Merge pull request 'public-cof' (#5) from public-cof into master

krops.nix

@@ -31,4 +31,5 @@ let
 in {}
 // mkDeploy "core-services-01" "root@core01.internal.rz.ens.wtf"
 // mkDeploy "remote-builder-01" "root@nix01.builders.rz.ens.wtf"
-// mkTestsConfig [ "core-services-01" "remote-builder-01" ]
+// mkDeploy "public-cof" "root@beta.rz.ens.wtf"
+// mkTestsConfig [ "core-services-01" "remote-builder-01" "public-cof" ]

machines/core-services-01/subZone.nix

@@ -4,6 +4,8 @@ with dns.lib.combinators;
 
 let
   my = config.my;
+  upstream-v4-proxies = [ "51.15.7.181" ]; # kurisu.dual.lahfa.xyz
+  public-cof-ips = [ "2001:470:1f13:187:c08e:feff:fe4d:f5f5" ];
   delegateACMEDNSChallenge = acme: { _acme-challenge.CNAME = [ acme ]; };
 
   remoteBuilders = {
@@ -15,7 +17,7 @@ with my.ipv6; # contains { standard, acme }
   SOA = {
     nameServer = "ns1.${my.subZone}.";
     adminEmail = my.email;
-    serial = 2021111100; # Y M D Version
+    serial = 2021111301; # Y M D Version
   };
 
   NS = [
@@ -34,6 +36,8 @@ with my.ipv6; # contains { standard, acme }
     auth.AAAA = standard;
     push.AAAA = standard;
     ns1.AAAA = standard;
+    beta.A = upstream-v4-proxies;
+    beta.AAAA = public-cof-ips;
 
     builders.subdomains = lib.mapAttrs (n: AAAA: { inherit AAAA; }) remoteBuilders;
 
@@ -48,6 +52,16 @@ with my.ipv6; # contains { standard, acme }
       AAAA = [ acme ];
     };
 
+    beta.subdomains = {
+      nuage.A = upstream-v4-proxies;
+      nuage.AAAA = public-cof-ips;
+      minecraft.AAAA = public-cof-ips;
+      factorio.AAAA = public-cof-ips;
+      home.A = upstream-v4-proxies;
+      home.AAAA = public-cof-ips;
+      pads.AAAA = public-cof-ips;
+      docs.AAAA = public-cof-ips;
+    };
 
     internal.subdomains = {
       # Routers

machines/public-cof/acme.nix

@@ -0,0 +1,5 @@
+{ ... }:
+{
+  security.acme.acceptTerms = true;
+  security.acme.email = "club-reseau@lists.ens.psl.eu";
+}

machines/public-cof/configuration.nix

@@ -0,0 +1,48 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ./hardware-configuration.nix
+      ./programs.nix
+      ./system.nix
+      ./acme.nix
+      ./networking.nix
+      ./nextcloud.nix
+      ./minecraft.nix
+      # ./factorio.nix # TODO
+      ./nginx.nix
+      # TODO monitoring
+    ];
+
+  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+    "minecraft-server"
+    "factorio-headless"
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  time.timeZone = "Europe/Paris";
+
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "us";
+  };
+
+  programs.mtr.enable = true;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  users.users.root.openssh.authorizedKeys.keyFiles = [
+    ./pubkeys/gdd.keys
+    ./pubkeys/raito.keys
+  ];
+
+  system.stateVersion = "21.05";
+}

machines/public-cof/factorio.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+  services.factorio = {
+    enable = true;
+    admins = [ ];
+    username = "AGB";
+    password = "Je vais voter pour le club réseau";
+    description = "This is a test and it will break";
+    game-name = "Factorio for AGB";
+    openFirewall = true;
+  };
+
+  networking.firewall.allowedUDPPorts = [ 34197 ];
+}

machines/public-cof/hardware-configuration.nix

@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/9147d97d-66fe-4bde-8535-aa855ebee1a8";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/AEF2-33FE";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/bd933d58-5fa1-41c6-a4a1-9c176180f0f6"; }
+    ];
+
+}

machines/public-cof/minecraft.nix

@@ -0,0 +1,84 @@
+{ lib, pkgs, ... }:
+let
+  papermc = {
+    ram = 4; # In GB
+    version = "1.17.1";
+    build = 189;
+    sha256 = "06g2vs8z7k9bl8asjgdz9h8fkd93xam2lbrgmzgamwjp94gvfvrn";
+  };
+  port = 43000;
+  rconPort = 25575;
+in
+{
+  # Remote administration
+  environment.systemPackages = [ pkgs.mcrcon ];
+
+  # Use papermc
+  nixpkgs.overlays = [
+    (self: super: {
+      minecraft-server = super.minecraft-server.overrideAttrs (old: {
+        src = pkgs.fetchurl {
+          url = with papermc;
+            "https://papermc.io/api/v2/projects/paper/versions/${version}/builds/${toString build}/downloads/paper-${version}-${toString build}.jar";
+          sha256 = papermc.sha256;
+        };
+      });
+    })
+  ];
+
+  services.minecraft-server = {
+    enable = true;
+    eula = true;
+    declarative = true;
+
+    jvmOpts = with papermc;
+      "-Xms${toString ram}G -Xmx${toString ram}G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+DisableExplicitGC -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1";
+
+    # To get the uuids: https://mcuuid.net/
+    whitelist = {
+      gabriel_dr_dl = "53fced49-da51-4c82-b1d0-37168029db08";
+      aimie_dodo = "d10be020-a612-47e5-b0d0-938b9a7eb58e";
+    };
+
+    serverProperties = {
+      server-port = port;
+      difficulty = "normal";
+      gamemode = "survival";
+      max-players = 42;
+      motd = "This is a test and it will break";
+
+      view-distance = 7;
+
+      # Map settings
+      level-seed = "9058136630944956755";
+      level-name = "Public COF";
+
+      level-type = "default";
+      spawn-animals = true;
+      spawn-monsters = true;
+      spawn-npcs = true;
+      generate-structures = true;
+
+      enable-command-block = false;
+
+      # Whitelist
+      white-list = true;
+      enforce-whitelist = true;
+
+      # Admin
+      enable-rcon = true;
+      "rcon.password" =
+        ''yQZ>O.%]fB{'E.X=HI1/En~i-''; # TODO Warning: it is written in clear in /var/lib/... with read permissions and mcrcom will transmit it without encryption
+      "rcon.port" = rconPort;
+      admin-slot = true;
+
+      snoop-enabled = false;
+      public = false;
+
+      # enable-jmx-monitoring = true; # https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ port ];
+  networking.firewall.allowedUDPPorts = [ port ];
+}

machines/public-cof/networking.nix

@@ -0,0 +1,19 @@
+{ ... }:
+{
+  networking = {
+    hostName = "public-cof";
+
+    useDHCP = false;
+    interfaces.ens18 = {
+      useDHCP = true;
+      ipv6.addresses = [{
+        address = "2001:470:1f13:187:c08e:feff:fe4d:f5f5";
+        prefixLength = 64;
+      }];
+    };
+
+    firewall.allowedTCPPorts = [ 22 ];
+    firewall.allowedUDPPorts = [ 22 ];
+    firewall.enable = true;
+  };
+}

machines/public-cof/nextcloud.nix

@@ -0,0 +1,47 @@
+{ ... }:
+{
+  services.nextcloud = {
+    enable = true;
+    hostName = "nuage.beta.rz.ens.wtf";
+    https = true;
+
+    config = {
+      overwriteProtocol = "https";
+
+      dbtype = "pgsql";
+      dbhost = "/run/postgresql";
+
+      dbpass = "TODO";
+      adminpass = "TODO";
+
+      defaultPhoneRegion = "FR";
+    };
+  };
+
+  services.nginx = {
+    virtualHosts = {
+      "nuage.beta.rz.ens.wtf" = {
+        forceSSL = true;
+        enableACME = true;
+      };
+    };
+  };
+
+  services.postgresql = {
+    enable = true;
+
+    ensureDatabases = [ "nextcloud" ];
+    ensureUsers = [
+      { name = "nextcloud";
+        ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
+      }
+    ];
+  };
+
+  systemd.services."nextcloud-setup" = {
+    requires = [ "postgresql.service" ];
+    after = [ "postgresql.service" ];
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}

machines/public-cof/nginx.nix

@@ -0,0 +1,26 @@
+{ ... }:
+{
+  services.nginx = {
+    enable = true;
+
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+
+    # # Only allow PFS-enabled ciphers with AES256
+    # sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
+
+    virtualHosts = {
+      "home.beta.rz.ens.wtf" = {
+        serverAliases = [ "beta.rz.ens.wtf" ];
+        forceSSL = true;
+        enableACME = true;
+        root = "/var/public-cof/home";
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.allowedUDPPorts = [ 80 443 ];
+}

machines/public-cof/programs.nix

@@ -0,0 +1,27 @@
+{ pkgs, ... }:
+let pkgsList = with pkgs; [
+  curl
+  wget
+
+  nix-prefetch-git
+  dnsutils
+
+  unzip
+  zip
+  ripgrep
+
+  niv
+  nixfmt
+  ];
+in
+{
+  imports = [
+    ./vim.nix
+  ];
+  programs = {
+    tmux.enable = true;
+    mosh.enable = true;
+  };
+
+  environment.systemPackages = pkgsList;
+}

machines/public-cof/pubkeys/gdd.keys

@@ -0,0 +1,2 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICE7TN5NQKGojNGIeTFiHjLHTDQGT8i05JFqX/zLW2zc
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFbkPWWZzOBaRdx4+7xQUgxDwuncSl2fxAeVuYfVUPZ

machines/public-cof/pubkeys/raito.keys

@@ -0,0 +1,4 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcEkYM1r8QVNM/G5CxJInEdoBCWjEHHDdHlzDYNSUIdHHsn04QY+XI67AdMCm8w30GZnLUIj5RiJEWXREUApby0GrfxGGcy8otforygfgtmuUKAUEHdU2MMwrQI7RtTZ8oQ0USRGuqvmegxz3l5caVU7qGvBllJ4NUHXrkZSja2/51vq80RF4MKkDGiz7xUTixI2UcBwQBCA/kQedKV9G28EH+1XfvePqmMivZjl+7VyHsgUVj9eRGA1XWFw59UPZG8a7VkxO/Eb3K9NF297HUAcFMcbY6cPFi9AaBgu3VC4eetDnoN/+xT1owiHi7BReQhGAy/6cdf7C/my5ehZwD
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKIIcqryU28FkV+UpiTnGCOfwKO5jFhkdvU7a7Ew2KoZ
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMLf6B8VV//BhOWihYK8Zy1CJ3sg4w2bP0aBO0VPs4hS
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0xMwWedkKosax9+7D2OlnMxFL/eV4CvFZLsbLptpXr

machines/public-cof/system.nix

@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+{
+  # # Auto upgrades
+  # system.autoUpgrade = {
+  #   enable = false; # TODO(Ryan): do not enable, it will break deployments.
+  #   allowReboot = false;
+  # };
+
+  # Auto GC and store optimizations
+  nix = {
+    trustedUsers = [ "root" ];
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 90d";
+    };
+    optimise.automatic = true;
+    extraOptions = ''
+      min-free = ${toString (100 * 1024 * 1024)}
+      max-free = ${toString (1024 * 1024 * 1024)}
+    '';
+  };
+}

machines/public-cof/vim.nix

@@ -0,0 +1,31 @@
+{ pkgs, ... }:
+{
+  environment.variables = { EDITOR = "vim"; };
+
+  environment.systemPackages = with pkgs; [
+    nixfmt
+    git
+    (neovim.override {
+      vimAlias = true;
+      configure = {
+        packages.myPlugins = with pkgs.vimPlugins; {
+          start = [ vim-lastplace vim-nix ];
+          opt = [];
+        };
+        customRC = ''
+          set encoding=utf-8
+          set wildmenu
+
+          set nocompatible
+          set backspace=indent,eol,start
+          set cursorline
+          hi CursorLine term=bold cterm=bold ctermbg=darkgrey
+          set number
+          set relativenumber
+          set tabstop=4
+          set expandtab
+        '';
+      };
+    }
+  )];
+}