Skynet/nixos
6
1
Fork 0
Code Issues 43 Pull requests 1 Projects Releases Packages Wiki Activity Actions

feat: simplified the config for running services, only one hosts config is required now in each server config file

Browse source
This commit is contained in:
silver 2024-05-30 17:55:29 +01:00
parent f8c7860eb5
commit 379cb84839
Signed by: silver
GPG key ID: 54E2C71918E93B74
34 changed files with 200 additions and 581 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

59
applications/_base.nix Normal file
View file

@ -0,0 +1,59 @@
{
config,
lib,
pkgs,
...
}:
with lib; let
# root service
cfg = config.services.skynet;
in {
imports = [
./acme.nix
./dns.nix
./nginx.nix
];
options.services.skynet = {
# since we use this basically everywhere provide a standard way to set it
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
hostname = mkOption {
type = types.str;
default = "${cfg.host.name}.skynet.ie";
};
};
};
config = {
services.skynet.dns.records = [
{
record = cfg.host.name;
r_type = "A";
value = cfg.host.ip;
server = true;
}
{
record = cfg.host.ip;
r_type = "PTR";
value = cfg.host.hostname;
}
];
services.nginx = {
virtualHosts = {
# for every server unless explisitly defined redirect the ip to skynet.ie
"${cfg.host.ip}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".return = "307 https://skynet.ie";
};
};
};
};
}

19
applications/bitwarden/vaultwarden.nix
View file

@ -19,17 +19,7 @@ in {
]; ];
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
enable = mkEnableOption "Skynet vaultwarden server"; enable = mkEnableOption "Skynet VaultWarden server";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
@ -44,16 +34,11 @@ in {
{ {
record = domain_sub; record = domain_sub;
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"${cfg.host.ip}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".return = "307 https://skynet.ie";
};
"${domain}" = { "${domain}" = {
forceSSL = true; forceSSL = true;
useACMEHost = "skynet"; useACMEHost = "skynet";

20
applications/email.nix
View file

@ -134,16 +134,6 @@ in {
enable = mkEnableOption "Skynet Email"; enable = mkEnableOption "Skynet Email";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
domain = mkOption { domain = mkOption {
type = types.str; type = types.str;
default = "skynet.ie"; default = "skynet.ie";
@ -246,12 +236,6 @@ in {
# to provide the certs # to provide the certs
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"${cfg.host.ip}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".return = "307 https://skynet.ie";
};
"mail.skynet.ie" = { "mail.skynet.ie" = {
forceSSL = true; forceSSL = true;
useACMEHost = "mail"; useACMEHost = "mail";
@ -291,7 +275,7 @@ in {
{ {
record = "mail"; record = "mail";
r_type = "A"; r_type = "A";
value = cfg.host.ip; value = config.services.skynet.host.ip;
} }
#DNS config for K-9 Mail #DNS config for K-9 Mail
{ {
@ -345,7 +329,7 @@ in {
# reverse pointer # reverse pointer
{ {
record = cfg.host.ip; record = config.services.skynet.host.ip;
r_type = "PTR"; r_type = "PTR";
value = "${cfg.sub}.${cfg.domain}."; value = "${cfg.sub}.${cfg.domain}.";
} }

23
applications/games.nix
View file

@ -18,16 +18,6 @@ in {
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
enable = mkEnableOption "Skynet Games"; enable = mkEnableOption "Skynet Games";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
domain = { domain = {
tld = mkOption { tld = mkOption {
type = types.str; type = types.str;
@ -52,7 +42,7 @@ in {
{ {
record = cfg.domain.sub; record = cfg.domain.sub;
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];
@ -61,12 +51,6 @@ in {
]; ];
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"${cfg.host.ip}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".return = "307 https://skynet.ie";
};
"${cfg.domain.sub}.skynet.ie" = { "${cfg.domain.sub}.skynet.ie" = {
forceSSL = true; forceSSL = true;
useACMEHost = "skynet"; useACMEHost = "skynet";
@ -78,11 +62,6 @@ in {
services.skynet.games_minecraft = { services.skynet.games_minecraft = {
enable = true; enable = true;
host = {
ip = cfg.host.ip;
name = cfg.domain.sub;
};
domain = { domain = {
sub = "minecraft.${cfg.domain.sub}"; sub = "minecraft.${cfg.domain.sub}";
}; };

34
applications/games/minecraft.nix
View file

@ -23,16 +23,6 @@ in {
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
enable = mkEnableOption "Skynet Games Minecraft"; enable = mkEnableOption "Skynet Games Minecraft";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
domain = { domain = {
tld = mkOption { tld = mkOption {
type = types.str; type = types.str;
@ -53,9 +43,9 @@ in {
config = mkIf cfg.enable { config = mkIf cfg.enable {
skynet_firewall.forward = [ skynet_firewall.forward = [
"ip daddr ${cfg.host.ip} tcp dport 80 counter packets 0 bytes 0 accept" "ip daddr ${config.services.skynet.host.ip} tcp dport 80 counter packets 0 bytes 0 accept"
"ip daddr ${cfg.host.ip} tcp dport 443 counter packets 0 bytes 0 accept" "ip daddr ${config.services.skynet.host.ip} tcp dport 443 counter packets 0 bytes 0 accept"
"ip daddr ${cfg.host.ip} tcp dport 25565 counter packets 0 bytes 0 accept" "ip daddr ${config.services.skynet.host.ip} tcp dport 25565 counter packets 0 bytes 0 accept"
]; ];
services.skynet.acme.domains = [ services.skynet.acme.domains = [
@ -68,38 +58,38 @@ in {
{ {
record = "config.${cfg.domain.sub}"; record = "config.${cfg.domain.sub}";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
# our own minecraft hosts # our own minecraft hosts
{ {
record = "compsoc_classic.${cfg.domain.sub}"; record = "compsoc_classic.${cfg.domain.sub}";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
{ {
record = "compsoc.${cfg.domain.sub}"; record = "compsoc.${cfg.domain.sub}";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
# gsoc servers # gsoc servers
{ {
record = "gsoc.${cfg.domain.sub}"; record = "gsoc.${cfg.domain.sub}";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
{ {
record = "gsoc_abridged.${cfg.domain.sub}"; record = "gsoc_abridged.${cfg.domain.sub}";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
# phildeb # phildeb
{ {
record = "phildeb.${cfg.domain.sub}"; record = "phildeb.${cfg.domain.sub}";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];
@ -109,12 +99,6 @@ in {
]; ];
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"${cfg.host.ip}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".return = "307 https://skynet.ie";
};
# https://config.minecraft.games.skynet.ie # https://config.minecraft.games.skynet.ie
"config.${short_domain}" = { "config.${short_domain}" = {
forceSSL = true; forceSSL = true;

24
applications/gitlab.nix
View file

@ -21,16 +21,6 @@ in {
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
enable = mkEnableOption "Skynet Gitlab"; enable = mkEnableOption "Skynet Gitlab";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
domain = { domain = {
tld = mkOption { tld = mkOption {
type = types.str; type = types.str;
@ -111,13 +101,13 @@ in {
{ {
record = cfg.domain.sub; record = cfg.domain.sub;
r_type = "A"; r_type = "A";
value = cfg.host.ip; value = config.services.skynet.host.ip;
} }
# for gitlab pages # for gitlab pages
{ {
record = "*.pages.${cfg.domain.base}.${cfg.domain.tld}."; record = "*.pages.${cfg.domain.base}.${cfg.domain.tld}.";
r_type = "A"; r_type = "A";
value = cfg.host.ip; value = config.services.skynet.host.ip;
} }
# for email # for email
@ -127,7 +117,7 @@ in {
value = ''10 ${domain_full}.''; value = ''10 ${domain_full}.'';
} }
{ {
record = cfg.host.ip; record = config.services.skynet.host.ip;
r_type = "PTR"; r_type = "PTR";
value = "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}."; value = "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}.";
} }
@ -151,12 +141,6 @@ in {
services.openssh.ports = [22 2222]; services.openssh.ports = [22 2222];
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"${cfg.host.ip}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".return = "307 https://skynet.ie";
};
# main site # main site
"${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = { "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = {
forceSSL = true; forceSSL = true;
@ -264,7 +248,7 @@ in {
# default for pages is set to 8090 but that leaves an "ugly" port in the url, # default for pages is set to 8090 but that leaves an "ugly" port in the url,
# override it here to make it look good # override it here to make it look good
port = 80; port = 80;
#external_http = ["${cfg.host.ip}:80"]; #external_http = ["${config.services.skynet.host.ip}:80"];
}; };
}; };
}; };

11
applications/grafana.nix
View file

@ -16,15 +16,6 @@ in {
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
enable = mkEnableOption "Grafana Server"; enable = mkEnableOption "Grafana Server";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
datasource = { datasource = {
name = mkOption { name = mkOption {
type = types.str; type = types.str;
@ -41,7 +32,7 @@ in {
{ {
record = "${name}"; record = "${name}";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];

12
applications/ldap/backend.nix
View file

@ -21,16 +21,6 @@ in {
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
enable = mkEnableOption "Skynet LDAP backend server"; enable = mkEnableOption "Skynet LDAP backend server";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
domain = { domain = {
tld = mkOption { tld = mkOption {
type = types.str; type = types.str;
@ -65,7 +55,7 @@ in {
{ {
record = cfg.domain.sub; record = cfg.domain.sub;
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];

20
applications/ldap/server.nix
View file

@ -18,7 +18,6 @@ in {
../acme.nix ../acme.nix
../dns.nix ../dns.nix
../nginx.nix ../nginx.nix
./backend.nix
]; ];
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
@ -26,16 +25,6 @@ in {
enable = mkEnableOption "Skynet LDAP service"; enable = mkEnableOption "Skynet LDAP service";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
domain = { domain = {
tld = mkOption { tld = mkOption {
type = types.str; type = types.str;
@ -65,13 +54,6 @@ in {
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
# passthrough to the backend
services.skynet.ldap_backend = {
enable = true;
host.ip = cfg.host.ip;
host.name = cfg.host.name;
};
# after changing teh password openldap.service has to be restarted # after changing teh password openldap.service has to be restarted
age.secrets.ldap_pw = { age.secrets.ldap_pw = {
file = ../../secrets/ldap/pw.age; file = ../../secrets/ldap/pw.age;
@ -88,7 +70,7 @@ in {
{ {
record = cfg.domain.sub; record = cfg.domain.sub;
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];

19
applications/nextcloud.nix
View file

@ -18,16 +18,6 @@ in {
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
enable = mkEnableOption "Skynet Nextcloud"; enable = mkEnableOption "Skynet Nextcloud";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
domain = { domain = {
tld = mkOption { tld = mkOption {
type = types.str; type = types.str;
@ -64,12 +54,12 @@ in {
{ {
record = cfg.domain.sub; record = cfg.domain.sub;
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
{ {
record = "onlyoffice.${cfg.domain.sub}"; record = "onlyoffice.${cfg.domain.sub}";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];
@ -109,11 +99,6 @@ in {
}; };
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"${cfg.host.ip}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".return = "307 https://skynet.ie";
};
${domain} = { ${domain} = {
forceSSL = true; forceSSL = true;
useACMEHost = "skynet"; useACMEHost = "skynet";

13
applications/nix_cache/nix_cache.nix
View file

@ -29,17 +29,10 @@ in {
]; ];
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
host = { enable = mkEnableOption "Skynet Nix Cache";
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
}; };
config = { config = mkIf cfg.enable {
services.skynet.acme.domains = [ services.skynet.acme.domains = [
"${name}.skynet.ie" "${name}.skynet.ie"
]; ];
@ -48,7 +41,7 @@ in {
{ {
record = "${name}"; record = "${name}";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];

13
applications/open_governance/keyserver.nix
View file

@ -18,17 +18,10 @@ in {
]; ];
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
host = { enable = mkEnableOption "Skynet Public Keyserver";
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
}; };
config = { config = mkIf cfg.enable {
services.skynet.acme.domains = [ services.skynet.acme.domains = [
"${name}.skynet.ie" "${name}.skynet.ie"
]; ];
@ -37,7 +30,7 @@ in {
{ {
record = "${name}"; record = "${name}";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];

11
applications/open_governance/open_governance.nix
View file

@ -20,14 +20,7 @@ in {
]; ];
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
host = { enable = mkEnableOption "Skynet Open Governance";
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
}; };
config = { config = {
@ -39,7 +32,7 @@ in {
{ {
record = "${name}"; record = "${name}";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];

9
applications/prometheus.nix
View file

@ -13,15 +13,6 @@ in {
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
server = { server = {
enable = mkEnableOption "Prometheus Server"; enable = mkEnableOption "Prometheus Server";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
port = mkOption { port = mkOption {
type = types.port; type = types.port;

29
applications/restic.nix
View file

@ -39,21 +39,23 @@ with lib; let
lib.attrsets.mapAttrsToList ( lib.attrsets.mapAttrsToList (
key: value: let key: value: let
backup = value.config.services.skynet.backup; backup = value.config.services.skynet.backup;
backup_host = value.config.services.skynet.host;
in in
if if
( (
(builtins.hasAttr "backup" value.config.services.skynet) (builtins.hasAttr "backup" value.config.services.skynet)
&& backup.server.enable && backup.server.enable
&& backup.host.name != cfg.host.name # chgeck that its not itself
&& backup_host.name != config.services.skynet.host.name
&& !backup.server.appendOnly && !backup.server.appendOnly
) )
then [ then [
{ {
name = backup.host.name; name = backup_host.name;
value = value =
base base
// { // {
repositoryFile = "/etc/skynet/restic/${backup.host.name}"; repositoryFile = "/etc/skynet/restic/${backup_host.name}";
backupPrepareCommand = '' backupPrepareCommand = ''
#!${pkgs.stdenv.shell} #!${pkgs.stdenv.shell}
@ -64,13 +66,13 @@ with lib; let
mkdir -p $baseDir mkdir -p $baseDir
cd $baseDir cd $baseDir
echo -n "rest:http://root:password@${backup.host.ip}:${toString backup.server.port}/root/${cfg.host.name}" > ${backup.host.name} echo -n "rest:http://root:password@${backup_host.ip}:${toString backup.server.port}/root/${config.services.skynet.host.name}" > ${backup_host.name}
# read in teh password # read in teh password
#PW = `cat ${config.age.secrets.restic.path}` #PW = `cat ${config.age.secrets.restic.path}`
line=$(head -n 1 ${config.age.secrets.restic.path}) line=$(head -n 1 ${config.age.secrets.restic.path})
sed -i "s/password/$line/g" ${backup.host.name} sed -i "s/password/$line/g" ${backup_host.name}
''; '';
}; };
} }
@ -87,8 +89,7 @@ in {
# https://git.hrnz.li/Ulli/nixos/src/commit/5edca2dfdab3ce52208e4dfd2b92951e500f8418/profiles/server/restic.nix # https://git.hrnz.li/Ulli/nixos/src/commit/5edca2dfdab3ce52208e4dfd2b92951e500f8418/profiles/server/restic.nix
# will eb enabled on every server # will eb enabled on every server
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
# backup is enabled by default enable = mkEnableOption "Skynet backup";
# enable = mkEnableOption "Skynet backup";
# what folders to backup # what folders to backup
normal = { normal = {
@ -128,16 +129,6 @@ in {
}; };
}; };
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
server = { server = {
enable = mkEnableOption "Skynet backup Server"; enable = mkEnableOption "Skynet backup Server";
@ -176,7 +167,7 @@ in {
services.restic.server = { services.restic.server = {
enable = true; enable = true;
listenAddress = "${cfg.host.ip}:${toString cfg.server.port}"; listenAddress = "${config.services.skynet.host.ip}:${toString cfg.server.port}";
appendOnly = cfg.server.appendOnly; appendOnly = cfg.server.appendOnly;
privateRepos = true; privateRepos = true;
}; };
@ -196,7 +187,7 @@ in {
# merge teh two configs together # merge teh two configs together
# backblaze = base // { # backblaze = base // {
# # backupos for each server are stored in a folder under their name # # backupos for each server are stored in a folder under their name
# repository = "b2:NixOS-Main2:/${cfg.host.name}"; # repository = "b2:NixOS-Main2:/${config.services.skynet.host.name}";
# #environmentFile = config.age.secrets.backblaze.path; # #environmentFile = config.age.secrets.backblaze.path;
# }; # };
}; };

21
applications/skynet.ie.nix
View file

@ -15,17 +15,10 @@ in {
]; ];
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
host = { enable = mkEnableOption "Skynet Main Website";
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
}; };
config = { config = mkIf cfg.enable {
services.skynet.acme.domains = [ services.skynet.acme.domains = [
# the root one is already covered by teh certificate # the root one is already covered by teh certificate
"2016.skynet.ie" "2016.skynet.ie"
@ -39,27 +32,27 @@ in {
{ {
record = "@"; record = "@";
r_type = "A"; r_type = "A";
value = cfg.host.ip; value = config.services.skynet.host.ip;
} }
{ {
record = "2016"; record = "2016";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
{ {
record = "discord"; record = "discord";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
{ {
record = "public"; record = "public";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
{ {
record = "renew"; record = "renew";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];

19
applications/skynet_users.nix
View file

@ -17,14 +17,7 @@ in {
]; ];
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
host = { enable = mkEnableOption "Skynet User Linux Server";
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
}; };
config = { config = {
@ -48,12 +41,12 @@ in {
{ {
record = "users"; record = "users";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
{ {
record = "*.users"; record = "*.users";
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];
@ -92,12 +85,6 @@ in {
}; };
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"${cfg.host.ip}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".return = "307 https://skynet.ie";
};
# main site # main site
"*.users.skynet.ie" = { "*.users.skynet.ie" = {
forceSSL = true; forceSSL = true;

23
applications/ulfm.nix
View file

@ -18,16 +18,6 @@ in {
options.services.skynet."${name}" = { options.services.skynet."${name}" = {
enable = mkEnableOption "ULFM service"; enable = mkEnableOption "ULFM service";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
domain = { domain = {
tld = mkOption { tld = mkOption {
type = types.str; type = types.str;
@ -62,14 +52,14 @@ in {
{ {
record = cfg.domain.sub; record = cfg.domain.sub;
r_type = "CNAME"; r_type = "CNAME";
value = cfg.host.name; value = config.services.skynet.host.name;
} }
]; ];
skynet_firewall.forward = [ skynet_firewall.forward = [
"ip daddr ${cfg.host.ip} tcp dport 80 counter packets 0 bytes 0 accept" "ip daddr ${config.services.skynet.host.ip} tcp dport 80 counter packets 0 bytes 0 accept"
"ip daddr ${cfg.host.ip} tcp dport 443 counter packets 0 bytes 0 accept" "ip daddr ${config.services.skynet.host.ip} tcp dport 443 counter packets 0 bytes 0 accept"
"ip daddr ${cfg.host.ip} tcp dport 8000 counter packets 0 bytes 0 accept" "ip daddr ${config.services.skynet.host.ip} tcp dport 8000 counter packets 0 bytes 0 accept"
]; ];
users.groups."icecast" = {}; users.groups."icecast" = {};
@ -101,11 +91,6 @@ in {
useACMEHost = "skynet"; useACMEHost = "skynet";
locations."/".proxyPass = "http://localhost:8000"; locations."/".proxyPass = "http://localhost:8000";
}; };
"${cfg.host.ip}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".return = "307 https://skynet.ie";
};
}; };
}; };
}; };

3
machines/_base.nix
View file

@ -18,6 +18,9 @@ in {
# for the secrets # for the secrets
inputs.agenix.nixosModules.default inputs.agenix.nixosModules.default
# base config for all servers
../applications/_base.nix
# every sever may need the firewall config stuff # every sever may need the firewall config stuff
../applications/firewall.nix ../applications/firewall.nix

18
machines/agentjones.nix
View file

@ -20,6 +20,7 @@ Notes: Used to have Agent Smith as a partner but it died (Ironically)
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -35,22 +36,9 @@ in {
tags = ["active-firewall"]; tags = ["active-firewall"];
}; };
services.skynet.dns.records = [ services.skynet = {
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup = {
host = host; host = host;
backup.enable = true;
}; };
# keep the wired usb connection alive (front panel) # keep the wired usb connection alive (front panel)

24
machines/cadie.nix
View file

@ -21,6 +21,7 @@ Notes:
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -35,27 +36,10 @@ in {
tags = ["active"]; tags = ["active"];
}; };
services.skynet.dns.records = [ services.skynet = {
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup = {
host = host;
};
services.skynet.nextcloud = {
enable = true;
host = host; host = host;
backup.enable = true;
nextcloud.enable = true;
}; };
# this was causing a conflict for some reason # this was causing a conflict for some reason

24
machines/calculon.nix
View file

@ -22,6 +22,7 @@ Notes:
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -38,24 +39,11 @@ in {
tags = ["active"]; tags = ["active"];
}; };
# it has two network devices so two
services.skynet.dns.records = [
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet = { services.skynet = {
nix-cache.host = host; host = host;
open-governance.host = host; backup.enable = true;
keyserver.host = host; nix-cache.enable = true;
open-governance.enable = true;
keyserver.enable = true;
}; };
} }

24
machines/earth.nix
View file

@ -21,6 +21,7 @@ Notes:
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -35,26 +36,9 @@ in {
tags = ["active-core"]; tags = ["active-core"];
}; };
# it has two network devices so two services.skynet = {
services.skynet.dns.records = [
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup = {
host = host;
};
services.skynet.website = {
host = host; host = host;
backup.enable = true;
website.enable = true;
}; };
} }

24
machines/galatea.nix
View file

@ -22,6 +22,7 @@ Notes:
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -36,26 +37,9 @@ in {
tags = ["active"]; tags = ["active"];
}; };
services.skynet.dns.records = [ services.skynet = {
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup = {
host = host;
};
services.skynet.ulfm = {
enable = true;
host = host; host = host;
backup.enable = true;
ulfm.enable = true;
}; };
} }

27
machines/gir.nix
View file

@ -21,6 +21,7 @@ Notes:
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -35,29 +36,9 @@ in {
tags = ["active-core"]; tags = ["active-core"];
}; };
# add this server to dns services.skynet = {
services.skynet.dns.records = [
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup = {
host = host; host = host;
}; backup.enable = true;
email.enable = true;
# we use this to pass in teh relevent infomation to the
services.skynet.email = {
enable = true;
host = host;
domain = "skynet.ie";
}; };
} }

24
machines/glados.nix
View file

@ -22,6 +22,7 @@ Notes: Each user has roughly 20gb os storage
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -36,26 +37,9 @@ in {
tags = ["active-gitlab"]; tags = ["active-gitlab"];
}; };
services.skynet.dns.records = [ services.skynet = {
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup = {
host = host;
};
services.skynet.gitlab = {
enable = true;
host = host; host = host;
backup.enable = true;
gitlab.enable = true;
}; };
} }

53
machines/kitt.nix
View file

@ -22,10 +22,12 @@ Notes:
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
../applications/ldap/server.nix ../applications/ldap/server.nix
../applications/ldap/backend.nix
../applications/discord.nix ../applications/discord.nix
../applications/bitwarden/vaultwarden.nix ../applications/bitwarden/vaultwarden.nix
../applications/bitwarden/bitwarden_sync.nix ../applications/bitwarden/bitwarden_sync.nix
@ -41,49 +43,20 @@ in {
tags = ["active-core"]; tags = ["active-core"];
}; };
# add this server to dns services.skynet = {
services.skynet.dns.records = [
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup = {
host = host; host = host;
}; backup.enable = true;
services.skynet.ldap = { # ldap setup
enable = true; ldap.enable = true;
host = host; ldap_backend.enable = true;
};
services.skynet.discord_bot = { # private member services
enable = true; discord_bot.enable = true;
};
services.skynet.vaultwarden = { # committee/admin services
enable = true; vaultwarden.enable = true;
prometheus.server.enable = true;
host = host; grafana.enable = true;
};
services.skynet.prometheus = {
server = {
enable = true;
host = host;
};
};
services.skynet.grafana = {
enable = true;
host = host;
}; };
} }

20
machines/marvin.nix
View file

@ -20,6 +20,7 @@ Notes:
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
groups = [ groups = [
@ -53,23 +54,8 @@ in {
sudo_groups = groups; sudo_groups = groups;
}; };
services.skynet.dns.records = [ services.skynet = {
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup = {
host = host; host = host;
backup.enable = true;
}; };
# Put test services below this
} }

19
machines/neuromancer.nix
View file

@ -21,6 +21,7 @@ Notes:
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -48,22 +49,8 @@ in {
tags = ["active-core"]; tags = ["active-core"];
}; };
services.skynet.dns.records = [ services.skynet = {
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup = {
server.enable = true;
host = host; host = host;
backup.server.enable = true;
}; };
} }

24
machines/optimus.nix
View file

@ -22,6 +22,7 @@ Notes:
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -36,26 +37,9 @@ in {
tags = ["active"]; tags = ["active"];
}; };
services.skynet.dns.records = [ services.skynet = {
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup = {
host = host;
};
services.skynet.games = {
enable = true;
host = host; host = host;
backup.enable = true;
games.enable = true;
}; };
} }

21
machines/skynet.nix
View file

@ -24,6 +24,7 @@ Notes: Does not host offical sites
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -39,23 +40,9 @@ in {
tags = ["active-ext"]; tags = ["active-ext"];
}; };
services.skynet.dns.records = [ services.skynet = {
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup.host = host;
services.skynet.website_users = {
host = host; host = host;
backup.enable = true;
website_users.enable = true;
}; };
} }

35
machines/vendetta.nix
View file

@ -21,6 +21,7 @@ Notes: Using the server that used to be called Earth
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -49,32 +50,16 @@ in {
]; ];
}; };
services.skynet.backup = { services.skynet = {
host = host; host = host;
}; backup.enable = true;
dns = {
services.skynet.dns = { server = {
server = { enable = true;
enable = true; # primary dns server (ns1)
# primary dns server (ns1) primary = true;
primary = true; ip = ip_pub;
ip = ip_pub; };
}; };
records = [
# vendetta IN A 193.1.99.120
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
# 120 IN PTR vendetta.skynet.ie.
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
}; };
} }

36
machines/vigil.nix
View file

@ -20,6 +20,7 @@ Notes:
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -33,33 +34,16 @@ in {
tags = ["active-dns" "dns"]; tags = ["active-dns" "dns"];
}; };
services.skynet.backup = { services.skynet = {
host = host; host = host;
}; backup.enable = true;
dns = {
services.skynet.dns = { server = {
server = { enable = true;
enable = true; # secondary dns server (ns2)
# secondary dns server (ns2) primary = false;
primary = false; ip = ip_pub;
ip = ip_pub; };
}; };
# this server will have to have dns records
records = [
# vigil IN A 193.1.99.109
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
# 109 IN PTR vigil.skynet.ie.
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
}; };
} }

26
machines/wheatly.nix
View file

@ -21,6 +21,7 @@ Notes:
host = { host = {
ip = ip_pub; ip = ip_pub;
name = name; name = name;
hostname = hostname;
}; };
in { in {
imports = [ imports = [
@ -35,26 +36,13 @@ in {
tags = ["active-gitlab"]; tags = ["active-gitlab"];
}; };
services.skynet.dns.records = [ services.skynet = {
{
record = name;
r_type = "A";
value = ip_pub;
server = true;
}
{
record = ip_pub;
r_type = "PTR";
value = hostname;
}
];
services.skynet.backup = {
host = host; host = host;
}; backup.enable = true;
services.skynet.gitlab_runner = { gitlab_runner = {
enable = true; enable = true;
runner.name = "runner01"; runner.name = "runner01";
};
}; };
} }