liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

arhcive.nix (3909B)

      1 # This is not part of Liminix per se. This is a "scratchpad"
      2 # configuration for a device I'm testing with.
      3 #
      4 # Parts of it do do things that Liminix eventually needs to do, but
      5 # don't look in here for solutions - just for identifying the
      6 # problems.
      7 {
      8   config,
      9   pkgs,
     10   lib,
     11   ...
     12 }: let
     13   secrets = import ./extneder-secrets.nix;
     14   inherit (pkgs.liminix.services) oneshot longrun bundle target;
     15   inherit (pkgs.pseudofile) dir symlink;
     16   inherit (pkgs) writeText dropbear ifwait serviceFns;
     17   svc = config.system.service;
     18 in rec {
     19   boot = {
     20     tftp = {
     21       serverip = "192.168.8.148";
     22       ipaddr = "192.168.8.251";
     23     };
     24   };
     25 
     26   imports = [
     27     ../modules/wlan.nix
     28     ../modules/network
     29     ../modules/vlan
     30     ../modules/ssh
     31     ../modules/watchdog
     32     ../modules/mount
     33   ];
     34   hostname = "arhcive";
     35 
     36   kernel = {
     37     config = {
     38       USB = "y";
     39       USB_EHCI_HCD = "y";
     40       USB_EHCI_HCD_PLATFORM = "y";
     41       USB_OHCI_HCD = "y";
     42       USB_OHCI_HCD_PLATFORM = "y";
     43       USB_SUPPORT = "y";
     44       USB_COMMON = "y";
     45       USB_STORAGE = "y";
     46       USB_STORAGE_DEBUG = "n";
     47       USB_UAS = "y";
     48       USB_ANNOUNCE_NEW_DEVICES = "y";
     49       SCSI = "y";
     50       BLK_DEV_SD = "y";
     51       USB_PRINTER = "y";
     52       MSDOS_PARTITION = "y";
     53       EFI_PARTITION = "y";
     54       EXT4_FS = "y";
     55       EXT4_USE_FOR_EXT2 = "y";
     56       FS_ENCRYPTION = "y";
     57     };
     58   };
     59 
     60   services.dhcpc =
     61     let iface = config.hardware.networkInterfaces.lan;
     62     in svc.network.dhcp.client.build {
     63       interface = iface;
     64       dependencies = [ config.services.hostname ];
     65     };
     66 
     67   services.sshd = svc.ssh.build { };
     68 
     69   services.watchdog = svc.watchdog.build {
     70     watched = with config.services ; [ sshd dhcpc ];
     71   };
     72 
     73   services.resolvconf = oneshot rec {
     74     dependencies = [ services.dhcpc ];
     75     name = "resolvconf";
     76     up = ''
     77       . ${serviceFns}
     78       ( in_outputs ${name}
     79       for i in $(output ${services.dhcpc} dns); do
     80         echo "nameserver $i" > resolv.conf
     81       done
     82       )
     83     '';
     84   };
     85   filesystem = dir {
     86     etc = dir {
     87       "resolv.conf" = symlink "${services.resolvconf}/.outputs/resolv.conf";
     88     };
     89     srv = dir {};
     90   };
     91 
     92   services.defaultroute4 = svc.network.route.build {
     93     via = "$(output ${services.dhcpc} router)";
     94     target = "default";
     95     dependencies = [services.dhcpc];
     96   };
     97 
     98   programs.busybox  = {
     99     applets = ["lsusb" "tar"];
    100     options = {
    101       FEATURE_LS_TIMESTAMPS = "y";
    102       FEATURE_LS_SORTFILES = "y";
    103       FEATURE_VOLUMEID_EXT = "y";
    104     };
    105   };
    106 
    107   services.mount_external_disk = svc.mount.build {
    108     device = "LABEL=backup-disk";
    109     mountpoint = "/srv";
    110     fstype = "ext4";
    111   };
    112 
    113   services.rsync =
    114     let
    115       secrets_file = oneshot rec {
    116         name = "rsync-secrets";
    117         up = ''
    118           . ${serviceFns}
    119           (in_outputs ${name}
    120            echo  "backup:${secrets.rsync_secret}" > secrets)
    121         '';
    122         down = "true";
    123       };
    124       configFile = writeText "rsync.conf" ''
    125         pid file = /run/rsyncd.pid
    126         uid = backup
    127         [srv]
    128           path = /srv
    129           use chroot = yes
    130           auth users = backup
    131           read only = false
    132           gid = backup
    133           secrets file = ${secrets_file}/.outputs/secrets
    134       '';
    135     in longrun {
    136       name = "rsync";
    137       run = ''
    138         ${pkgs.rsyncSmall}/bin/rsync --no-detach --daemon  --config=${configFile}
    139       '';
    140       dependencies = [
    141         secrets_file
    142         services.mount_external_disk
    143         config.hardware.networkInterfaces.lan
    144       ] ;
    145     };
    146 
    147   users.root = {
    148     passwd = lib.mkForce secrets.root_password;
    149     # openssh.authorizedKeys.keys = [
    150     #   (builtins.readFile "/home/dan/.ssh/id_rsa.pub")
    151     # ];
    152   };
    153 
    154   users.backup = {
    155     uid=500; gid=500; gecos="Storage owner"; dir="/srv";
    156     shell="/dev/null";
    157   };
    158   groups.backup = {
    159     gid=500; usernames = ["backup"];
    160   };
    161 
    162   defaultProfile.packages = with pkgs; [e2fsprogs strace tcpdump ];
    163 }