Reorganize and comment some of the nix code

7 files changed, 310 insertions, 0 deletions

diff --git a/Com/Simatime/Cloud/chat.nix b/Com/Simatime/Cloud/chat.nix
new file mode 100644
index 0000000..e23b73e
--- /dev/null
+++ b/Com/Simatime/Cloud/chat.nix
@@ -0,0 +1,100 @@
+{ config, pkgs, ... }:
+#
+# a homeserver for matrix.org.
+#
+# - nixos manual: https://nixos.org/nixos/manual/index.html#module-services-matrix
+#
+# to create new users:
+#
+#     nix run nixpkgs.matrix-synapse
+#     register_new_matrix_user -k <registration_shared_secret> http://localhost:<matrix_port>
+#
+let
+  fqdn = "matrix.${config.networking.domain}";
+  riot = "chat.${config.networking.domain}";
+  matrix_port = 8448;
+in {
+  # matrix-synapse server. for what the settings mean, see:
+  # https://nixos.org/nixos/manual/index.html#module-services-matrix
+  #
+  services.matrix-synapse = {
+    enable = true;
+    server_name = config.networking.domain;
+    registration_shared_secret = "AkGRWSQLga3RoKRFnHhKoeCEIeZzu31y4TRzMRkMyRbBnETkVTSxilf24qySLzQn";
+    listeners = [
+      {
+        port = matrix_port;
+        bind_address = "::1";
+        type = "http";
+        tls = false;
+        x_forwarded = true;
+        resources = [
+          {
+            names = [ "client" "federation" ];
+            compress = false;
+          }
+        ];
+      }
+    ];
+  };
+  # matrix needs a database
+  #
+  services.postgresql.enable = true;
+  # web proxy for the matrix server
+  #
+  services.nginx = {
+    enable = true;
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedProxySettings = true;
+    virtualHosts = {
+      # route to matrix-synapse
+      "${config.networking.domain}" = {
+        locations."= /.well-known/matrix/server".extraConfig =
+          let
+            server = { "m.server" = "${fqdn}:443"; };
+          in ''
+            add_header Content-Type application/json;
+            return 200 '${builtins.toJSON server}';
+          '';
+        locations."= /.well-known/matrix/client".extraConfig =
+          let
+            client = {
+              "m.homeserver" = { "base_url" = "https://${fqdn}"; } ;
+              "m.identity_server" = { "base_url" = "https://vector.im"; };
+            };
+          in ''
+            add_header Content-Type application/json;
+            add_header Access-Control-Allow-Origin *;
+            return 200 '${builtins.toJSON client}';
+          '';
+      };
+      # reverse proxy for matrix client-server and server-server communication
+      "${fqdn}" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/".extraConfig = ''
+          return 404;
+        '';
+        locations."/_matrix" = {
+          proxyPass = "http://[::1]:${toString matrix_port}";
+        };
+      };
+    };
+  };
+  # riot client, available at chat.simatime.com
+  #
+  # note that riot and matrix-synapse must be on separate fqdn's to
+  # protect from XSS attacks:
+  # https://github.com/vector-im/riot-web#important-security-note
+  #
+  services.nginx.virtualHosts."${riot}" = {
+    enableACME = true;
+    forceSSL = true;
+    serverAliases = [
+      "chat.${config.networking.domain}"
+    ];
+    root = pkgs.riot-web;
+  };
+}
diff --git a/Com/Simatime/Cloud/git.nix b/Com/Simatime/Cloud/git.nix
new file mode 100644
index 0000000..4cdaa28
--- /dev/null
+++ b/Com/Simatime/Cloud/git.nix
@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+
+{
+  services = {
+    gitolite = {
+      enable = true;
+      enableGitAnnex = true;
+      # TODO: change this to /var/lib/gitolite?
+      dataDir = "/srv/git";
+      user = "git";
+      group = "git";
+      extraGitoliteRc = ''
+        $RC{SITE_INFO} = 'a computer is a bicycle for the mind.';
+      '';
+      adminPubkey = builtins.readFile ../keys/ben.pub;
+    };
+  };
+}
diff --git a/Com/Simatime/Cloud/hardware.nix b/Com/Simatime/Cloud/hardware.nix
new file mode 100644
index 0000000..8c88cb7
--- /dev/null
+++ b/Com/Simatime/Cloud/hardware.nix
@@ -0,0 +1,6 @@
+{ ... }:
+{
+  imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ];
+  boot.loader.grub.device = "/dev/vda";
+  fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
+}
diff --git a/Com/Simatime/Cloud/mail.nix b/Com/Simatime/Cloud/mail.nix
new file mode 100644
index 0000000..81bddc2
--- /dev/null
+++ b/Com/Simatime/Cloud/mail.nix
@@ -0,0 +1,43 @@
+{ ... }:
+
+{
+  mailserver = {
+    enable = true;
+    monitoring = {
+      enable = false;
+      alertAddress = "bsima@me.com";
+    };
+    fqdn = "simatime.com";
+    domains = [ "simatime.com" "bsima.me" ];
+    certificateScheme = 3; # let's encrypt
+    enableImap = true;
+    enablePop3 = true;
+    enableImapSsl = true;
+    enablePop3Ssl = true;
+    enableManageSieve = true;
+    virusScanning = false; # ur on ur own
+    localDnsResolver = true;
+
+    loginAccounts = {
+      "ben@simatime.com" = {
+        hashedPassword = "$6$Xr180W0PqprtaFB0$9S/Ug1Yz11CaWO7UdVJxQLZWfRUE3/rarB0driXkXALugEeQDLIjG2STGQBLU23//JtK3Mz8Kwsvg1/Zo0vD2/";
+        aliases = [
+          # my default email
+          "ben@bsima.me"
+          # admin stuff
+          "postmaster@simatime.com"
+          "abuse@simatime.com"
+        ];
+        catchAll = [ "simatime.com" "bsima.me" ];
+        quota = "5G";
+      };
+      "nick@simatime.com" = {
+        hashedPassword = "$6$31P/Mg8k8Pezy1e$Fn1tDyssf.1EgxmLYFsQpSq6RP4wbEvP/UlBlXQhyKA9FnmFtJteXsbJM1naa8Kyylo8vZM9zmeoSthHS1slA1";
+        aliases = [
+          "nicolai@simatime.com"
+        ];
+        quota = "1G";
+      };
+    };
+  };
+}
diff --git a/Com/Simatime/Cloud/networking.nix b/Com/Simatime/Cloud/networking.nix
new file mode 100644
index 0000000..0df42e3
--- /dev/null
+++ b/Com/Simatime/Cloud/networking.nix
@@ -0,0 +1,36 @@
+{ lib, config, ... }:
+
+{
+  networking = {
+
+    firewall = {
+      allowedTCPPorts = [ 22 80 443 ];
+      allowPing = true;
+    };
+
+    # This following was populated at runtime with the networking details
+    # gathered from the active system.
+    nameservers = [
+      "67.207.67.2"
+      "67.207.67.3"
+    ];
+    defaultGateway = "159.89.128.1";
+    defaultGateway6 = "";
+    dhcpcd.enable = false;
+    usePredictableInterfaceNames = lib.mkForce true;
+    interfaces = {
+      eth0 = {
+        ipv4.addresses = [
+          { address="159.89.128.69"; prefixLength=20; }
+          { address="10.46.0.6"; prefixLength=16; }
+        ];
+        ipv6.addresses = [
+          { address="fe80::e899:c0ff:fe9c:e194"; prefixLength=64; }
+        ];
+      };
+    };
+  };
+  services.udev.extraRules = ''
+    ATTR{address}=="ea:99:c0:9c:e1:94", NAME="eth0"
+  '';
+}
diff --git a/Com/Simatime/Cloud/web.nix b/Com/Simatime/Cloud/web.nix
new file mode 100644
index 0000000..22d7199
--- /dev/null
+++ b/Com/Simatime/Cloud/web.nix
@@ -0,0 +1,41 @@
+{ ... }:
+
+let
+  bensIp = "73.222.221.62";
+in
+{
+  services = {
+    nginx = {
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      virtualHosts = {
+        "bsima.me".root = "/home/ben/public_html/";
+        "www.bsima.me".root = "/home/ben/public_html/";
+        "simatime.com".locations."/".root = "/srv/www/";
+        "firefoxsync.simatime.com".locations."/".proxyPass = "http://localhost:5001";
+        "hero.simatime.com".locations."/".proxyPass = "http://${bensIp}:3001";
+        "tv.simatime.com".locations."/".proxyPass = "http://${bensIp}:8096"; # emby runs on port 8096
+        "deluge.simatime.com".locations."/".proxyPass = "http://${bensIp}:8112";
+
+        "notebook.simatime.com".locations = {
+          "/" = {
+            proxyPass = "http://${bensIp}:3099";
+            proxyWebsockets = true;
+            extraConfig = ''
+              proxy_buffering off;
+              proxy_read_timeout 86400;
+
+            '';
+          };
+          "/(api/kernels/[^/]+/channels|terminals/websocket)/" = {
+            proxyPass = "http://${bensIp}:3099";
+            proxyWebsockets = true;
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/Com/Simatime/Cloud/znc.nix b/Com/Simatime/Cloud/znc.nix
new file mode 100644
index 0000000..9b1a28d
--- /dev/null
+++ b/Com/Simatime/Cloud/znc.nix
@@ -0,0 +1,66 @@
+/*
+
+N.B.: generate znc passwords with 'nix-shell -p znc --command "znc --makepass"'
+
+- https://wiki.znc.in/Configuration
+
+*/
+
+{ ... }:
+
+{
+  services = {
+    znc = {
+      enable = true;
+      mutable = false;
+      useLegacyConfig = false;
+      openFirewall = true;
+      config = {
+        LoadModule = [ "adminlog" ];
+        User.bsima = {
+          Admin = true;
+          Nick = "bsima";
+          AltNick = "bsima1";
+          LoadModule = [ "chansaver" "controlpanel" "log" ];
+          Network.freenode = {
+            Server = "chat.freenode.net +6697";
+            LoadModule = [ "simple_away" "nickserv" "sasl" ];
+            Chan = {
+              "#ai"              = {};
+              "#biz"             = { Modes = "+Sp"; };
+              "#bsima"           = { Modes = "+Sp"; };
+              "##categorytheory" = { Detached = true; };
+              "#clojure"         = { Detached = true; };
+              "#coq"             = { Detached = true; };
+              "#emacs"           = { Detached = true; };
+              "#guile"           = { Detached = true; };
+              "#guix"            = { Detached = true; };
+              "#haskell"         = {};
+              "#haskell-miso"    = { Detached = true; };
+              "#hledger"         = {};
+              "#hnix"            = { Detached = true; };
+              "#home-manager"    = { Detached = true; };
+              "#ledger"          = {};
+              "#nix-darwin"      = { Detached = true; };
+              "#nixos"           = {};
+              "#org-mode"        = {};
+              "#scheme"          = { Detached = true; };
+              "#servant"         = { Detached = true; };
+              "#sr.ht"           = { Detached = true; };
+              "#xmonad"          = { Detached = true; };
+            };
+          };
+          Network.efnet = {
+            Server = "irc.efnet.info +6697";
+            LoadModule = [ "simple_away" ];
+          };
+          Pass.password = {
+            Method = "sha256";
+            Hash = "bead16d806e7bf5cbbc31d572b20f01e2b253eb60e2497ce465df56306becd02";
+            Salt = "/GhmBMc+E6b7qd8muFEe";
+          };
+        };
+      };
+    };
+  };
+}