
--- a/system/services/nginx/hosts.nix
+++ b/system/services/nginx/hosts.nix
Binary files differdiff --git a/system/services/nix-sync/default.nix b/system/services/nix-sync/default.nix
new file mode 100644
index 0000000..44348c0
--- /dev/null
+++ b/system/services/nix-sync/default.nix
@@ -0,0 +1,262 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.services.nix-sync;
+
+  mkTimer = name: repo: {
+    description = "Nix sync ${name} timer";
+    wantedBy = ["timers.target"];
+    timerConfig = {
+      OnActiveSec = repo.interval;
+    };
+    after = ["network-online.target"];
+  };
+
+  parents = path: let
+    split_path = builtins.split "/" path;
+    filename = builtins.elemAt split_path (builtins.length split_path - 1);
+  in
+    lib.strings.removeSuffix "/" (builtins.replaceStrings [filename] [""] path);
+  esa = lib.strings.escapeShellArg;
+  mkUnit = name: repo: let
+    optionalPathSeparator =
+      if lib.strings.hasPrefix "/" repo.path
+      then ""
+      else "/";
+    repoCachePath = cfg.cachePath + optionalPathSeparator + repo.path;
+    execStartScript = pkgs.writeScript "nix-sync-exec" ''
+      #! /usr/bin/env dash
+      export XDG_CACHE_HOME="$CACHE_DIRECTORY";
+      cd ${esa repoCachePath};
+
+      git fetch
+      origin="$(git rev-parse @{u})";
+      branch="$(git rev-parse @)";
+
+      if ! [ "$origin" = "$branch" ]; then
+        git pull;
+
+        out_paths=$(mktemp);
+        nix build . --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
+        [ "$(wc -l < "$out_paths")" -gt 1 ] && (echo "To many out-paths"; exit 1)
+        out_path="$(cat "$out_paths")";
+        rm ${esa repo.path};
+        ln -s "$out_path" ${esa repo.path};
+        rm "$out_paths";
+      fi
+    '';
+    execStartPreScript = ''
+      export XDG_CACHE_HOME="$CACHE_DIRECTORY";
+
+      if ! [ -d ${esa repoCachePath}/.git ]; then
+          mkdir --parents ${esa repoCachePath};
+          git clone ${esa repo.uri} ${esa repoCachePath};
+
+          out_paths=$(mktemp);
+          nix build ${esa repoCachePath} --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
+          [ "$(wc -l < "$out_paths")" -gt 1 ] && (echo "To many out-paths"; exit 1)
+          out_path="$(cat "$out_paths")";
+          ln -s "$out_path" ${esa repo.path};
+          rm "$out_paths";
+      fi
+
+      if ! [ -L ${esa repo.path} ]; then
+        cd ${esa repoCachePath};
+
+        git pull;
+
+        out_paths=$(mktemp);
+        nix build . --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
+        [ "$(wc -l < "$out_paths")" -gt 1 ] && (echo "To many out-paths"; exit 1)
+        out_path="$(cat "$out_paths")";
+
+        [ -d ${esa repo.path} ] && rm -d ${esa repo.path};
+        [ -e ${esa repo.path} ] && rm ${esa repo.path};
+
+        ln -s "$out_path" ${esa repo.path};
+        rm "$out_paths";
+      fi
+    '';
+  in {
+    description = "Nix Sync ${name}";
+    wantedBy = ["default.target"];
+    after = ["network.target"];
+    path = with pkgs; [openssh git nix mktemp coreutils dash];
+    preStart = execStartPreScript;
+
+    serviceConfig = {
+      ExecStart = execStartScript;
+      Restart = "on-abort";
+      # User and group
+      User = cfg.user;
+      Group = cfg.group;
+      # Runtime directory and mode
+      RuntimeDirectory = "nix-sync";
+      RuntimeDirectoryMode = "0750";
+      # Cache directory and mode
+      CacheDirectory = "nix-sync";
+      CacheDirectoryMode = "0750";
+      # Logs directory and mode
+      LogsDirectory = "nix-sync";
+      LogsDirectoryMode = "0750";
+      # Proc filesystem
+      ProcSubset = "all";
+      ProtectProc = "invisible";
+      # New file permissions
+      UMask = "0027"; # 0640 / 0750
+      # Capabilities
+      AmbientCapabilities = ["CAP_CHOWN"];
+      CapabilityBoundingSet = ["CAP_CHOWN"];
+      # Security
+      NoNewPrivileges = true;
+      # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
+      ReadWritePaths = ["${esa (parents repo.path)}" "-${esa repoCachePath}" "-${esa cfg.cachePath}"];
+      ReadOnlyPaths = ["/nix"];
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      PrivateDevices = true;
+      ProtectHostname = true;
+      ProtectClock = true;
+      ProtectKernelTunables = true;
+      ProtectKernelModules = true;
+      ProtectKernelLogs = true;
+      ProtectControlGroups = true;
+      RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
+      RestrictNamespaces = true;
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      RemoveIPC = true;
+      PrivateMounts = true;
+      # System Call Filtering
+      SystemCallArchitectures = "native";
+      SystemCallFilter = ["~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid"];
+    };
+  };
+
+  services =
+    lib.mapAttrs' (name: repo: {
+      name = "nix-sync-${name}";
+      value = mkUnit name repo;
+    })
+    cfg.repositories;
+  timers =
+    lib.mapAttrs' (name: repo: {
+      name = "nix-sync-${name}";
+      value = mkTimer name repo;
+    })
+    cfg.repositories;
+
+  # generate the websites directory, so systemd can mount it read write
+  generatedDirectories =
+    lib.mapAttrsToList (
+      _: repo: "d ${esa (parents repo.path)} 0755 ${cfg.user} ${cfg.group}"
+    )
+    cfg.repositories;
+
+  repositoryType = lib.types.submodule ({name, ...}: {
+    options = {
+      name = lib.mkOption {
+        internal = true;
+        default = name;
+        type = lib.types.str;
+        description = "The name that should be given to this unit.";
+      };
+
+      path = lib.mkOption {
+        type = lib.types.str;
+        description = "The path at which to sync the repository";
+      };
+
+      uri = lib.mkOption {
+        type = lib.types.str;
+        example = "ssh://user@example.com:/~[user]/path/to/repo.git";
+        description = ''
+          The URI of the remote to be synchronized. This is only used in the
+          event that the directory does not already exist. See
+          <link xlink:href="https://git-scm.com/docs/git-clone#_git_urls"/>
+          for the supported URIs.
+        '';
+      };
+
+      interval = lib.mkOption {
+        type = lib.types.int;
+        default = 500;
+        description = ''
+          The interval, specified in seconds, at which the synchronization will
+          be triggered.
+        '';
+      };
+    };
+  });
+in {
+  options = {
+    services.nix-sync = {
+      enable = lib.mkEnableOption "nix-sync services";
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "nix-sync";
+        description = lib.mdDoc "User account under which nix-sync units runs.";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "nix-sync";
+        description = lib.mdDoc "Group account under which nix-sync units runs.";
+      };
+
+      cachePath = lib.mkOption {
+        type = lib.types.str;
+        default = "/var/lib/nix-sync";
+        description = lib.mdDoc ''
+          Where to cache git directories. Should not end with a slash ("/")
+        '';
+      };
+
+      repositories = lib.mkOption {
+        type = with lib.types; attrsOf repositoryType;
+        description = ''
+          The repositories that should be synchronized.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !lib.strings.hasSuffix "/" cfg.cachePath;
+        message = "Your cachePath ('${cfg.cachePath}') ends with a slash ('/'), please use: '${lib.strings.removeSuffix "/" cfg.cachePath}'.";
+      }
+    ];
+
+    systemd.tmpfiles.rules =
+      generatedDirectories;
+
+    systemd.services = services;
+    systemd.timers = timers;
+    users.users =
+      if cfg.user == "nix-sync"
+      then {
+        nix-sync = {
+          group = "${cfg.group}";
+          isSystemUser = true;
+        };
+      }
+      else lib.warnIf (cfg.user != "nix-sync") "The user (${cfg.user}) is not \"nix-sync\", thus you are responible for generating it.";
+    users.groups =
+      if cfg.group == "nix-sync"
+      then {
+        nix-sync = {
+          members = ["${cfg.user}"];
+        };
+      }
+      else lib.warnIf (cfg.group != "nix-sync") "The group (${cfg.group}) is not \"nix-sync\", thus you are responible for generating it.";
+  };
+}
diff --git a/system/services/openssh/default.nix b/system/services/openssh/default.nix
new file mode 100644
index 0000000..46b7ffd
--- /dev/null
+++ b/system/services/openssh/default.nix
@@ -0,0 +1,17 @@
+{...}: {
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+    hostKeys = [
+      {
+        # See the explanation for this in /system/impermanence/mods/openssh.nix
+        # path = "/var/lib/sshd/ssh_host_ed25519_key";
+
+        # FIXME: Remove this workaround
+        path = "/srv/var/lib/sshd/ssh_host_ed25519_key";
+        rounds = 1000;
+        type = "ed25519";
+      }
+    ];
+  };
+}
diff --git a/system/services/opensshd/default.nix b/system/services/opensshd/default.nix
deleted file mode 100644
index 1bb37ee..0000000
--- a/system/services/opensshd/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{...}: {
-  services.openssh = {
-    enable = true;
-    settings.PasswordAuthentication = false;
-    hostKeys = [
-      {
-        path = "/srv/sshd/ssh_host_ed25519_key";
-        rounds = 1000;
-        type = "ed25519";
-      }
-    ];
-  };
-}
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-11-29 14:28:40 +0000