liminix

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README | LICENSE

arhcive.nix (3596B)

      1 # This is not part of Liminix per se. This is a "scratchpad"
      2 # configuration for a device I'm testing with.
      3 #
      4 # Parts of it do do things that Liminix eventually needs to do, but
      5 # don't look in here for solutions - just for identifying the
      6 # problems.
      7 {
      8   config,
      9   pkgs,
     10   lib,
     11   ...
     12 }:
     13 let
     14   secrets = import ./extneder-secrets.nix;
     15   inherit (pkgs.liminix.services) oneshot longrun target;
     16   inherit (pkgs.pseudofile) dir symlink;
     17   inherit (pkgs) writeText serviceFns;
     18   svc = config.system.service;
     19 in
     20 rec {
     21   boot = {
     22     tftp = {
     23       serverip = "10.0.0.1";
     24       ipaddr = "10.0.0.8";
     25     };
     26   };
     27 
     28   imports = [
     29     ../modules/wlan.nix
     30     ../modules/network
     31     ../modules/vlan
     32     ../modules/ssh
     33     ../modules/usb.nix
     34     ../modules/watchdog
     35     ../modules/mount
     36   ];
     37   hostname = "arhcive";
     38 
     39   services.dhcpc =
     40     let
     41       iface = config.hardware.networkInterfaces.lan;
     42     in
     43     svc.network.dhcp.client.build {
     44       interface = iface;
     45       dependencies = [ config.services.hostname ];
     46     };
     47 
     48   services.sshd = svc.ssh.build { };
     49 
     50   services.watchdog = svc.watchdog.build {
     51     watched = with config.services; [
     52       sshd
     53       dhcpc
     54     ];
     55   };
     56 
     57   services.resolvconf = oneshot rec {
     58     dependencies = [ services.dhcpc ];
     59     name = "resolvconf";
     60     up = ''
     61       ( in_outputs ${name}
     62       for i in $(output ${services.dhcpc} dns); do
     63         echo "nameserver $i" > resolv.conf
     64       done
     65       )
     66     '';
     67   };
     68   filesystem = dir {
     69     etc = dir {
     70       "resolv.conf" = symlink "${services.resolvconf}/.outputs/resolv.conf";
     71     };
     72     srv = dir { };
     73   };
     74 
     75   services.defaultroute4 = svc.network.route.build {
     76     via = "$(output ${services.dhcpc} router)";
     77     target = "default";
     78     dependencies = [ services.dhcpc ];
     79   };
     80 
     81   programs.busybox = {
     82     applets = [
     83       "lsusb"
     84       "tar"
     85     ];
     86     options = {
     87       FEATURE_LS_TIMESTAMPS = "y";
     88       FEATURE_LS_SORTFILES = "y";
     89       FEATURE_VOLUMEID_EXT = "y";
     90     };
     91   };
     92 
     93   services.mount_external_disk = svc.mount.build {
     94     partlabel = "backup-disk";
     95     mountpoint = "/srv";
     96     fstype = "ext4";
     97   };
     98 
     99   services.rsync =
    100     let
    101       secrets_file = oneshot rec {
    102         name = "rsync-secrets";
    103         up = ''
    104           (in_outputs ${name}
    105            echo  "backup:${secrets.rsync_secret}" > secrets)
    106         '';
    107         down = "true";
    108       };
    109       configFile = writeText "rsync.conf" ''
    110         pid file = /run/rsyncd.pid
    111         uid = backup
    112         [srv]
    113           path = /srv
    114           use chroot = yes
    115           auth users = backup
    116           read only = false
    117           gid = backup
    118           secrets file = ${secrets_file}/.outputs/secrets
    119       '';
    120     in
    121     longrun {
    122       name = "rsync";
    123       run = ''
    124         ${pkgs.rsyncSmall}/bin/rsync --no-detach --daemon  --config=${configFile}
    125       '';
    126       dependencies = [
    127         secrets_file
    128         services.mount_external_disk
    129         config.hardware.networkInterfaces.lan
    130       ];
    131     };
    132 
    133   users.root = {
    134     passwd = lib.mkForce secrets.root.passwd;
    135     openssh.authorizedKeys.keys = secrets.root.keys;
    136   };
    137 
    138   users.backup = {
    139     uid = 500;
    140     gid = 500;
    141     gecos = "Storage owner";
    142     dir = "/srv";
    143     shell = "/dev/null";
    144   };
    145   groups.backup = {
    146     gid = 500;
    147     usernames = [ "backup" ];
    148   };
    149 
    150   defaultProfile.packages = with pkgs; [
    151     e2fsprogs
    152     mtdutils
    153     (levitate.override {
    154       config = {
    155         services = {
    156           inherit (config.services) dhcpc sshd watchdog;
    157         };
    158         defaultProfile.packages = [ mtdutils ];
    159         users.root.openssh.authorizedKeys.keys = secrets.root.keys;
    160       };
    161     })
    162   ];
    163 }