# Edit this configuration file to define what should be installed on # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). { config, pkgs, lib, ... }: { imports = [ # Include the results of the hardware scan. ./odin/hw.nix ./users.nix ./custom/uucp.nix ./custom/uucp-mediaserver.nix ./custom/borgbackup.nix ]; # Use the GRUB 2 boot loader. boot.loader.grub.enable = true; boot.loader.grub.version = 2; # Define on which hard drive you want to install Grub. boot.loader.grub.device = "/dev/disk/by-id/ata-MKNSSDCR60GB_MK130619AS1031770"; networking.hostName = "odin"; # Define your hostname. # Select internationalisation properties. i18n = { consoleKeyMap = "dvp"; defaultLocale = "en_US.UTF-8"; }; # Set your time zone. time.timeZone = "Europe/Berlin"; environment.systemPackages = with pkgs; [ pythonPackages.magic-wormhole tmux mosh quota git (callPackage ./utils/nix/rebuild-system.nix {}) samba ntfs3g ]; programs.zsh.enable = true; services.openssh = { enable = true; passwordAuthentication = false; challengeResponseAuthentication = false; extraConfig = '' AllowGroups ssh ''; }; users.groups."ssh" = { members = ["uucp" "root"]; }; networking.firewall = { enable = true; allowPing = true; allowedTCPPorts = [ 22 # ssh 139 445 # samba ]; allowedUDPPorts = [ 137 138 ]; # samba allowedUDPPortRanges = [ { from = 60000; to = 61000; } # mosh ]; }; users.extraUsers.root = let template = import ./users/gkleen.nix; in { inherit (template) shell; openssh.authorizedKeys.keyFiles = template.openssh.authorizedKeys.keyFiles; }; services.journald = { rateLimitBurst = 0; }; services.haveged.enable = true; services.uucp = { enable = true; nodeName = "odin"; remoteNodes = { "ymir" = { publicKeys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGANj+LJ4CI6VrAgBRocKCGq74kZnwD1PdKr/gdlfVr1 uucp@ymir"]; hostnames = ["ymir.yggdrasil.li" "ymir.niflheim.yggdrasil"]; commands = ["rmail"]; }; "hel" = { publicKeys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKD8ycFGfVkBL9wjA5Kc33cl6Qt5K2505G/38oH8Cy/e uucp@hel"]; hostnames = ["hel.asgard.yggdrasil" "hel.midgard.yggdrasil"]; commands = ["rmail"]; }; }; media-server = { enable = true; remoteNodes = [ "hel" ]; }; commandPath = [ "${pkgs.rmail}/bin" ]; }; users.groups."media" = { members = [ "uucp" ]; }; services.postfix = { enable = true; enableSmtp = false; enableSubmission = false; setSendmail = true; networksStyle = "host"; hostname = "odin.asgard.yggdrasil"; recipientDelimiter = "+"; postmasterAlias = "gkleen"; rootAlias = "gkleen"; extraAliases = '' uucp: gkleen ''; destination = [''regexp:${pkgs.writeText "destination" '' /\.?localdomain$/ ACCEPT /^localhost$/ ACCEPT /\.?odin(\.asgard\.yggdrasil)?$/ ACCEPT ''}'']; config = { default_transport = "uucp:ymir"; message_size_limit = "0"; mailbox_size_limit = "0"; mail_spool_directory = "/srv/mail"; luser_relay = ''postmaster''${recipient_delimiter}''${local:unknown}''; }; masterConfig = { uucp = { type = "unix"; private = true; privileged = true; chroot = false; command = "pipe"; args = [ "flags=Fqhu" "user=uucp" ''argv=${config.security.wrapperDir}/uux -z -a $sender - $nexthop!rmail ($recipient)'' ]; }; }; networks = ["127.0.0.0/8" "[::ffff:127.0.0.0]/104" "[::1]/128" "10.141.0.0/16"]; }; services.borgbackup = { snapshots = "lvm"; prefix = "automatic.yggdrasil.asgard.odin."; targets = { "munin" = { repo = "borg.munin:borg"; paths = [ { VG = "raid6"; LV = "mail"; } { VG = "raid6"; LV = "home"; } { VG = "raid6"; LV = "media"; } { VG = "raid6"; LV = "root"; } { VG = "ssd-raid1"; LV = "root"; } ]; prune = lib.genAttrs ["raid6/mail" "raid6/home" "raid6/media" "raid6/root" "ssd-raid1/root"] (name: [ "--keep-within" "24H" "--keep-daily" "31" "--keep-monthly" "12" "--keep-yearly" "-1" ]); }; }; }; services.samba = { enable = true; shares = { homes = { comment = "Home Directories"; browseable = true; "valid users" = "%S"; writable = true; }; }; extraConfig = '' domain master = true workgroup = ASGARD load printers = no printing = bsd printcap name = /dev/null disable spoolss = yes ''; }; system.autoUpgrade.enable = true; system.stateVersion = "18.09"; systemd.services."nixos-upgrade" = { path = with pkgs; [ git ]; preStart = '' git -C /etc/nixos pull --recurse-submodules ''; }; }