116 lines
2.6 KiB
Nix
116 lines
2.6 KiB
Nix
/*
|
|
|
|
Name: https://en.wikipedia.org/wiki/Optimus_Prime
|
|
Why: Created to sell toys so this vm is for games
|
|
Type: VM
|
|
Hardware: -
|
|
From: 2023
|
|
Role: Game host
|
|
Notes:
|
|
|
|
*/
|
|
|
|
{ pkgs, lib, nodes, arion, ... }:
|
|
let
|
|
# name of the server, sets teh hostname and record for it
|
|
name = "optimus";
|
|
ip_pub = "193.1.99.112";
|
|
ip_priv = "172.20.20.7";
|
|
hostname = "${name}.skynet.ie";
|
|
|
|
in {
|
|
imports = [
|
|
# applications for this particular server
|
|
../applications/firewall.nix
|
|
../applications/dns.nix
|
|
../applications/games.nix
|
|
|
|
# for testing
|
|
../applications/ldap.nix
|
|
];
|
|
|
|
deployment = {
|
|
targetHost = hostname;
|
|
targetPort = 22;
|
|
targetUser = "root";
|
|
};
|
|
|
|
# these two are to be able to add the rules for firewall and dns
|
|
# open the firewall for this
|
|
skynet_firewall.forward = [
|
|
"ip daddr ${ip_pub} tcp dport 80 counter packets 0 bytes 0 accept"
|
|
"ip daddr ${ip_pub} tcp dport 443 counter packets 0 bytes 0 accept"
|
|
"ip daddr ${ip_pub} tcp dport 25565 counter packets 0 bytes 0 accept"
|
|
];
|
|
|
|
skynet_dns.records = {
|
|
external = [
|
|
"${name} A ${ip_pub}"
|
|
];
|
|
cname = [
|
|
# the games are each going to have a subdomain on this
|
|
"games CNAME ${name}"
|
|
];
|
|
};
|
|
|
|
# we use this to pass in teh relevent infomation to the
|
|
services.skynet_ldap = {
|
|
enable = true;
|
|
|
|
host = {
|
|
# pass in teh ip (used for firewall)
|
|
ip = ip_pub;
|
|
|
|
# the name is used for dns
|
|
name = name;
|
|
};
|
|
};
|
|
|
|
security.sudo.extraRules = [
|
|
{ groups = [ "skynet-admins" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ]; }
|
|
];
|
|
|
|
services.sssd = {
|
|
enable = true;
|
|
|
|
sshAuthorizedKeysIntegration = true;
|
|
|
|
config = ''
|
|
[domain/skynet.ie]
|
|
debug_level = 4
|
|
|
|
id_provider = ldap
|
|
auth_provider = ldap
|
|
sudo_provider = ldap
|
|
|
|
ldap_uri = ldap://193.1.99.112:389
|
|
|
|
ldap_search_base = dc=skynet,dc=ie
|
|
# thank ye https://medium.com/techish-cloud/linux-user-ssh-authentication-with-sssd-ldap-without-joining-domain-9151396d967d
|
|
ldap_user_search_base = ou=users,dc=skynet,dc=ie?sub?(|(skMemberOf=cn=skynet-users,ou=groups,dc=skynet,dc=ie))
|
|
ldap_group_search_base = ou=groups,dc=skynet,dc=ie
|
|
ldap_sudo_search_base = cn=skynet-admins,ou=groups,dc=skynet,dc=ie
|
|
|
|
ldap_group_nesting_level = 5
|
|
|
|
cache_credentials = false
|
|
entry_cache_timeout = 1
|
|
|
|
ldap_user_member_of = skMemberOf
|
|
|
|
[sssd]
|
|
config_file_version = 2
|
|
services = nss, pam, sudo, ssh
|
|
domains = skynet.ie
|
|
|
|
[nss]
|
|
|
|
[pam]
|
|
|
|
[sudo]
|
|
|
|
[autofs]
|
|
'';
|
|
};
|
|
|
|
}
|