refactor nutin-madaj nix code

6 files changed, 257 insertions, 225 deletions

diff --git a/depo/nutin-madaj/configuration.nix b/depo/nutin-madaj/configuration.nix
deleted file mode 100644
index 446a5f5..0000000
--- a/depo/nutin-madaj/configuration.nix
+++ /dev/null
@@ -1,222 +0,0 @@
-{ pkgs, ... }:
-
-let
-  bensIp = "68.107.97.20"; # hiddor-kahih
-  benKey =  "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCiNB0iF9ClawNEizBtdYucqp1tAXXRbqvlPS6PFRrtiwSl+SJD29BCLgA5rLxcmFhBHZ/iId/En7GPFEzI/gMu071J7pUI4OcW0UVZju3GNc6ZEz/a6AD2u79JiXEDHfPEdmMqAe36kkaK0KJWSQP3xsFRwJ+8F8HHbSwoCLL+GJhBgAWHQLGfKesNrDacNljNDU3CgkEnDmu8QKuSzH2k1vrr69q2u2iMSAdiStDBAWEjN5nCVrm2XB2vmFLMtXpX2n8JI+znOGzRRDc8dNXejQeDMZGyV6jfVidEIX7vdgSydGjTRKcCLVAsKY3z0gYBZ8u8EUNujgcFBnnAvytj ben@neb";
-  ibbPort = "3000";
-  fathomPort = "3030";
-  gitDir = "/srv/git";
-in
-{
-  nixpkgs.config.allowUnfree = true;
-  nixpkgs.overlays = [
-    (import ../../pack/overlay.nix)
-  ];
-
-  networking.firewall.allowedTCPPorts = [ 22 80 443 ];
-
-  services = {
-
-    gitolite = {
-      enable = true;
-      enableGitAnnex = true;
-      dataDir = "${gitDir}";
-      user = "git";
-      group = "git";
-      extraGitoliteRc = ''
-        $RC{SITE_INFO} = 'a computer is a bicycle for the mind.';
-        $RC{GIT_CONFIG_KEYS} = 'gitweb\.(owner|description|category)';
-      '';
-      adminPubkey = "${benKey}";
-    };
-    lighttpd = {
-      enable = true;
-      port = 8000;
-      document-root = "/srv/www";
-      mod_userdir = true;
-      mod_status = true;
-      collectd = {
-        enable = true;
-      };
-      cgit = {
-        # disable cgit for now; the ssh interface still works anyway.
-        enable = false;
-        subdir = "git";
-        configText = ''
-          cache-size=0
-          clone-url=git@simatime.com:$CGIT_REPO_URL
-          enable-index-owner=1
-          enable-http-clone=0
-          enable-index-links=1
-          enable-commit-graph=1
-          enable-log-filecount=1
-          enable-log-linecount=1
-          enable-git-config=1
-          remove-suffix=1
-          branch-sort=age
-          max-stats=week
-          mimetype.gif=image/gif
-          mimetype.html=text/html
-          mimetype.jpg=image/jpeg
-          mimetype.jpeg=image/jpeg
-          mimetype.pdf=application/pdf
-          mimetype.png=image/png
-          mimetype.svg=image/svg+xml
-          about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh
-          source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
-          readme=:README.md
-          root-title=simatime git repository
-          root-desc=a computer is a bicycle for the mind.
-          project-list=${gitDir}/projects.list
-          scan-path=${gitDir}/repositories
-        '';
-      };
-    };
-
-    ibb = {
-      enable = true;
-      port = ibbPort;
-    };
-
-    fathom = {
-      enable = true;
-      port = fathomPort;
-      dataDir = "/var/lib/fathom";
-    };
-
-    nginx = {
-      enable = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      virtualHosts = {
-        # "bsima.me".locations."/".proxyPass = "http://localhost:8000/~ben";
-        "simatime.com".locations."/".proxyPass = "http://localhost:8000";
-        "web.simatime.com".locations."/".proxyPass = "http://${bensIp}:8000";
-        "dev.simatime.com".locations."/".proxyPass = "http://${bensIp}:${ibbPort}";
-        "hero.simatime.com".locations."/".proxyPass = "http://${bensIp}:3001";
-        "tv.simatime.com".locations."/".proxyPass = "http://${bensIp}:8096"; # emby runs on port 8096
-
-        "notebook.simatime.com".locations = {
-          "/" = {
-            proxyPass = "http://${bensIp}:3099";
-            proxyWebsockets = true;
-            extraConfig = ''
-              proxy_buffering off;
-              proxy_read_timeout 86400;
-
-            '';
-          };
-          "/(api/kernels/[^/]+/channels|terminals/websocket)/" = {
-            proxyPass = "http://${bensIp}:3099";
-            proxyWebsockets = true;
-          };
-        };
-        "stats.simatime.com" = {
-          locations."/".proxyPass = "http://localhost:${fathomPort}";
-          forceSSL = true;
-          enableACME = true;
-        };
-        "influencedbybooks.com" = {
-          forceSSL = true;
-          enableACME = true;
-          locations = {
-            "/" = {
-              proxyPass = "http://localhost:${ibbPort}";
-            };
-          };
-        };
-      };
-    };
-
-    znc = {
-      enable = true;
-      mutable = true;
-      useLegacyConfig = false;
-      openFirewall = true;
-      config = {
-        LoadModule = [ "adminlog" "fail2ban" ];
-        User.bsima = {
-          Admin = true;
-          Nick = "bsima";
-          AltNick = "bsima1";
-          LoadModule = [ "chansaver" "controlpanel" ];
-          Network.freenode = { Server = "chat.freenode.net +6697";
-            LoadModule = [ "simple_away" "nickserv" ];
-            Chan = {
-              "#ai"           = {};
-              "#bsima"        = {};
-              "#emacs"        = {};
-              "#haskell"      = {};
-              "#haskell-miso" = {};
-              "#home-manager" = {};
-              "#nixos"        = {};
-              "#servant"      = {};
-              "#sr.ht"        = {};
-              "#xmonad"       = {};
-            };
-          };
-          Pass.password = {
-            Method = "sha256";
-            Hash = "4a6703074c713a26d56a906fc9ea82bb591177f10a25a650719266bf588d9525";
-            Salt = "QByO-A:4Rbib;dl_3wEH";
-          };
-        };
-      };
-    };
-  };
-
-  mailserver = {
-    enable = true;
-    monitoring = {
-      enable = true;
-      alertAddress = "ben@bsima.me";
-    };
-    fqdn = "mail.simatime.com";
-    domains = [ "simatime.com" ];
-    certificateScheme = 3; # let's encrypt
-    enableImap = true;
-    enablePop3 = true;
-    enableImapSsl = true;
-    enablePop3Ssl = true;
-    enableManageSieve = true;
-    virusScanning = false; # ur on ur own
-
-    loginAccounts = {
-      "ben@simatime.com" = {
-        hashedPassword = "$6$Xr180W0PqprtaFB0$9S/Ug1Yz11CaWO7UdVJxQLZWfRUE3/rarB0driXkXALugEeQDLIjG2STGQBLU23//JtK3Mz8Kwsvg1/Zo0vD2/";
-        aliases = [
-          # admin stuff
-          "postmaster@simatime.com"
-          "abuse@simatime.com"
-        ];
-        catchAll = [ "simatime.com" ];
-        quota = "1G";
-      };
-      "nick@simatime.com" = {
-        hashedPassword = "$6$31P/Mg8k8Pezy1e$Fn1tDyssf.1EgxmLYFsQpSq6RP4wbEvP/UlBlXQhyKA9FnmFtJteXsbJM1naa8Kyylo8vZM9zmeoSthHS1slA1";
-        aliases = [
-          "nicolai@simatime.com"
-        ];
-        quota = "1G";
-      };
-    };
-  };
-
-  virtualisation = {
-    libvirtd.enable = true;
-    docker.enable = true;
-    virtualbox.guest.enable = true;
-    virtualbox.host.enable = true;
-    virtualbox.host.headless = false;
-    virtualbox.host.addNetworkInterface = true;
-
-  };
-
-  boot.cleanTmpDir = true;
-  networking.hostName = "simatime";
-  networking.firewall.allowPing = true;
-  services.openssh.enable = true;
-  users.users.root.openssh.authorizedKeys.keys = [ benKey ];
-}
diff --git a/depo/nutin-madaj/default.nix b/depo/nutin-madaj/default.nix
index fa95947..ffb2909 100644
--- a/depo/nutin-madaj/default.nix
+++ b/depo/nutin-madaj/default.nix
@@ -1,9 +1,24 @@
+/*
+
+nutin-madaj - cloud infrastructure server.
+
+This serves the git repo, mailserver, znc bouncer, user sites, and so on.
+
+Currently also used as a catch-all production/staging server, until I get real
+stuff deployed.
+
+*/
+
 let
   nixpkgs = builtins.fetchTarball (import ../../pack/nixpkgs.nix);
   nixos-mailserver = builtins.fetchTarball {
     url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/v2.2.1/nixos-mailserver-v2.2.1.tar.gz";
     sha256 = "03d49v8qnid9g9rha0wg2z6vic06mhp0b049s3whccn1axvs2zzx";
   };
+  benKey =  "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCiNB0iF9ClawNEizBtdYucqp1tAXXRbqvlPS6PFRrtiwSl+SJD29BCLgA5rLxcmFhBHZ/iId/En7GPFEzI/gMu071J7pUI4OcW0UVZju3GNc6ZEz/a6AD2u79JiXEDHfPEdmMqAe36kkaK0KJWSQP3xsFRwJ+8F8HHbSwoCLL+GJhBgAWHQLGfKesNrDacNljNDU3CgkEnDmu8QKuSzH2k1vrr69q2u2iMSAdiStDBAWEjN5nCVrm2XB2vmFLMtXpX2n8JI+znOGzRRDc8dNXejQeDMZGyV6jfVidEIX7vdgSydGjTRKcCLVAsKY3z0gYBZ8u8EUNujgcFBnnAvytj ben@neb";
+  ibbPort = "3000";
+  fathomPort = "3030";
+
 in
 import "${nixpkgs}/nixos" {
   system = "x86_64-linux";
@@ -12,15 +27,69 @@ import "${nixpkgs}/nixos" {
       ./hardware-configuration.nix
       ./networking.nix
 
-      # end config
-      ./configuration.nix
+      # configured modules
+      ./git.nix
+      ./mail.nix
+      ./web.nix
+      ./znc.nix
 
-      # our modules
+      # our custom modules
       ../../mode/ibb.nix
       ../../mode/fathom.nix
 
       # third party
       nixos-mailserver
     ];
+
+    nixpkgs.config.allowUnfree = true;
+    nixpkgs.overlays = [
+      (import ../../pack/overlay.nix)
+    ];
+
+    networking.firewall.allowedTCPPorts = [ 22 80 443 ];
+
+    virtualisation = {
+      libvirtd.enable = true;
+      docker.enable = true;
+      virtualbox.guest.enable = true;
+      virtualbox.host.enable = true;
+      virtualbox.host.headless = false;
+      virtualbox.host.addNetworkInterface = true;
+    };
+
+    # our custom apps
+    services = {
+      ibb = {
+        enable = true;
+        port = ibbPort;
+      };
+      # TODO: move this nginx config into mode/ibb.nix
+      nginx.virtualHosts."influencedbybooks.com" = {
+        forceSSL = true;
+        enableACME = true;
+        locations = {
+          "/" = {
+            proxyPass = "http://localhost:${ibbPort}";
+          };
+        };
+      };
+
+      fathom = {
+        enable = true;
+        port = fathomPort;
+        dataDir = "/var/lib/fathom";
+      };
+      nginx.virtualHosts."stats.simatime.com" = {
+        locations."/".proxyPass = "http://localhost:${fathomPort}";
+        forceSSL = true;
+        enableACME = true;
+      };
+    };
+
+    boot.cleanTmpDir = true;
+    networking.hostName = "simatime";
+    networking.firewall.allowPing = true;
+    services.openssh.enable = true;
+    users.users.root.openssh.authorizedKeys.keys = [ benKey ];
   };
 }
diff --git a/depo/nutin-madaj/git.nix b/depo/nutin-madaj/git.nix
new file mode 100644
index 0000000..ef86d52
--- /dev/null
+++ b/depo/nutin-madaj/git.nix
@@ -0,0 +1,65 @@
+{ pkgs, ... }:
+
+let
+  benKey =  "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCiNB0iF9ClawNEizBtdYucqp1tAXXRbqvlPS6PFRrtiwSl+SJD29BCLgA5rLxcmFhBHZ/iId/En7GPFEzI/gMu071J7pUI4OcW0UVZju3GNc6ZEz/a6AD2u79JiXEDHfPEdmMqAe36kkaK0KJWSQP3xsFRwJ+8F8HHbSwoCLL+GJhBgAWHQLGfKesNrDacNljNDU3CgkEnDmu8QKuSzH2k1vrr69q2u2iMSAdiStDBAWEjN5nCVrm2XB2vmFLMtXpX2n8JI+znOGzRRDc8dNXejQeDMZGyV6jfVidEIX7vdgSydGjTRKcCLVAsKY3z0gYBZ8u8EUNujgcFBnnAvytj ben@neb";
+  gitDir = "/srv/git";
+in
+{
+  services = {
+    gitolite = {
+      enable = true;
+      enableGitAnnex = true;
+      dataDir = "${gitDir}";
+      user = "git";
+      group = "git";
+      extraGitoliteRc = ''
+        $RC{SITE_INFO} = 'a computer is a bicycle for the mind.';
+        $RC{GIT_CONFIG_KEYS} = 'gitweb\.(owner|description|category)';
+      '';
+      adminPubkey = "${benKey}";
+    };
+    lighttpd = {
+      enable = true;
+      port = 8000;
+      document-root = "/srv/www";
+      mod_userdir = true;
+      mod_status = true;
+      collectd = {
+        enable = true;
+      };
+      cgit = {
+        # disable cgit for now; the ssh interface still works anyway.
+        enable = false;
+        subdir = "git";
+        configText = ''
+          cache-size=0
+          clone-url=git@simatime.com:$CGIT_REPO_URL
+          enable-index-owner=1
+          enable-http-clone=0
+          enable-index-links=1
+          enable-commit-graph=1
+          enable-log-filecount=1
+          enable-log-linecount=1
+          enable-git-config=1
+          remove-suffix=1
+          branch-sort=age
+          max-stats=week
+          mimetype.gif=image/gif
+          mimetype.html=text/html
+          mimetype.jpg=image/jpeg
+          mimetype.jpeg=image/jpeg
+          mimetype.pdf=application/pdf
+          mimetype.png=image/png
+          mimetype.svg=image/svg+xml
+          about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh
+          source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
+          readme=:README.md
+          root-title=simatime git repository
+          root-desc=a computer is a bicycle for the mind.
+          project-list=${gitDir}/projects.list
+          scan-path=${gitDir}/repositories
+        '';
+      };
+    };
+  };
+}
diff --git a/depo/nutin-madaj/mail.nix b/depo/nutin-madaj/mail.nix
new file mode 100644
index 0000000..96ad506
--- /dev/null
+++ b/depo/nutin-madaj/mail.nix
@@ -0,0 +1,40 @@
+{ ... }:
+
+{
+  mailserver = {
+    enable = true;
+    monitoring = {
+      enable = true;
+      alertAddress = "ben@bsima.me";
+    };
+    fqdn = "mail.simatime.com";
+    domains = [ "simatime.com" ];
+    certificateScheme = 3; # let's encrypt
+    enableImap = true;
+    enablePop3 = true;
+    enableImapSsl = true;
+    enablePop3Ssl = true;
+    enableManageSieve = true;
+    virusScanning = false; # ur on ur own
+
+    loginAccounts = {
+      "ben@simatime.com" = {
+        hashedPassword = "$6$Xr180W0PqprtaFB0$9S/Ug1Yz11CaWO7UdVJxQLZWfRUE3/rarB0driXkXALugEeQDLIjG2STGQBLU23//JtK3Mz8Kwsvg1/Zo0vD2/";
+        aliases = [
+          # admin stuff
+          "postmaster@simatime.com"
+          "abuse@simatime.com"
+        ];
+        catchAll = [ "simatime.com" ];
+        quota = "1G";
+      };
+      "nick@simatime.com" = {
+        hashedPassword = "$6$31P/Mg8k8Pezy1e$Fn1tDyssf.1EgxmLYFsQpSq6RP4wbEvP/UlBlXQhyKA9FnmFtJteXsbJM1naa8Kyylo8vZM9zmeoSthHS1slA1";
+        aliases = [
+          "nicolai@simatime.com"
+        ];
+        quota = "1G";
+      };
+    };
+  };
+}
diff --git a/depo/nutin-madaj/web.nix b/depo/nutin-madaj/web.nix
new file mode 100644
index 0000000..d14a2c7
--- /dev/null
+++ b/depo/nutin-madaj/web.nix
@@ -0,0 +1,39 @@
+{ ... }:
+
+let
+  bensIp = "68.107.97.20"; # hiddor-kahih
+in
+{
+  services = {
+    nginx = {
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      virtualHosts = {
+        # "bsima.me".locations."/".proxyPass = "http://localhost:8000/~ben";
+        "simatime.com".locations."/".proxyPass = "http://localhost:8000";
+        "web.simatime.com".locations."/".proxyPass = "http://${bensIp}:8000";
+        "hero.simatime.com".locations."/".proxyPass = "http://${bensIp}:3001";
+        "tv.simatime.com".locations."/".proxyPass = "http://${bensIp}:8096"; # emby runs on port 8096
+
+        "notebook.simatime.com".locations = {
+          "/" = {
+            proxyPass = "http://${bensIp}:3099";
+            proxyWebsockets = true;
+            extraConfig = ''
+              proxy_buffering off;
+              proxy_read_timeout 86400;
+
+            '';
+          };
+          "/(api/kernels/[^/]+/channels|terminals/websocket)/" = {
+            proxyPass = "http://${bensIp}:3099";
+            proxyWebsockets = true;
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/depo/nutin-madaj/znc.nix b/depo/nutin-madaj/znc.nix
new file mode 100644
index 0000000..a7623c1
--- /dev/null
+++ b/depo/nutin-madaj/znc.nix
@@ -0,0 +1,41 @@
+{ ... }:
+
+{
+  services = {
+    znc = {
+      enable = true;
+      mutable = true;
+      useLegacyConfig = false;
+      openFirewall = true;
+      config = {
+        LoadModule = [ "adminlog" "fail2ban" ];
+        User.bsima = {
+          Admin = true;
+          Nick = "bsima";
+          AltNick = "bsima1";
+          LoadModule = [ "chansaver" "controlpanel" ];
+          Network.freenode = { Server = "chat.freenode.net +6697";
+            LoadModule = [ "simple_away" "nickserv" ];
+            Chan = {
+              "#ai"           = {};
+              "#bsima"        = {};
+              "#emacs"        = {};
+              "#haskell"      = {};
+              "#haskell-miso" = {};
+              "#home-manager" = {};
+              "#nixos"        = {};
+              "#servant"      = {};
+              "#sr.ht"        = {};
+              "#xmonad"       = {};
+            };
+          };
+          Pass.password = {
+            Method = "sha256";
+            Hash = "4a6703074c713a26d56a906fc9ea82bb591177f10a25a650719266bf588d9525";
+            Salt = "QByO-A:4Rbib;dl_3wEH";
+          };
+        };
+      };
+    };
+  };
+}