mirror of
https://github.com/gensokyo-zone/infrastructure.git
synced 2026-02-09 12:29:19 -08:00
chore: nf-fmt-nix
This commit is contained in:
arcnmx
parent
7486517713
commit
9903866044
160 changed files with 4570 additions and 3019 deletions
2
modules/extern/nixos/access.nix
vendored
2
modules/extern/nixos/access.nix
vendored
|
|
@ -35,7 +35,7 @@ in {
|
|||
nixosConfig = config;
|
||||
};
|
||||
};
|
||||
default = { };
|
||||
default = {};
|
||||
};
|
||||
|
||||
config = {
|
||||
|
|
|
|||
62
modules/extern/nixos/dns.nix
vendored
62
modules/extern/nixos/dns.nix
vendored
|
|
@ -42,7 +42,7 @@
|
|||
type = listOf str;
|
||||
};
|
||||
fallback = mkOption {
|
||||
type = nullOr (enum [ "cloudflare" "google" ]);
|
||||
type = nullOr (enum ["cloudflare" "google"]);
|
||||
default = "cloudflare";
|
||||
};
|
||||
fallbackNameservers = mkOption {
|
||||
|
|
@ -67,32 +67,38 @@
|
|||
];
|
||||
nameservers = let
|
||||
inherit (gensokyo-zone.systems) utsuho hakurei;
|
||||
in mkMerge [
|
||||
(mkOptionDefault [ ])
|
||||
(mkIf access.local.enable [
|
||||
(mkIf enableIPv6 utsuho.config.access.address6ForNetwork.local)
|
||||
utsuho.config.access.address4ForNetwork.local
|
||||
])
|
||||
# TODO: mirror or tunnel on hakurei or something .-.
|
||||
(mkIf (access.tail.enabled && false) [
|
||||
(mkIf enableIPv6 hakurei.config.access.address6ForNetwork.tail)
|
||||
hakurei.config.access.address4ForNetwork.tail
|
||||
])
|
||||
];
|
||||
fallbackNameservers = mkOptionDefault {
|
||||
cloudflare = [
|
||||
"1.1.1.1#cloudflare-dns.com"
|
||||
"1.0.0.1#cloudflare-dns.com"
|
||||
in
|
||||
mkMerge [
|
||||
(mkOptionDefault [])
|
||||
(mkIf access.local.enable [
|
||||
(mkIf enableIPv6 utsuho.config.access.address6ForNetwork.local)
|
||||
utsuho.config.access.address4ForNetwork.local
|
||||
])
|
||||
# TODO: mirror or tunnel on hakurei or something .-.
|
||||
(mkIf (access.tail.enabled && false) [
|
||||
(mkIf enableIPv6 hakurei.config.access.address6ForNetwork.tail)
|
||||
hakurei.config.access.address4ForNetwork.tail
|
||||
])
|
||||
];
|
||||
google = optionals enableIPv6 [
|
||||
"[2001:4860:4860::8888]#dns.google"
|
||||
"[2001:4860:4860::8844]#dns.google"
|
||||
] ++ [
|
||||
"8.8.8.8#dns.google"
|
||||
"8.8.4.4#dns.google"
|
||||
];
|
||||
${toString null} = [ ];
|
||||
}.${toString config.fallback};
|
||||
fallbackNameservers =
|
||||
mkOptionDefault
|
||||
{
|
||||
cloudflare = [
|
||||
"1.1.1.1#cloudflare-dns.com"
|
||||
"1.0.0.1#cloudflare-dns.com"
|
||||
];
|
||||
google =
|
||||
optionals enableIPv6 [
|
||||
"[2001:4860:4860::8888]#dns.google"
|
||||
"[2001:4860:4860::8844]#dns.google"
|
||||
]
|
||||
++ [
|
||||
"8.8.8.8#dns.google"
|
||||
"8.8.4.4#dns.google"
|
||||
];
|
||||
${toString null} = [];
|
||||
}
|
||||
.${toString config.fallback};
|
||||
set = {
|
||||
nssSettings = {
|
||||
hosts = mkMerge [
|
||||
|
|
@ -123,11 +129,11 @@ in {
|
|||
nixosConfig = config;
|
||||
};
|
||||
};
|
||||
default = { };
|
||||
default = {};
|
||||
};
|
||||
|
||||
config = {
|
||||
networking.nameservers = mkIf (cfg.enable && cfg.nameservers != [ ]) (mkMerge [
|
||||
networking.nameservers = mkIf (cfg.enable && cfg.nameservers != []) (mkMerge [
|
||||
(mkBefore cfg.nameservers)
|
||||
cfg.fallbackNameservers
|
||||
]);
|
||||
|
|
|
|||
217
modules/extern/nixos/krb5.nix
vendored
217
modules/extern/nixos/krb5.nix
vendored
|
|
@ -40,9 +40,11 @@
|
|||
default = toUpper config.domain;
|
||||
};
|
||||
ca = {
|
||||
trust = mkEnableOption "trust CA" // {
|
||||
default = true;
|
||||
};
|
||||
trust =
|
||||
mkEnableOption "trust CA"
|
||||
// {
|
||||
default = true;
|
||||
};
|
||||
pem = mkOption {
|
||||
type = path;
|
||||
};
|
||||
|
|
@ -59,7 +61,7 @@
|
|||
};
|
||||
urls = mkOption {
|
||||
type = listOf str;
|
||||
default = [ "ldaps://${config.ldap.host}" ];
|
||||
default = ["ldaps://${config.ldap.host}"];
|
||||
};
|
||||
baseDn = mkOption {
|
||||
type = str;
|
||||
|
|
@ -75,21 +77,21 @@
|
|||
};
|
||||
passwordFileKrb5 = mkOption {
|
||||
type = path;
|
||||
example = lib.literalExpression "\${pkgs.writeText "ldap.kdb5" ''
|
||||
example = lib.literalExpression "\${pkgs.writeText " ldap.kdb5 " ''
|
||||
${config.bind.dn}#{HEX}616e6f6e796d6f7573
|
||||
''}";
|
||||
};
|
||||
passwordFileSssdEnv = mkOption {
|
||||
type = path;
|
||||
example = lib.literalExpression "\${pkgs.writeText "ldap.kdb5" ''
|
||||
${"SSSD_AUTHTOK_" + replaceStrings [ "." ] [ "_" ] (toUpper config.domain)}=verysecretpassword
|
||||
example = lib.literalExpression "\${pkgs.writeText " ldap.kdb5 " ''
|
||||
${"SSSD_AUTHTOK_" + replaceStrings ["."] ["_"] (toUpper config.domain)}=verysecretpassword
|
||||
''}";
|
||||
};
|
||||
};
|
||||
};
|
||||
db = {
|
||||
backend = mkOption {
|
||||
type = enum [ "kldap" "ipa" ];
|
||||
type = enum ["kldap" "ipa"];
|
||||
default = "kldap";
|
||||
};
|
||||
};
|
||||
|
|
@ -99,7 +101,7 @@
|
|||
};
|
||||
authToLocalNames = mkOption {
|
||||
type = attrsOf str;
|
||||
default = { };
|
||||
default = {};
|
||||
example = {
|
||||
"arc@${config.realm}" = "arc";
|
||||
};
|
||||
|
|
@ -108,26 +110,30 @@
|
|||
enable = mkEnableOption "sssd";
|
||||
pam.enable = mkEnableOption "PAM";
|
||||
backend = mkOption {
|
||||
type = enum [ "ipa" "ldap" ];
|
||||
default = {
|
||||
ipa = "ipa";
|
||||
kldap = "ldap";
|
||||
}.${config.db.backend};
|
||||
type = enum ["ipa" "ldap"];
|
||||
default =
|
||||
{
|
||||
ipa = "ipa";
|
||||
kldap = "ldap";
|
||||
}
|
||||
.${config.db.backend};
|
||||
};
|
||||
};
|
||||
ntp = {
|
||||
enable = mkEnableOption "ntp" // {
|
||||
default = true;
|
||||
};
|
||||
enable =
|
||||
mkEnableOption "ntp"
|
||||
// {
|
||||
default = true;
|
||||
};
|
||||
servers = mkOption {
|
||||
type = listOf str;
|
||||
example = [ config.ipa.host ];
|
||||
default = [ "2.fedora.pool.ntp.org" ];
|
||||
example = [config.ipa.host];
|
||||
default = ["2.fedora.pool.ntp.org"];
|
||||
};
|
||||
};
|
||||
nfs = {
|
||||
enable = mkEnableOption "nfs";
|
||||
package = mkPackageOption pkgs "nfs-utils" { };
|
||||
package = mkPackageOption pkgs "nfs-utils" {};
|
||||
idmapd = {
|
||||
localDomain = mkOption {
|
||||
type = bool;
|
||||
|
|
@ -135,11 +141,11 @@
|
|||
};
|
||||
localRealms = mkOption {
|
||||
type = listOf str;
|
||||
default = [ config.realm ];
|
||||
default = [config.realm];
|
||||
};
|
||||
methods = mkOption {
|
||||
type = listOf str;
|
||||
default = [ "nsswitch" ];
|
||||
default = ["nsswitch"];
|
||||
};
|
||||
authToLocalNames = mkOption {
|
||||
type = attrsOf str;
|
||||
|
|
@ -185,7 +191,8 @@
|
|||
url = "https://${config.ipa.httpHost}/ipa/config/ca.crt";
|
||||
sha256 = "sha256-PKjnjn1jIq9x4BX8+WGkZfj4HQtmnHqmFSALqggo91o=";
|
||||
};
|
||||
in mkOptionDefault caPem;
|
||||
in
|
||||
mkOptionDefault caPem;
|
||||
ldap = {
|
||||
urls = mkMerge [
|
||||
(mkIf access.local.enable (mkOptionDefault (mkBefore [
|
||||
|
|
@ -200,22 +207,23 @@
|
|||
];
|
||||
bind = let
|
||||
inherit (nixosConfig.sops) secrets;
|
||||
in mkIf (nixosOptions ? sops.secrets && secrets ? gensokyo-zone-krb5-passwords) {
|
||||
passwordFileKrb5 = mkOptionDefault nixosConfig.sops.secrets.gensokyo-zone-krb5-passwords.path;
|
||||
passwordFile = mkOptionDefault nixosConfig.sops.secrets.gensokyo-zone-krb5-peep-password.path;
|
||||
passwordFileSssdEnv = mkOptionDefault nixosConfig.sops.secrets.gensokyo-zone-sssd-passwords.path;
|
||||
};
|
||||
in
|
||||
mkIf (nixosOptions ? sops.secrets && secrets ? gensokyo-zone-krb5-passwords) {
|
||||
passwordFileKrb5 = mkOptionDefault nixosConfig.sops.secrets.gensokyo-zone-krb5-passwords.path;
|
||||
passwordFile = mkOptionDefault nixosConfig.sops.secrets.gensokyo-zone-krb5-peep-password.path;
|
||||
passwordFileSssdEnv = mkOptionDefault nixosConfig.sops.secrets.gensokyo-zone-sssd-passwords.path;
|
||||
};
|
||||
};
|
||||
db.backend = mkIf enabled.ipa (mkAlmostOptionDefault "ipa");
|
||||
nfs = {
|
||||
package = mkIf (elem "umich_ldap" config.nfs.idmapd.methods) (mkAlmostOptionDefault pkgs.nfs-utils-ldap);
|
||||
idmapd = {
|
||||
methods = mkMerge [
|
||||
(mkIf (config.nfs.idmapd.authToLocalNames != { }) (
|
||||
mkOptionDefault (mkBefore [ "static" ])
|
||||
(mkIf (config.nfs.idmapd.authToLocalNames != {}) (
|
||||
mkOptionDefault (mkBefore ["static"])
|
||||
))
|
||||
(mkIf (!enabled.sssd) (
|
||||
mkOptionDefault [ "umich_ldap" ]
|
||||
mkOptionDefault ["umich_ldap"]
|
||||
))
|
||||
];
|
||||
};
|
||||
|
|
@ -243,55 +251,63 @@
|
|||
};
|
||||
};
|
||||
sssdSettings = let
|
||||
servers = optional access.local.enable "idp.local.${config.domain}"
|
||||
++ [ "_srv" ];
|
||||
servers =
|
||||
optional access.local.enable "idp.local.${config.domain}"
|
||||
++ ["_srv"];
|
||||
backups = mkMerge [
|
||||
(mkIf access.tail.enabled (mkAlmostOptionDefault [ "ipa.tail.${config.domain}" ]))
|
||||
(mkIf access.local.enable (mkAlmostOptionDefault [ "ipa.local.${config.domain}" ]))
|
||||
(mkIf access.tail.enabled (mkAlmostOptionDefault ["ipa.tail.${config.domain}"]))
|
||||
(mkIf access.local.enable (mkAlmostOptionDefault ["ipa.local.${config.domain}"]))
|
||||
];
|
||||
in mkIf config.sssd.enable {
|
||||
enable = mkAlmostOptionDefault true;
|
||||
gensokyo-zone = {
|
||||
backend = mkAlmostOptionDefault config.sssd.backend;
|
||||
krb5.servers = {
|
||||
servers = servers ++ [ config.host ];
|
||||
inherit backups;
|
||||
in
|
||||
mkIf config.sssd.enable {
|
||||
enable = mkAlmostOptionDefault true;
|
||||
gensokyo-zone = {
|
||||
backend = mkAlmostOptionDefault config.sssd.backend;
|
||||
krb5.servers = {
|
||||
servers = servers ++ [config.host];
|
||||
inherit backups;
|
||||
};
|
||||
ipa.servers = {
|
||||
servers = servers ++ [config.ipa.host];
|
||||
inherit backups;
|
||||
};
|
||||
ldap = {
|
||||
bind.passwordFile = mkAlmostOptionDefault config.ldap.bind.passwordFile;
|
||||
uris.backups = mkIf access.tail.enabled (mkAlmostOptionDefault (mkAfter [
|
||||
"ldaps://ldap.tail.${config.domain}"
|
||||
]));
|
||||
};
|
||||
};
|
||||
ipa.servers = {
|
||||
servers = servers ++ [ config.ipa.host ];
|
||||
inherit backups;
|
||||
};
|
||||
ldap = {
|
||||
bind.passwordFile = mkAlmostOptionDefault config.ldap.bind.passwordFile;
|
||||
uris.backups = mkIf access.tail.enabled (mkAlmostOptionDefault (mkAfter [
|
||||
"ldaps://ldap.tail.${config.domain}"
|
||||
]));
|
||||
environmentFile = mkIf (config.sssd.backend == "ldap") (
|
||||
mkAlmostOptionDefault
|
||||
config.ldap.bind.passwordFileSssdEnv
|
||||
);
|
||||
services = {
|
||||
ifp.enable = mkAlmostOptionDefault true;
|
||||
pam.enable = mkIf (!config.sssd.pam.enable) (mkDefault false);
|
||||
};
|
||||
};
|
||||
environmentFile = mkIf (config.sssd.backend == "ldap") (mkAlmostOptionDefault
|
||||
config.ldap.bind.passwordFileSssdEnv
|
||||
);
|
||||
services = {
|
||||
ifp.enable = mkAlmostOptionDefault true;
|
||||
pam.enable = mkIf (!config.sssd.pam.enable) (mkDefault false);
|
||||
};
|
||||
};
|
||||
ipaSettings = mkIf config.ipa.enable (mapAlmostOptionDefaults {
|
||||
enable = true;
|
||||
certificate = config.ca.pem;
|
||||
basedn = config.ldap.baseDn;
|
||||
domain = config.domain;
|
||||
realm = config.realm;
|
||||
server = config.ipa.server;
|
||||
# TODO: dyndns?
|
||||
} // {
|
||||
overrideConfigs = mapAlmostOptionDefaults {
|
||||
sssd = false;
|
||||
krb5 = false;
|
||||
};
|
||||
});
|
||||
enable = true;
|
||||
certificate = config.ca.pem;
|
||||
basedn = config.ldap.baseDn;
|
||||
domain = config.domain;
|
||||
realm = config.realm;
|
||||
server = config.ipa.server;
|
||||
# TODO: dyndns?
|
||||
}
|
||||
// {
|
||||
overrideConfigs = mapAlmostOptionDefaults {
|
||||
sssd = false;
|
||||
krb5 = false;
|
||||
};
|
||||
});
|
||||
nfsSettings = mkIf config.nfs.enable {
|
||||
${if nixosOptions ? services.nfs.settings then "settings" else null} = mkMerge [
|
||||
${
|
||||
if nixosOptions ? services.nfs.settings
|
||||
then "settings"
|
||||
else null
|
||||
} = mkMerge [
|
||||
{
|
||||
gssd = mapOptionDefaults {
|
||||
#use-machine-creds = false;
|
||||
|
|
@ -314,7 +330,11 @@
|
|||
};
|
||||
})
|
||||
];
|
||||
${if nixosOptions ? services.nfs.settings then null else "extraConfig"} = mkMerge [
|
||||
${
|
||||
if nixosOptions ? services.nfs.settings
|
||||
then null
|
||||
else "extraConfig"
|
||||
} = mkMerge [
|
||||
''
|
||||
[gssd]
|
||||
#use-machine-creds = false
|
||||
|
|
@ -344,10 +364,10 @@
|
|||
Domain = mkForce config.domain;
|
||||
Local-Realms = concatStringsSep "," config.nfs.idmapd.localRealms;
|
||||
};
|
||||
Translation.Method = mkIf (config.nfs.idmapd.methods != [ "nsswitch" ]) (mkForce (
|
||||
Translation.Method = mkIf (config.nfs.idmapd.methods != ["nsswitch"]) (mkForce (
|
||||
concatStringsSep "," config.nfs.idmapd.methods
|
||||
));
|
||||
Static = mkIf (config.nfs.idmapd.authToLocalNames != { }) config.nfs.idmapd.authToLocalNames;
|
||||
Static = mkIf (config.nfs.idmapd.authToLocalNames != {}) config.nfs.idmapd.authToLocalNames;
|
||||
UMICH_SCHEMA = mkIf (elem "umich_ldap" config.nfs.idmapd.methods) (mapOptionDefaults {
|
||||
LDAP_server = config.ldap.host;
|
||||
LDAP_use_ssl = true;
|
||||
|
|
@ -389,7 +409,7 @@ in {
|
|||
nixosOptions = options;
|
||||
};
|
||||
};
|
||||
default = { };
|
||||
default = {};
|
||||
};
|
||||
|
||||
config = {
|
||||
|
|
@ -413,10 +433,11 @@ in {
|
|||
hosts = let
|
||||
inherit (gensokyo-zone.systems) freeipa;
|
||||
# TODO: consider hakurei instead...
|
||||
in mkIf (cfg.enable && !config.gensokyo-zone.dns.enable or false && config.gensokyo-zone.access.local.enable) {
|
||||
${freeipa.config.access.address6ForNetwork.local} = mkIf config.networking.enableIPv6 (mkBefore [ cfg.host ]);
|
||||
${freeipa.config.access.address4ForNetwork.local} = mkBefore [ cfg.host ];
|
||||
};
|
||||
in
|
||||
mkIf (cfg.enable && !config.gensokyo-zone.dns.enable or false && config.gensokyo-zone.access.local.enable) {
|
||||
${freeipa.config.access.address6ForNetwork.local} = mkIf config.networking.enableIPv6 (mkBefore [cfg.host]);
|
||||
${freeipa.config.access.address4ForNetwork.local} = mkBefore [cfg.host];
|
||||
};
|
||||
};
|
||||
environment.etc = {
|
||||
"request-key.conf" = mkIf (cfg.enable && cfg.nfs.enable && cfg.sssd.enable) {
|
||||
|
|
@ -425,24 +446,30 @@ in {
|
|||
export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${config.system.nssModules.path}"
|
||||
exec ${cfg.nfs.package}/bin/nfsidmap "$@"
|
||||
'';
|
||||
in mkForce (pkgs.writeText "request-key.conf" ''
|
||||
create id_resolver * * ${nfsidmap} -t 600 %k %d
|
||||
'');
|
||||
in
|
||||
mkForce (pkgs.writeText "request-key.conf" ''
|
||||
create id_resolver * * ${nfsidmap} -t 600 %k %d
|
||||
'');
|
||||
};
|
||||
};
|
||||
${if options ? sops.secrets then "sops" else null}.secrets = let
|
||||
${
|
||||
if options ? sops.secrets
|
||||
then "sops"
|
||||
else null
|
||||
}.secrets = let
|
||||
sopsFile = mkDefault ../secrets/krb5.yaml;
|
||||
in mkIf cfg.enable {
|
||||
gensokyo-zone-krb5-passwords = mkIf (cfg.db.backend == "kldap") {
|
||||
inherit sopsFile;
|
||||
in
|
||||
mkIf cfg.enable {
|
||||
gensokyo-zone-krb5-passwords = mkIf (cfg.db.backend == "kldap") {
|
||||
inherit sopsFile;
|
||||
};
|
||||
gensokyo-zone-krb5-peep-password = mkIf (cfg.sssd.backend == "ldap") {
|
||||
inherit sopsFile;
|
||||
};
|
||||
gensokyo-zone-sssd-passwords = mkIf (cfg.sssd.backend == "ldap") {
|
||||
inherit sopsFile;
|
||||
};
|
||||
};
|
||||
gensokyo-zone-krb5-peep-password = mkIf (cfg.sssd.backend == "ldap") {
|
||||
inherit sopsFile;
|
||||
};
|
||||
gensokyo-zone-sssd-passwords = mkIf (cfg.sssd.backend == "ldap") {
|
||||
inherit sopsFile;
|
||||
};
|
||||
};
|
||||
lib.gensokyo-zone.krb5 = {
|
||||
inherit cfg krb5Module;
|
||||
};
|
||||
|
|
|
|||
64
modules/extern/nixos/kyuuto.nix
vendored
64
modules/extern/nixos/kyuuto.nix
vendored
|
|
@ -33,20 +33,28 @@
|
|||
options = with lib.types; {
|
||||
enable = mkEnableOption "kyuuto";
|
||||
media = {
|
||||
enable = mkEnableOption "/mnt/kyuuto-media" // {
|
||||
default = true;
|
||||
};
|
||||
krb5.enable = mkEnableOption "krb5" // {
|
||||
default = enabled.krb5;
|
||||
};
|
||||
enable =
|
||||
mkEnableOption "/mnt/kyuuto-media"
|
||||
// {
|
||||
default = true;
|
||||
};
|
||||
krb5.enable =
|
||||
mkEnableOption "krb5"
|
||||
// {
|
||||
default = enabled.krb5;
|
||||
};
|
||||
};
|
||||
transfer = {
|
||||
enable = mkEnableOption "/mnt/kyuuto-transfer" // {
|
||||
default = true;
|
||||
};
|
||||
krb5.enable = mkEnableOption "krb5" // {
|
||||
default = enabled.krb5;
|
||||
};
|
||||
enable =
|
||||
mkEnableOption "/mnt/kyuuto-transfer"
|
||||
// {
|
||||
default = true;
|
||||
};
|
||||
krb5.enable =
|
||||
mkEnableOption "krb5"
|
||||
// {
|
||||
default = enabled.krb5;
|
||||
};
|
||||
};
|
||||
shared.enable = mkEnableOption "/mnt/kyuuto-shared";
|
||||
domain = mkOption {
|
||||
|
|
@ -135,12 +143,13 @@
|
|||
(mkIf config.nfs.enable "nfs4")
|
||||
(mkIf config.smb.enable "smb3")
|
||||
];
|
||||
options = mkMerge (setFilesystemOptions ++ [
|
||||
(mkIf config.media.krb5.enable [
|
||||
"sec=krb5"
|
||||
(mkIf config.nfs.enable "nfsvers=4")
|
||||
])
|
||||
]);
|
||||
options = mkMerge (setFilesystemOptions
|
||||
++ [
|
||||
(mkIf config.media.krb5.enable [
|
||||
"sec=krb5"
|
||||
(mkIf config.nfs.enable "nfsvers=4")
|
||||
])
|
||||
]);
|
||||
};
|
||||
"/mnt/kyuuto-transfer" = mkIf config.transfer.enable {
|
||||
device = mkMerge [
|
||||
|
|
@ -151,12 +160,17 @@
|
|||
(mkIf config.nfs.enable "nfs4")
|
||||
(mkIf config.smb.enable "smb3")
|
||||
];
|
||||
options = mkMerge (setFilesystemOptions ++ [
|
||||
(mkIf config.media.krb5.enable [
|
||||
(if access.local.enable || access.tail.enabled then "sec=sys:krb5" else "sec=krb5")
|
||||
#(mkIf config.nfs.enable "nfsvers=3")
|
||||
])
|
||||
]);
|
||||
options = mkMerge (setFilesystemOptions
|
||||
++ [
|
||||
(mkIf config.media.krb5.enable [
|
||||
(
|
||||
if access.local.enable || access.tail.enabled
|
||||
then "sec=sys:krb5"
|
||||
else "sec=krb5"
|
||||
)
|
||||
#(mkIf config.nfs.enable "nfsvers=3")
|
||||
])
|
||||
]);
|
||||
};
|
||||
"/mnt/kyuuto-shared" = mkIf (config.shared.enable && config.smb.enable) {
|
||||
device = mkIf (config.smb.user != null) ''\\smb.${config.domain}\shared'';
|
||||
|
|
@ -204,7 +218,7 @@ in {
|
|||
nixosConfig = config;
|
||||
};
|
||||
};
|
||||
default = { };
|
||||
default = {};
|
||||
};
|
||||
|
||||
config = {
|
||||
|
|
|
|||
37
modules/extern/nixos/nix.nix
vendored
37
modules/extern/nixos/nix.nix
vendored
|
|
@ -46,9 +46,11 @@
|
|||
default = "ssh";
|
||||
};
|
||||
ssh = {
|
||||
commonKey = mkEnableOption "shared secret nixbld key" // {
|
||||
default = true;
|
||||
};
|
||||
commonKey =
|
||||
mkEnableOption "shared secret nixbld key"
|
||||
// {
|
||||
default = true;
|
||||
};
|
||||
user = mkOption {
|
||||
type = str;
|
||||
default = "nixbld";
|
||||
|
|
@ -105,8 +107,8 @@
|
|||
];
|
||||
builder = {
|
||||
systems = mkMerge [
|
||||
(mkIf config.builder.cross.aarch64 (mkOptionDefault [ "aarch64-linux" ]))
|
||||
(mkIf config.builder.cross.armv7l (mkOptionDefault [ "armv7l-linux" ]))
|
||||
(mkIf config.builder.cross.aarch64 (mkOptionDefault ["aarch64-linux"]))
|
||||
(mkIf config.builder.cross.armv7l (mkOptionDefault ["armv7l-linux"]))
|
||||
];
|
||||
domain = mkMerge [
|
||||
(mkIf access.tail.enabled (mkAlmostOptionDefault "nixbld.tail.${domain}"))
|
||||
|
|
@ -114,9 +116,11 @@
|
|||
];
|
||||
ssh.key = let
|
||||
inherit (nixosConfig.sops) secrets;
|
||||
in mkIf (nixosOptions ? sops.secrets && secrets ? gensokyo-zone-nix-bld-key) (mkAlmostOptionDefault
|
||||
nixosConfig.sops.secrets.gensokyo-zone-nix-bld-key.path
|
||||
);
|
||||
in
|
||||
mkIf (nixosOptions ? sops.secrets && secrets ? gensokyo-zone-nix-bld-key) (
|
||||
mkAlmostOptionDefault
|
||||
nixosConfig.sops.secrets.gensokyo-zone-nix-bld-key.path
|
||||
);
|
||||
setBuildMachine = {
|
||||
hostName = config.builder.domain;
|
||||
protocol = config.builder.protocol;
|
||||
|
|
@ -145,7 +149,7 @@ in {
|
|||
nixosOptions = options;
|
||||
};
|
||||
};
|
||||
default = { };
|
||||
default = {};
|
||||
};
|
||||
|
||||
config = {
|
||||
|
|
@ -153,13 +157,18 @@ in {
|
|||
settings = unmerged.merge cfg.setNixSettings;
|
||||
buildMachines = unmerged.merge cfg.setNixBuildMachines;
|
||||
};
|
||||
${if options ? sops.secrets then "sops" else null}.secrets = let
|
||||
${
|
||||
if options ? sops.secrets
|
||||
then "sops"
|
||||
else null
|
||||
}.secrets = let
|
||||
sopsFile = mkDefault ../secrets/nix.yaml;
|
||||
in mkIf cfg.enable {
|
||||
gensokyo-zone-nix-bld-key = mkIf cfg.builder.ssh.commonKey {
|
||||
inherit sopsFile;
|
||||
in
|
||||
mkIf cfg.enable {
|
||||
gensokyo-zone-nix-bld-key = mkIf cfg.builder.ssh.commonKey {
|
||||
inherit sopsFile;
|
||||
};
|
||||
};
|
||||
};
|
||||
lib.gensokyo-zone.nix = {
|
||||
inherit cfg nixModule;
|
||||
};
|
||||
|
|
|
|||
4
modules/extern/nixos/users.nix
vendored
4
modules/extern/nixos/users.nix
vendored
|
|
@ -162,7 +162,7 @@
|
|||
modules = [userModule];
|
||||
inherit specialArgs;
|
||||
});
|
||||
default = { };
|
||||
default = {};
|
||||
};
|
||||
excludeUsers = mkOption {
|
||||
type = listOf str;
|
||||
|
|
@ -172,7 +172,7 @@
|
|||
modules = [groupModule];
|
||||
inherit specialArgs;
|
||||
});
|
||||
default = { };
|
||||
default = {};
|
||||
};
|
||||
excludeGroups = mkOption {
|
||||
type = listOf str;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue