summary refs log tree commit diff stats
path: root/system/services
diff options
context:
space:
mode:
Diffstat (limited to 'system/services')
-rw-r--r--system/services/default.nix7
-rw-r--r--system/services/fail2ban/default.nix4
-rw-r--r--system/services/keycloak/default.nix2
-rw-r--r--system/services/mail/default.nix43
-rw-r--r--system/services/mail/users.nixbin0 -> 486 bytes
-rw-r--r--system/services/minecraft/default.nix2
-rw-r--r--system/services/nginx/default.nix10
-rw-r--r--system/services/nginx/hosts.nixbin1027 -> 989 bytes
-rw-r--r--system/services/nix-sync/default.nix159
-rw-r--r--system/services/openssh/default.nix17
-rw-r--r--system/services/opensshd/default.nix13
11 files changed, 190 insertions, 67 deletions
diff --git a/system/services/default.nix b/system/services/default.nix
index 2e2b751..13e1c0a 100644
--- a/system/services/default.nix
+++ b/system/services/default.nix
@@ -1,12 +1,13 @@
 {...}: {
   imports = [
+    ./fail2ban
     ./keycloak
+    ./mail
     ./minecraft
     ./nginx
     ./nix
-    ./opensshd
+    ./nix-sync
+    ./openssh
     ./rust-motd
-    ./fail2ban
-    ./git-sync
   ];
 }
diff --git a/system/services/fail2ban/default.nix b/system/services/fail2ban/default.nix
index 5aee097..3e6244b 100644
--- a/system/services/fail2ban/default.nix
+++ b/system/services/fail2ban/default.nix
@@ -1,4 +1,3 @@
-# vim: ts=2
 {...}: {
   services.fail2ban = {
     enable = true;
@@ -8,7 +7,7 @@
       logtarget = SYSLOG
       socket    = /run/fail2ban/fail2ban.sock
       pidfile   = /run/fail2ban/fail2ban.pid
-      dbfile    = /srv/fail2ban/fail2ban.sqlite3
+      dbfile    = /var/lib/fail2ban/db.sqlite3
     '';
     bantime-increment = {
       enable = true;
@@ -28,3 +27,4 @@
     };
   };
 }
+
diff --git a/system/services/keycloak/default.nix b/system/services/keycloak/default.nix
index dfeabc3..5f21b90 100644
--- a/system/services/keycloak/default.nix
+++ b/system/services/keycloak/default.nix
@@ -31,7 +31,7 @@
       createLocally = true;
 
       username = "keycloak";
-      passwordFile = "/srv/keycloak/password";
+      passwordFile = "${config.age.secrets.keycloak.path}";
     };
 
     settings = {
diff --git a/system/services/mail/default.nix b/system/services/mail/default.nix
new file mode 100644
index 0000000..0640fc7
--- /dev/null
+++ b/system/services/mail/default.nix
@@ -0,0 +1,43 @@
+{lib, ...}: let
+  all_admins = [
+    "sils@vhack.eu"
+    "soispha@vhack.eu"
+    "nightingale@vhack.eu"
+  ];
+  users = import ./users.nix {};
+in {
+  mailserver =
+    lib.recursiveUpdate {
+      enable = true;
+      fqdn = "server1.vhack.eu";
+
+      useFsLayout = true;
+
+      extraVirtualAliases = {
+        "abuse@vhack.eu" = all_admins;
+        "postmaster@vhack.eu" = all_admins;
+        "admin@vhack.eu" = all_admins;
+      };
+
+      mailDirectory = "/var/lib/mail/vmail";
+      dkimKeyDirectory = "/var/lib/mail/dkim";
+      sieveDirectory = "/var/lib/mail/sieve";
+      backup.snapshotRoot = "/var/lib/mail/backup";
+
+      enableImap = false;
+      enableImapSsl = true;
+      enablePop3 = false;
+      enablePop3Ssl = true;
+      # SMTP
+      enableSubmission = false;
+      enableSubmissionSsl = true;
+      openFirewall = true;
+
+      keyFile = "/var/lib/acme/server1.vhack.eu/key.pem";
+      certificateScheme = "acme";
+      certificateFile = "/var/lib/acme/server1.vhack.eu/fullchain.pem";
+    }
+    users;
+}
+# vim: ts=2
+
diff --git a/system/services/mail/users.nix b/system/services/mail/users.nix
new file mode 100644
index 0000000..f3264a1
--- /dev/null
+++ b/system/services/mail/users.nix
Binary files differdiff --git a/system/services/minecraft/default.nix b/system/services/minecraft/default.nix
index e69ffb1..e659af0 100644
--- a/system/services/minecraft/default.nix
+++ b/system/services/minecraft/default.nix
@@ -7,7 +7,7 @@
     enable = true;
     declarative = true;
     eula = true;
-    dataDir = "/srv/minecraft";
+    dataDir = "/var/lib/minecraft";
     openFirewall = true;
     jvmOpts = "-Xmx8192M -Xms8192M";
     whitelist = {
diff --git a/system/services/nginx/default.nix b/system/services/nginx/default.nix
index 3eb98d3..b9a0754 100644
--- a/system/services/nginx/default.nix
+++ b/system/services/nginx/default.nix
@@ -2,9 +2,13 @@
   imports = [
     ./hosts.nix
   ];
-  security.acme.acceptTerms = true;
-  security.acme.defaults.email = "admin@vhack.eu";
-  security.acme.defaults.webroot = "/srv/acme/";
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "admin@vhack.eu";
+      webroot = "/var/lib/acme/acme-challenge";
+    };
+  };
 
   networking.firewall = {
     allowedTCPPorts = [80 443];
diff --git a/system/services/nginx/hosts.nix b/system/services/nginx/hosts.nix
index 94fae9f..03806c0 100644
--- a/system/services/nginx/hosts.nix
+++ b/system/services/nginx/hosts.nix
Binary files differdiff --git a/system/services/nix-sync/default.nix b/system/services/nix-sync/default.nix
index 18511b3..5c2ed80 100644
--- a/system/services/nix-sync/default.nix
+++ b/system/services/nix-sync/default.nix
@@ -6,47 +6,85 @@
 }: let
   cfg = config.services.nix-sync;
 
+  mkTimer = name: repo: {
+    description = "Nix sync ${name} timer";
+    wantedBy = ["timers.target"];
+    timerConfig = {
+      OnActiveSec = repo.interval;
+    };
+    after = ["network-online.target"];
+  };
+
+  parents = path: let
+    split_path = builtins.split "/" path;
+    filename = builtins.elemAt split_path (builtins.length split_path - 1);
+  in
+    lib.strings.removeSuffix "/" (builtins.replaceStrings [filename] [""] path);
+  esa = lib.strings.escapeShellArg;
   mkUnit = name: repo: let
-    esa = lib.strings.escapeShellArg;
-    execStartScript = lib.writeShellScript "git-sync-exec" ''
-      cd ${esa cfg.cachePath}/${esa repo.path};
+    optionalPathSeparator =
+      if lib.strings.hasPrefix "/" repo.path
+      then ""
+      else "/";
+    repoCachePath = cfg.cachePath + optionalPathSeparator + repo.path;
+    execStartScript = pkgs.writeScript "nix-sync-exec" ''
+      #! /usr/bin/env dash
+      export XDG_CACHE_HOME="$CACHE_DIRECTORY";
+      cd ${esa repoCachePath};
 
-      while true; do
-        origin="$(git rev-parse @{u})";
-        branch="$(git rev-parse @)";
+      git fetch
+      origin="$(git rev-parse @{u})";
+      branch="$(git rev-parse @)";
 
-        if ! [ "$origin" = "$branch" ]; then
-          git pull;
+      if ! [ "$origin" = "$branch" ]; then
+        git pull;
 
-          out_paths=$(mktemp);
-          nix build . --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
-          [ "$(wc -l < "$out_paths")" -gt 1 ] && (echo "To many out-paths"; exit 1)
-          out_path="$(cat "$out_paths")";
-          rm -r ${esa repo.path};
-          ln -s "$out_path" ${esa repo.path};
-          rm "$out-paths";
-        fi
-        sleep ${esa repo.interval};
-      done
+        out_paths=$(mktemp);
+        nix build . --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
+        [ "$(wc -l < "$out_paths")" -gt 1 ] && (echo "To many out-paths"; exit 1)
+        out_path="$(cat "$out_paths")";
+        rm ${esa repo.path};
+        ln -s "$out_path" ${esa repo.path};
+        rm "$out_paths";
+      fi
     '';
     execStartPreScript = ''
-      if ! stat ${esa cfg.cachePath}/${esa repo.path}/.git; then
-          mkdir --parents ${esa cfg.cachePath}/${esa repo.path};
-          git clone ${esa repo.uri} ${esa cfg.cachePath}/${esa repo.path};
+      export XDG_CACHE_HOME="$CACHE_DIRECTORY";
+
+      if ! [ -d ${esa repoCachePath}/.git ]; then
+          mkdir --parents ${esa repoCachePath};
+          git clone ${esa repo.uri} ${esa repoCachePath};
 
           out_paths=$(mktemp);
-          nix build ${esa cfg.cachePath}/${esa repo.path} --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
+          nix build ${esa repoCachePath} --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
           [ "$(wc -l < "$out_paths")" -gt 1 ] && (echo "To many out-paths"; exit 1)
           out_path="$(cat "$out_paths")";
           ln -s "$out_path" ${esa repo.path};
-          rm "$out-paths";
+          rm "$out_paths";
+      fi
+
+      if ! [ -L ${esa repo.path} ]; then
+        cd ${esa repoCachePath};
+
+        git pull;
+
+        out_paths=$(mktemp);
+        nix build . --print-out-paths --experimental-features 'nix-command flakes' > "$out_paths";
+        [ "$(wc -l < "$out_paths")" -gt 1 ] && (echo "To many out-paths"; exit 1)
+        out_path="$(cat "$out_paths")";
+
+        [ -d ${esa repo.path} ] && rm -d ${esa repo.path};
+        [ -e ${esa repo.path} ] && rm ${esa repo.path};
+
+        ln -s "$out_path" ${esa repo.path};
+        rm "$out_paths";
       fi
     '';
   in {
     description = "Nix Sync ${name}";
     wantedBy = ["default.target"];
     after = ["network.target"];
-    path = with pkgs; [openssh git nix mktemp coreutils];
+    path = with pkgs; [openssh git nix mktemp coreutils dash];
     preStart = execStartPreScript;
 
     serviceConfig = {
@@ -56,16 +94,16 @@
       User = cfg.user;
       Group = cfg.group;
       # Runtime directory and mode
-      RuntimeDirectory = "nginx";
+      RuntimeDirectory = "nix-sync";
       RuntimeDirectoryMode = "0750";
       # Cache directory and mode
-      CacheDirectory = "nginx";
+      CacheDirectory = "nix-sync";
       CacheDirectoryMode = "0750";
       # Logs directory and mode
-      LogsDirectory = "nginx";
+      LogsDirectory = "nix-sync";
       LogsDirectoryMode = "0750";
       # Proc filesystem
-      ProcSubset = "pid";
+      ProcSubset = "all";
       ProtectProc = "invisible";
       # New file permissions
       UMask = "0027"; # 0640 / 0750
@@ -75,7 +113,8 @@
       # Security
       NoNewPrivileges = true;
       # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
-      ReadWritePaths = ["${repo.path}" "${cfg.cachePath}/${repo.path}"];
+      ReadWritePaths = ["${esa (parents repo.path)}" "-${esa repoCachePath}" "-${esa cfg.cachePath}"];
+      ReadOnlyPaths = ["/nix"];
       ProtectSystem = "strict";
       ProtectHome = true;
       PrivateTmp = true;
@@ -102,10 +141,23 @@
 
   services =
     lib.mapAttrs' (name: repo: {
-      name = "git-sync-${name}";
+      name = "nix-sync-${name}";
       value = mkUnit name repo;
     })
     cfg.repositories;
+  timers =
+    lib.mapAttrs' (name: repo: {
+      name = "nix-sync-${name}";
+      value = mkTimer name repo;
+    })
+    cfg.repositories;
+
+  # generate the websites directory, so systemd can mount it read write
+  generatedDirectories =
+    lib.mapAttrsToList (
+      _: repo: "d ${esa (parents repo.path)} 0755 ${cfg.user} ${cfg.group}"
+    )
+    cfg.repositories;
 
   repositoryType = lib.types.submodule ({name, ...}: {
     options = {
@@ -123,7 +175,7 @@
 
       uri = lib.mkOption {
         type = lib.types.str;
-        example = "git+ssh://user@example.com:/~[user]/path/to/repo.git";
+        example = "ssh://user@example.com:/~[user]/path/to/repo.git";
         description = ''
           The URI of the remote to be synchronized. This is only used in the
           event that the directory does not already exist. See
@@ -137,24 +189,15 @@
         default = 500;
         description = ''
           The interval, specified in seconds, at which the synchronization will
-          be triggered even without filesystem changes.
+          be triggered.
         '';
       };
     };
   });
 in {
   options = {
-    services.git-sync = {
-      enable = lib.mkEnableOption "git-sync services";
-
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.git-sync;
-        defaultText = lib.literalExpression "pkgs.git-sync";
-        description = ''
-          Package containing the <command>git-sync</command> program.
-        '';
-      };
+    services.nix-sync = {
+      enable = lib.mkEnableOption "nix-sync services";
 
       user = lib.mkOption {
         type = lib.types.str;
@@ -172,7 +215,7 @@ in {
         type = lib.types.str;
         default = "/var/lib/nix-sync";
         description = lib.mdDoc ''
-          Where to cache git directories.
+          Where to cache git directories. Should not end with a slash ("/")
         '';
       };
 
@@ -186,7 +229,35 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !lib.strings.hasSuffix "/" cfg.cachePath;
+        message = "Your cachePath ('${cfg.cachePath}') ends with a slash ('/'), please use: '${lib.strings.removeSuffix "/" cfg.cachePath}'.";
+      }
+    ];
+
+    systemd.tmpfiles.rules =
+      generatedDirectories;
+
     systemd.services = services;
+    systemd.timers = timers;
+    users.users =
+      if cfg.user == "nix-sync"
+      then {
+        nix-sync = {
+          group = "${cfg.group}";
+          isSystemUser = true;
+        };
+      }
+      else lib.warnIf (cfg.user != "nix-sync") "The user (${cfg.user}) is not \"nix-sync\", thus you are responible for generating it.";
+    users.groups =
+      if cfg.group == "nix-sync"
+      then {
+        nix-sync = {
+          members = ["${cfg.user}"];
+        };
+      }
+      else lib.warnIf (cfg.group != "nix-sync") "The group (${cfg.group}) is not \"nix-sync\", thus you are responible for generating it.";
   };
 }
 # vim: ts=2
diff --git a/system/services/openssh/default.nix b/system/services/openssh/default.nix
new file mode 100644
index 0000000..46b7ffd
--- /dev/null
+++ b/system/services/openssh/default.nix
@@ -0,0 +1,17 @@
+{...}: {
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+    hostKeys = [
+      {
+        # See the explanation for this in /system/impermanence/mods/openssh.nix
+        # path = "/var/lib/sshd/ssh_host_ed25519_key";
+
+        # FIXME: Remove this workaround
+        path = "/srv/var/lib/sshd/ssh_host_ed25519_key";
+        rounds = 1000;
+        type = "ed25519";
+      }
+    ];
+  };
+}
diff --git a/system/services/opensshd/default.nix b/system/services/opensshd/default.nix
deleted file mode 100644
index 1bb37ee..0000000
--- a/system/services/opensshd/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{...}: {
-  services.openssh = {
-    enable = true;
-    settings.PasswordAuthentication = false;
-    hostKeys = [
-      {
-        path = "/srv/sshd/ssh_host_ed25519_key";
-        rounds = 1000;
-        type = "ed25519";
-      }
-    ];
-  };
-}
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-11-29 12:37:20 +0000