liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

arhcive.nix (3601B)

      1 # This is not part of Liminix per se. This is a "scratchpad"
      2 # configuration for a device I'm testing with.
      3 #
      4 # Parts of it do do things that Liminix eventually needs to do, but
      5 # don't look in here for solutions - just for identifying the
      6 # problems.
      7 {
      8   config,
      9   pkgs,
     10   lib,
     11   ...
     12 }:
     13 let
     14   secrets = import ./extneder-secrets.nix;
     15   inherit (pkgs.liminix.services) oneshot longrun target;
     16   inherit (pkgs.pseudofile) dir symlink;
     17   inherit (pkgs) writeText;
     18   svc = config.system.service;
     19 in
     20 rec {
     21   boot = {
     22     tftp = {
     23       serverip = "10.0.0.1";
     24       ipaddr = "10.0.0.8";
     25     };
     26   };
     27 
     28   imports = [
     29     ../modules/wlan.nix
     30     ../modules/network
     31     ../modules/vlan
     32     ../modules/ssh
     33     ../modules/usb.nix
     34     ../modules/watchdog
     35     ../modules/mount
     36     ../modules/dhcp4c
     37   ];
     38   hostname = "arhcive";
     39 
     40   services.dhcpc =
     41     let
     42       iface = config.hardware.networkInterfaces.lan;
     43     in
     44     svc.dhcp4c.client.build {
     45       interface = iface;
     46       dependencies = [ config.services.hostname ];
     47     };
     48 
     49   services.sshd = svc.ssh.build { };
     50 
     51   services.watchdog = svc.watchdog.build {
     52     watched = with config.services; [
     53       sshd
     54       dhcpc
     55     ];
     56   };
     57 
     58   services.resolvconf = oneshot rec {
     59     dependencies = [ services.dhcpc ];
     60     name = "resolvconf";
     61     up = ''
     62       ( in_outputs ${name}
     63       for i in $(output ${services.dhcpc} dns); do
     64         echo "nameserver $i" > resolv.conf
     65       done
     66       )
     67     '';
     68   };
     69   filesystem = dir {
     70     etc = dir {
     71       "resolv.conf" = symlink "${services.resolvconf}/.outputs/resolv.conf";
     72     };
     73     srv = dir { };
     74   };
     75 
     76   services.defaultroute4 = svc.network.route.build {
     77     via = "$(output ${services.dhcpc} router)";
     78     target = "default";
     79     dependencies = [ services.dhcpc ];
     80   };
     81 
     82   programs.busybox = {
     83     applets = [
     84       "lsusb"
     85       "tar"
     86     ];
     87     options = {
     88       FEATURE_LS_TIMESTAMPS = "y";
     89       FEATURE_LS_SORTFILES = "y";
     90       FEATURE_VOLUMEID_EXT = "y";
     91     };
     92   };
     93 
     94   services.mount_external_disk = svc.mount.build {
     95     partlabel = "backup-disk";
     96     mountpoint = "/srv";
     97     fstype = "ext4";
     98   };
     99 
    100   services.rsync =
    101     let
    102       secrets_file = oneshot rec {
    103         name = "rsync-secrets";
    104         up = ''
    105           (in_outputs ${name}
    106            echo  "backup:${secrets.rsync_secret}" > secrets)
    107         '';
    108         down = "true";
    109       };
    110       configFile = writeText "rsync.conf" ''
    111         pid file = /run/rsyncd.pid
    112         uid = backup
    113         [srv]
    114           path = /srv
    115           use chroot = yes
    116           auth users = backup
    117           read only = false
    118           gid = backup
    119           secrets file = ${secrets_file}/.outputs/secrets
    120       '';
    121     in
    122     longrun {
    123       name = "rsync";
    124       run = ''
    125         ${pkgs.rsyncSmall}/bin/rsync --no-detach --daemon  --config=${configFile}
    126       '';
    127       dependencies = [
    128         secrets_file
    129         services.mount_external_disk
    130         config.hardware.networkInterfaces.lan
    131       ];
    132     };
    133 
    134   users.root = {
    135     passwd = lib.mkForce secrets.root.passwd;
    136     openssh.authorizedKeys.keys = secrets.root.keys;
    137   };
    138 
    139   users.backup = {
    140     uid = 500;
    141     gid = 500;
    142     gecos = "Storage owner";
    143     dir = "/srv";
    144     shell = "/dev/null";
    145   };
    146   groups.backup = {
    147     gid = 500;
    148     usernames = [ "backup" ];
    149   };
    150 
    151   defaultProfile.packages = with pkgs; [
    152     e2fsprogs
    153     mtdutils
    154     (levitate.override {
    155       config = {
    156         services = {
    157           inherit (config.services) dhcpc sshd watchdog;
    158         };
    159         defaultProfile.packages = [ mtdutils ];
    160         users.root.openssh.authorizedKeys.keys = secrets.root.keys;
    161       };
    162     })
    163   ];
    164 }