mirror of
https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git
synced 2026-01-12 10:28:25 +01:00
Compare commits
4 Commits
d88dd0a45c
...
gitea-gpg-
| Author | SHA1 | Date | |
|---|---|---|---|
|
cbec247a87 | ||
|
|
78028846a9 | ||
|
|
07777edafb | ||
|
|
3bdfb4c297 |
@@ -1,9 +1,9 @@
|
||||
{ pkgs, lib, ... }:
|
||||
{ pkgs, lib, fp, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../users
|
||||
../modules/snakeoil-certs.nix
|
||||
(fp /users)
|
||||
(fp /modules/snakeoil-certs.nix)
|
||||
|
||||
./networking.nix
|
||||
./nix.nix
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
{
|
||||
system.autoUpgrade = {
|
||||
enable = true;
|
||||
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git?ref=pvvvvv";
|
||||
flake = "git+https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git";
|
||||
flags = [
|
||||
# --update-input is deprecated since nix 2.22, and removed in lix 2.90
|
||||
# https://git.lix.systems/lix-project/lix/issues/400
|
||||
|
||||
30
flake.lock
generated
30
flake.lock
generated
@@ -7,11 +7,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1729281548,
|
||||
"narHash": "sha256-MuojlSnwAJAwfhgmW8ZtZrwm2Sko4fqubCvReqbUzYw=",
|
||||
"lastModified": 1731746438,
|
||||
"narHash": "sha256-f3SSp1axoOk0NAI7oFdRzbxG2XPBSIXC+/DaAXnvS1A=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "a6a3179ddf396dfc28a078e2f169354d0c137125",
|
||||
"rev": "cb64993826fa7a477490be6ccb38ba1fa1e18fa8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -119,11 +119,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1729307008,
|
||||
"narHash": "sha256-QUvb6epgKi9pCu9CttRQW4y5NqJ+snKr1FZpG/x3Wtc=",
|
||||
"lastModified": 1731663789,
|
||||
"narHash": "sha256-x07g4NcqGP6mQn6AISXJaks9sQYDjZmTMBlKIvajvyc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a9b86fc2290b69375c5542b622088eb6eca2a7c3",
|
||||
"rev": "035d434d48f4375ac5d3a620954cf5fda7dd7c36",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -135,11 +135,11 @@
|
||||
},
|
||||
"nixpkgs-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1728156290,
|
||||
"narHash": "sha256-uogSvuAp+1BYtdu6UWuObjHqSbBohpyARXDWqgI12Ss=",
|
||||
"lastModified": 1730602179,
|
||||
"narHash": "sha256-efgLzQAWSzJuCLiCaQUCDu4NudNlHdg2NzGLX5GYaEY=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "17ae88b569bb15590549ff478bab6494dde4a907",
|
||||
"rev": "3c2f1c4ca372622cb2f9de8016c9a0b1cbd0f37c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -151,11 +151,11 @@
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1729308112,
|
||||
"narHash": "sha256-Ap+cPeiluam2KFZO+OWuFTl/IkIJfyGYGMgkT2pVCRY=",
|
||||
"lastModified": 1731745710,
|
||||
"narHash": "sha256-SVeiClbgqL071JpAspOu0gCkPSAL51kSIRwo4C/pghA=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "61253596816c4cd65e2a0f474cbc0ac0c6e0f7cf",
|
||||
"rev": "dfaa4cb76c2d450d8f396bb6b9f43cede3ade129",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -249,11 +249,11 @@
|
||||
"nixpkgs-stable": "nixpkgs-stable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1728345710,
|
||||
"narHash": "sha256-lpunY1+bf90ts+sA2/FgxVNIegPDKCpEoWwOPu4ITTQ=",
|
||||
"lastModified": 1731748189,
|
||||
"narHash": "sha256-Zd/Uukvpcu26M6YGhpbsgqm6LUSLz+Q8mDZ5LOEGdiE=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "06535d0e3d0201e6a8080dd32dbfde339b94f01b",
|
||||
"rev": "d2bd7f433b28db6bc7ae03d5eca43564da0af054",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
@@ -59,6 +59,7 @@
|
||||
specialArgs = {
|
||||
inherit unstablePkgs inputs;
|
||||
values = import ./values.nix;
|
||||
fp = path: ./${path};
|
||||
};
|
||||
|
||||
modules = [
|
||||
@@ -132,12 +133,6 @@
|
||||
inputs.greg-ng.overlays.default
|
||||
];
|
||||
};
|
||||
kvernberg = stableNixosConfig "kvernberg" {
|
||||
modules = [
|
||||
disko.nixosModules.disko
|
||||
{ disko.devices.disk.disk1.device = "/dev/sda"; }
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
nixosModules = {
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
{ pkgs, values, ... }:
|
||||
{ fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
./services/bluemap/default.nix
|
||||
./services/gitea/default.nix
|
||||
@@ -19,7 +19,7 @@
|
||||
./services/well-known
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;
|
||||
sops.defaultSopsFile = fp /secrets/bekkalokk/bekkalokk.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, values, pkgs, lib, ... }:
|
||||
{ config, values, fp, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.gitea;
|
||||
domain = "git.pvv.ntnu.no";
|
||||
@@ -6,6 +6,7 @@ let
|
||||
in {
|
||||
imports = [
|
||||
./ci.nix
|
||||
./gpg.nix
|
||||
./import-users
|
||||
./web-secret-provider
|
||||
];
|
||||
@@ -173,8 +174,8 @@ in {
|
||||
};
|
||||
|
||||
script = let
|
||||
logo-svg = ../../../../assets/logo_blue_regular.svg;
|
||||
logo-png = ../../../../assets/logo_blue_regular.png;
|
||||
logo-svg = fp /assets/logo_blue_regular.svg;
|
||||
logo-png = fp /assets/logo_blue_regular.png;
|
||||
extraLinks = pkgs.writeText "gitea-extra-links.tmpl" ''
|
||||
<a class="item" href="https://www.pvv.ntnu.no/">PVV</a>
|
||||
<a class="item" href="https://wiki.pvv.ntnu.no/">Wiki</a>
|
||||
|
||||
38
hosts/bekkalokk/services/gitea/gpg.nix
Normal file
38
hosts/bekkalokk/services/gitea/gpg.nix
Normal file
@@ -0,0 +1,38 @@
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.gitea;
|
||||
GNUPGHOME = "${config.users.users.gitea.home}/gnupg";
|
||||
in
|
||||
{
|
||||
sops.secrets."gitea/gpg-signing-key" = {
|
||||
owner = cfg.user;
|
||||
inherit (cfg) group;
|
||||
};
|
||||
|
||||
systemd.services.gitea.environment = { inherit GNUPGHOME; };
|
||||
|
||||
systemd.tmpfiles.settings."20-gitea-gnugpg".${GNUPGHOME}.d = {
|
||||
inherit (cfg) user group;
|
||||
mode = "700";
|
||||
};
|
||||
|
||||
systemd.services.gitea-ensure-gnupg-homedir = {
|
||||
description = "Import gpg key for gitea";
|
||||
environment = { inherit GNUPGHOME; };
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = cfg.user;
|
||||
PrivateNetwork = true;
|
||||
};
|
||||
script = ''
|
||||
${lib.getExe pkgs.gnupg} --import ${config.sops.secrets."gitea/gpg-signing-key".path}
|
||||
'';
|
||||
};
|
||||
|
||||
services.gitea.settings."repository.signing" = {
|
||||
SIGNING_KEY = "0549C43374D2253C";
|
||||
SIGNING_NAME = "PVV Git";
|
||||
SIGNING_EMAIL = "gitea@git.pvv.ntnu.no";
|
||||
INITIAL_COMMIT = "always";
|
||||
};
|
||||
}
|
||||
@@ -1,4 +1,4 @@
|
||||
{ pkgs, lib, config, values, pkgs-unstable, ... }: let
|
||||
{ pkgs, lib, fp, config, values, pkgs-unstable, ... }: let
|
||||
cfg = config.services.mediawiki;
|
||||
|
||||
# "mediawiki"
|
||||
@@ -210,8 +210,8 @@ in {
|
||||
'';
|
||||
};
|
||||
|
||||
"= /PNG/PVV-logo.svg".alias = ../../../../assets/logo_blue_regular.svg;
|
||||
"= /PNG/PVV-logo.png".alias = ../../../../assets/logo_blue_regular.png;
|
||||
"= /PNG/PVV-logo.svg".alias = fp /assets/logo_blue_regular.svg;
|
||||
"= /PNG/PVV-logo.png".alias = fp /assets/logo_blue_regular.png;
|
||||
"= /favicon.ico".alias = pkgs.runCommandLocal "mediawiki-favicon.ico" {
|
||||
buildInputs = with pkgs; [ imagemagick ];
|
||||
} ''
|
||||
@@ -219,7 +219,7 @@ in {
|
||||
-resize x64 \
|
||||
-gravity center \
|
||||
-crop 64x64+0+0 \
|
||||
${../../../../assets/logo_blue_regular.png} \
|
||||
${fp /assets/logo_blue_regular.png} \
|
||||
-flatten \
|
||||
-colors 256 \
|
||||
-background transparent \
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{ config, lib, fp, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.snappymail;
|
||||
in {
|
||||
imports = [ ../../../../modules/snappymail.nix ];
|
||||
imports = [ (fp /modules/snappymail.nix) ];
|
||||
|
||||
services.snappymail = {
|
||||
enable = true;
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
{ pkgs, values, ... }:
|
||||
{ fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
./services/nginx
|
||||
|
||||
./services/mysql.nix
|
||||
@@ -15,7 +15,7 @@
|
||||
./services/matrix
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/bicep/bicep.yaml;
|
||||
sops.defaultSopsFile = fp /secrets/bicep/bicep.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
@@ -1,16 +1,16 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
{ config, fp, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.pvv-calendar-bot;
|
||||
in {
|
||||
sops.secrets = {
|
||||
"calendar-bot/matrix_token" = {
|
||||
sopsFile = ../../../secrets/bicep/bicep.yaml;
|
||||
sopsFile = fp /secrets/bicep/bicep.yaml;
|
||||
key = "calendar-bot/matrix_token";
|
||||
owner = cfg.user;
|
||||
group = cfg.group;
|
||||
};
|
||||
"calendar-bot/mysql_password" = {
|
||||
sopsFile = ../../../secrets/bicep/bicep.yaml;
|
||||
sopsFile = fp /secrets/bicep/bicep.yaml;
|
||||
key = "calendar-bot/mysql_password";
|
||||
owner = cfg.user;
|
||||
group = cfg.group;
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
{ config, lib, pkgs, secrets, values, ... }:
|
||||
{ config, lib, fp, pkgs, secrets, values, ... }:
|
||||
|
||||
{
|
||||
sops.secrets."matrix/synapse/turnconfig" = {
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "synapse/turnconfig";
|
||||
owner = config.users.users.matrix-synapse.name;
|
||||
group = config.users.users.matrix-synapse.group;
|
||||
};
|
||||
sops.secrets."matrix/coturn/static-auth-secret" = {
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "coturn/static-auth-secret";
|
||||
owner = config.users.users.turnserver.name;
|
||||
group = config.users.users.turnserver.group;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, ... }:
|
||||
{ config, lib, fp, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.mx-puppet-discord;
|
||||
@@ -7,11 +7,11 @@ in
|
||||
users.groups.keys-matrix-registrations = { };
|
||||
|
||||
sops.secrets."matrix/discord/as_token" = {
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "discord/as_token";
|
||||
};
|
||||
sops.secrets."matrix/discord/hs_token" = {
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "discord/hs_token";
|
||||
};
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, unstablePkgs, inputs, ... }:
|
||||
{ config, lib, fp, unstablePkgs, inputs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.matrix-hookshot;
|
||||
@@ -11,11 +11,11 @@ in
|
||||
];
|
||||
|
||||
sops.secrets."matrix/hookshot/as_token" = {
|
||||
sopsFile = ../../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "hookshot/as_token";
|
||||
};
|
||||
sops.secrets."matrix/hookshot/hs_token" = {
|
||||
sopsFile = ../../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "hookshot/hs_token";
|
||||
};
|
||||
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
{ config, lib, ... }:
|
||||
{ config, lib, fp, ... }:
|
||||
|
||||
{
|
||||
sops.secrets."matrix/mjolnir/access_token" = {
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "mjolnir/access_token";
|
||||
owner = config.users.users.mjolnir.name;
|
||||
group = config.users.users.mjolnir.group;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, lib, pkgs, values, inputs, ... }:
|
||||
{ config, lib, fp, pkgs, values, inputs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.matrix-synapse-next;
|
||||
@@ -10,13 +10,13 @@ let
|
||||
in {
|
||||
sops.secrets."matrix/synapse/signing_key" = {
|
||||
key = "synapse/signing_key";
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
owner = config.users.users.matrix-synapse.name;
|
||||
group = config.users.users.matrix-synapse.group;
|
||||
};
|
||||
|
||||
sops.secrets."matrix/synapse/user_registration" = {
|
||||
sopsFile = ../../../../secrets/bicep/matrix.yaml;
|
||||
sopsFile = fp /secrets/bicep/matrix.yaml;
|
||||
key = "synapse/signing_key";
|
||||
owner = config.users.users.matrix-synapse.name;
|
||||
group = config.users.users.matrix-synapse.group;
|
||||
|
||||
@@ -1,16 +1,16 @@
|
||||
{ config, pkgs, values, ... }:
|
||||
{ config, fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
./disks.nix
|
||||
|
||||
../../misc/builder.nix
|
||||
(fp /misc/builder.nix)
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/bob/bob.yaml;
|
||||
sops.defaultSopsFile = fp /secrets/bob/bob.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
{ config, pkgs, values, ... }:
|
||||
{ config, fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
./services/grzegorz.nix
|
||||
];
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{ config, ... }:
|
||||
{ config, fp, ... }:
|
||||
{
|
||||
imports = [ ../../../modules/grzegorz.nix ];
|
||||
imports = [ (fp /modules/grzegorz.nix) ];
|
||||
|
||||
services.nginx.virtualHosts."${config.networking.fqdn}" = {
|
||||
serverAliases = [
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
{ config, pkgs, values, ... }:
|
||||
{ config, fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
../../modules/grzegorz.nix
|
||||
(fp /modules/grzegorz.nix)
|
||||
];
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
|
||||
@@ -1,16 +1,16 @@
|
||||
{ config, pkgs, lib, values, ... }:
|
||||
{ config, fp, pkgs, lib, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
|
||||
./services/monitoring
|
||||
./services/nginx
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/ildkule/ildkule.yaml;
|
||||
sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
@@ -1,43 +0,0 @@
|
||||
{ config, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
|
||||
./disks.nix
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/kvernberg/kvernberg.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking.hostName = "kvernberg"; # Define your hostname.
|
||||
|
||||
systemd.network.networks."30-all" = values.defaultNetworkConfig // {
|
||||
matchConfig.Name = "en*";
|
||||
address = with values.hosts.kvernberg; [ (ipv4 + "/25") (ipv6 + "/64") ];
|
||||
};
|
||||
|
||||
# List packages installed in system profile
|
||||
environment.systemPackages = with pkgs; [
|
||||
|
||||
];
|
||||
|
||||
# No devices with SMART
|
||||
services.smartd.enable = false;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "24.05"; # Did you read the comment?
|
||||
|
||||
}
|
||||
@@ -1,39 +0,0 @@
|
||||
# Example to create a bios compatible gpt partition
|
||||
{ lib, ... }:
|
||||
{
|
||||
disko.devices = {
|
||||
disk.disk1 = {
|
||||
device = lib.mkDefault "/dev/sda";
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
boot = {
|
||||
name = "boot";
|
||||
size = "1M";
|
||||
type = "EF02";
|
||||
};
|
||||
esp = {
|
||||
name = "ESP";
|
||||
size = "500M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
root = {
|
||||
name = "root";
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
@@ -1,93 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
options,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [ (import ./common.nix "bank") ];
|
||||
|
||||
options.services.libeufin.bank = {
|
||||
initialAccounts = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.attrs;
|
||||
description = ''
|
||||
Accounts to enable before the bank service starts.
|
||||
|
||||
This is mainly needed for the nexus currency conversion
|
||||
since the exchange's bank account is expected to be already
|
||||
registered.
|
||||
|
||||
Don't forget to change the account passwords afterwards.
|
||||
'';
|
||||
default = [ ];
|
||||
};
|
||||
|
||||
settings = lib.mkOption {
|
||||
description = ''
|
||||
Configuration options for the libeufin bank system config file.
|
||||
|
||||
For a list of all possible options, please see the man page [`libeufin-bank.conf(5)`](https://docs.taler.net/manpages/libeufin-bank.conf.5.html)
|
||||
'';
|
||||
type = lib.types.submodule {
|
||||
inherit (options.services.libeufin.settings.type.nestedTypes) freeformType;
|
||||
options = {
|
||||
libeufin-bank = {
|
||||
CURRENCY = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
The currency under which the libeufin-bank should operate.
|
||||
|
||||
This defaults to the GNU taler module's currency for convenience
|
||||
but if you run libeufin-bank separately from taler, you must set
|
||||
this yourself.
|
||||
'';
|
||||
};
|
||||
PORT = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 8082;
|
||||
description = ''
|
||||
The port on which libeufin-bank should listen.
|
||||
'';
|
||||
};
|
||||
SUGGESTED_WITHDRAWAL_EXCHANGE = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "https://exchange.demo.taler.net/";
|
||||
description = ''
|
||||
Exchange that is suggested to wallets when withdrawing.
|
||||
|
||||
Note that, in order for withdrawals to work, your libeufin-bank
|
||||
must be able to communicate with and send money etc. to the bank
|
||||
at which the exchange used for withdrawals has its bank account.
|
||||
|
||||
If you also have your own bank and taler exchange network, you
|
||||
probably want to set one of your exchange's url here instead of
|
||||
the demo exchange.
|
||||
|
||||
This setting must always be set in order for the Android app to
|
||||
not crash during the withdrawal process but the exchange to be
|
||||
used can always be changed in the app.
|
||||
'';
|
||||
};
|
||||
};
|
||||
libeufin-bankdb-postgres = {
|
||||
CONFIG = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
The database connection string for the libeufin-bank database.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
services.libeufin.bank.settings.libeufin-bank.CURRENCY = lib.mkIf (
|
||||
config.services.taler.enable && (config.services.taler.settings.taler ? CURRENCY)
|
||||
) config.services.taler.settings.taler.CURRENCY;
|
||||
|
||||
services.libeufin.bank.settings.libeufin-bankdb-postgres.CONFIG = lib.mkIf config.services.libeufin.bank.createLocalDatabase "postgresql:///libeufin-bank";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,156 +0,0 @@
|
||||
# TODO: create a common module generator for Taler and Libeufin?
|
||||
libeufinComponent:
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
options.services.libeufin.${libeufinComponent} = {
|
||||
enable = lib.mkEnableOption "libeufin core banking system and web interface";
|
||||
package = lib.mkPackageOption pkgs "libeufin" { };
|
||||
debug = lib.mkEnableOption "debug logging";
|
||||
createLocalDatabase = lib.mkEnableOption "automatic creation of a local postgres database";
|
||||
openFirewall = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Whether to open ports in the firewall";
|
||||
};
|
||||
};
|
||||
|
||||
config =
|
||||
let
|
||||
cfgMain = config.services.libeufin;
|
||||
cfg = cfgMain.${libeufinComponent};
|
||||
|
||||
serviceName = "libeufin-${libeufinComponent}";
|
||||
|
||||
isNexus = libeufinComponent == "nexus";
|
||||
|
||||
# get database name from config
|
||||
# TODO: should this always be the same db? In which case, should this be an option directly under `services.libeufin`?
|
||||
dbName =
|
||||
lib.removePrefix "postgresql:///"
|
||||
cfg.settings."libeufin-${libeufinComponent}db-postgres".CONFIG;
|
||||
|
||||
bankPort = cfg.settings."${if isNexus then "nexus-httpd" else "libeufin-bank"}".PORT;
|
||||
in
|
||||
lib.mkIf cfg.enable {
|
||||
services.libeufin.settings = cfg.settings;
|
||||
|
||||
# TODO add system-libeufin.slice?
|
||||
systemd.services = {
|
||||
# Main service
|
||||
"${serviceName}" = {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart =
|
||||
let
|
||||
args = lib.cli.toGNUCommandLineShell { } {
|
||||
c = cfgMain.configFile;
|
||||
L = if cfg.debug then "debug" else null;
|
||||
};
|
||||
in
|
||||
"${lib.getExe' cfg.package "libeufin-${libeufinComponent}"} serve ${args}";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "10s";
|
||||
};
|
||||
requires = [ "libeufin-dbinit.service" ];
|
||||
after = [ "libeufin-dbinit.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
# Database Initialisation
|
||||
libeufin-dbinit =
|
||||
let
|
||||
dbScript = pkgs.writers.writeText "libeufin-db-permissions.sql" ''
|
||||
GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA libeufin_bank TO "${serviceName}";
|
||||
GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA libeufin_nexus TO "${serviceName}";
|
||||
GRANT USAGE ON SCHEMA libeufin_bank TO "${serviceName}";
|
||||
GRANT USAGE ON SCHEMA libeufin_nexus TO "${serviceName}";
|
||||
'';
|
||||
|
||||
# Accounts to be created after the bank database initialization.
|
||||
#
|
||||
# For example, if the bank's currency conversion is enabled, it's
|
||||
# required that the exchange account is registered before the
|
||||
# service starts.
|
||||
initialAccountRegistration = lib.concatMapStringsSep "\n" (
|
||||
account:
|
||||
let
|
||||
args = lib.cli.toGNUCommandLineShell { } {
|
||||
c = cfgMain.configFile;
|
||||
inherit (account) username password name;
|
||||
payto_uri = "payto://x-taler-bank/bank:${toString bankPort}/${account.username}?receiver-name=${account.name}";
|
||||
exchange = lib.toLower account.username == "exchange";
|
||||
};
|
||||
in
|
||||
"${lib.getExe' cfg.package "libeufin-bank"} create-account ${args}"
|
||||
) cfg.initialAccounts;
|
||||
|
||||
args = lib.cli.toGNUCommandLineShell { } {
|
||||
c = cfgMain.configFile;
|
||||
L = if cfg.debug then "debug" else null;
|
||||
};
|
||||
in
|
||||
{
|
||||
path = [ config.services.postgresql.package ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
DynamicUser = true;
|
||||
StateDirectory = "libeufin-dbinit";
|
||||
StateDirectoryMode = "0750";
|
||||
User = dbName;
|
||||
};
|
||||
script = lib.optionalString cfg.enable ''
|
||||
${lib.getExe' cfg.package "libeufin-${libeufinComponent}"} dbinit ${args}
|
||||
'';
|
||||
# Grant DB permissions after schemas have been created
|
||||
postStart =
|
||||
''
|
||||
psql -U "${dbName}" -f "${dbScript}"
|
||||
''
|
||||
+ lib.optionalString ((!isNexus) && (cfg.initialAccounts != [ ])) ''
|
||||
# only register initial accounts once
|
||||
if [ ! -e /var/lib/libeufin-dbinit/init ]; then
|
||||
${initialAccountRegistration}
|
||||
touch /var/lib/libeufin-dbinit/init
|
||||
echo "Bank initialisation complete"
|
||||
fi
|
||||
'';
|
||||
requires = lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
|
||||
after = [ "network.target" ] ++ lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall = lib.mkIf cfg.openFirewall {
|
||||
allowedTCPPorts = [
|
||||
bankPort
|
||||
];
|
||||
};
|
||||
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
|
||||
services.postgresql = lib.mkIf cfg.createLocalDatabase {
|
||||
enable = true;
|
||||
ensureDatabases = [ dbName ];
|
||||
ensureUsers = [
|
||||
{ name = serviceName; }
|
||||
{
|
||||
name = dbName;
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
assertions = [
|
||||
{
|
||||
assertion =
|
||||
cfg.createLocalDatabase || (cfg.settings."libeufin-${libeufinComponent}db-postgres" ? CONFIG);
|
||||
message = "Libeufin ${libeufinComponent} database is not configured.";
|
||||
}
|
||||
];
|
||||
|
||||
};
|
||||
}
|
||||
@@ -1,29 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.services.libeufin;
|
||||
settingsFormat = pkgs.formats.ini { };
|
||||
in
|
||||
|
||||
{
|
||||
options.services.libeufin = {
|
||||
configFile = lib.mkOption {
|
||||
internal = true;
|
||||
default = settingsFormat.generate "generated-libeufin.conf" cfg.settings;
|
||||
};
|
||||
settings = lib.mkOption {
|
||||
description = "Global configuration options for the libeufin bank system config file.";
|
||||
type = lib.types.submodule { freeformType = settingsFormat.type; };
|
||||
default = { };
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf (cfg.bank.enable || cfg.nexus.enable) {
|
||||
environment.etc."libeufin/libeufin.conf".source = cfg.configFile;
|
||||
};
|
||||
}
|
||||
@@ -1,127 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
options,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [ (import ./common.nix "nexus") ];
|
||||
|
||||
options.services.libeufin.nexus.settings = lib.mkOption {
|
||||
description = ''
|
||||
Configuration options for the libeufin nexus config file.
|
||||
For a list of all possible options, please see the man page [`libeufin-nexus.conf(5)`](https://docs.taler.net/manpages/libeufin-nexus.conf.5.html)
|
||||
'';
|
||||
type = lib.types.submodule {
|
||||
inherit (options.services.libeufin.settings.type.nestedTypes) freeformType;
|
||||
options = {
|
||||
nexus-ebics = {
|
||||
# Mandatory configuration values
|
||||
# https://docs.taler.net/libeufin/nexus-manual.html#setting-up-the-ebics-subscriber
|
||||
# https://docs.taler.net/libeufin/setup-ebics-at-postfinance.html
|
||||
CURRENCY = lib.mkOption {
|
||||
description = "Name of the fiat currency.";
|
||||
type = lib.types.nonEmptyStr;
|
||||
example = "CHF";
|
||||
};
|
||||
HOST_BASE_URL = lib.mkOption {
|
||||
description = "URL of the EBICS server.";
|
||||
type = lib.types.nonEmptyStr;
|
||||
example = "https://ebics.postfinance.ch/ebics/ebics.aspx";
|
||||
};
|
||||
BANK_DIALECT = lib.mkOption {
|
||||
description = ''
|
||||
Name of the following combination: EBICS version and ISO20022
|
||||
recommendations that Nexus would honor in the communication with the
|
||||
bank.
|
||||
Currently only the "postfinance" or "gls" value is supported.
|
||||
'';
|
||||
type = lib.types.enum [
|
||||
"postfinance"
|
||||
"gls"
|
||||
];
|
||||
example = "postfinance";
|
||||
};
|
||||
HOST_ID = lib.mkOption {
|
||||
description = "Name of the EBICS host.";
|
||||
type = lib.types.nonEmptyStr;
|
||||
example = "PFEBICS";
|
||||
};
|
||||
USER_ID = lib.mkOption {
|
||||
description = ''
|
||||
User ID of the EBICS subscriber.
|
||||
This value must be assigned by the bank after having activated a new EBICS subscriber.
|
||||
'';
|
||||
type = lib.types.nonEmptyStr;
|
||||
example = "PFC00563";
|
||||
};
|
||||
PARTNER_ID = lib.mkOption {
|
||||
description = ''
|
||||
Partner ID of the EBICS subscriber.
|
||||
This value must be assigned by the bank after having activated a new EBICS subscriber.
|
||||
'';
|
||||
type = lib.types.nonEmptyStr;
|
||||
example = "PFC00563";
|
||||
};
|
||||
IBAN = lib.mkOption {
|
||||
description = "IBAN of the bank account that is associated with the EBICS subscriber.";
|
||||
type = lib.types.nonEmptyStr;
|
||||
example = "CH7789144474425692816";
|
||||
};
|
||||
BIC = lib.mkOption {
|
||||
description = "BIC of the bank account that is associated with the EBICS subscriber.";
|
||||
type = lib.types.nonEmptyStr;
|
||||
example = "POFICHBEXXX";
|
||||
};
|
||||
NAME = lib.mkOption {
|
||||
description = "Legal entity that is associated with the EBICS subscriber.";
|
||||
type = lib.types.nonEmptyStr;
|
||||
example = "John Smith S.A.";
|
||||
};
|
||||
BANK_PUBLIC_KEYS_FILE = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/var/lib/libeufin-nexus/bank-ebics-keys.json";
|
||||
description = ''
|
||||
Filesystem location where Nexus should store the bank public keys.
|
||||
'';
|
||||
};
|
||||
CLIENT_PRIVATE_KEYS_FILE = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/var/lib/libeufin-nexus/client-ebics-keys.json";
|
||||
description = ''
|
||||
Filesystem location where Nexus should store the subscriber private keys.
|
||||
'';
|
||||
};
|
||||
};
|
||||
nexus-httpd = {
|
||||
PORT = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 8084;
|
||||
description = ''
|
||||
The port on which libeufin-bank should listen.
|
||||
'';
|
||||
};
|
||||
};
|
||||
libeufin-nexusdb-postgres = {
|
||||
CONFIG = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
The database connection string for the libeufin-nexus database.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config =
|
||||
let
|
||||
cfgMain = config.services.libeufin;
|
||||
cfg = config.services.libeufin.nexus;
|
||||
in
|
||||
lib.mkIf cfg.enable {
|
||||
services.libeufin.nexus.settings.libeufin-nexusdb-postgres.CONFIG = lib.mkIf (
|
||||
cfgMain.bank.enable && cfgMain.bank.createLocalDatabase
|
||||
) "postgresql:///libeufin-bank";
|
||||
};
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
{
|
||||
imports = [
|
||||
./libeufin/bank.nix
|
||||
./libeufin/module.nix
|
||||
./libeufin/nexus.nix
|
||||
./taler/exchange.nix
|
||||
./taler/merchant.nix
|
||||
./taler/module.nix
|
||||
];
|
||||
}
|
||||
@@ -1,117 +0,0 @@
|
||||
# TODO: create a common module generator for Taler and Libeufin?
|
||||
{
|
||||
talerComponent ? "",
|
||||
servicesDB ? [ ],
|
||||
servicesNoDB ? [ ],
|
||||
...
|
||||
}:
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = cfgTaler.${talerComponent};
|
||||
cfgTaler = config.services.taler;
|
||||
settingsFormat = pkgs.formats.ini { };
|
||||
|
||||
services = servicesDB ++ servicesNoDB;
|
||||
|
||||
dbName = "taler-${talerComponent}-httpd";
|
||||
groupName = "taler-${talerComponent}-services";
|
||||
|
||||
inherit (cfgTaler) runtimeDir;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.taler.${talerComponent} = {
|
||||
enable = lib.mkEnableOption "the GNU Taler ${talerComponent}";
|
||||
package = lib.mkPackageOption pkgs "taler-${talerComponent}" { };
|
||||
# TODO: make option accept multiple debugging levels?
|
||||
debug = lib.mkEnableOption "debug logging";
|
||||
openFirewall = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Whether to open ports in the firewall";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.taler.enable = cfg.enable;
|
||||
|
||||
systemd.services = lib.mergeAttrsList [
|
||||
# Main services
|
||||
(lib.genAttrs (map (n: "taler-${talerComponent}-${n}") services) (name: {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
User = name;
|
||||
Group = groupName;
|
||||
ExecStart = toString [
|
||||
(lib.getExe' cfg.package name)
|
||||
"-c /etc/taler/taler.conf"
|
||||
(lib.optionalString cfg.debug " -L debug")
|
||||
];
|
||||
RuntimeDirectory = name;
|
||||
StateDirectory = name;
|
||||
CacheDirectory = name;
|
||||
ReadWritePaths = [ runtimeDir ];
|
||||
Restart = "always";
|
||||
RestartSec = "10s";
|
||||
};
|
||||
requires = [ "taler-${talerComponent}-dbinit.service" ];
|
||||
after = [ "taler-${talerComponent}-dbinit.service" ];
|
||||
wantedBy = [ "multi-user.target" ]; # TODO slice?
|
||||
}))
|
||||
# Database Initialisation
|
||||
{
|
||||
"taler-${talerComponent}-dbinit" = {
|
||||
path = [ config.services.postgresql.package ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
DynamicUser = true;
|
||||
User = dbName;
|
||||
Restart = "on-failure";
|
||||
RestartSec = "5s";
|
||||
};
|
||||
requires = [ "postgresql.service" ];
|
||||
after = [ "postgresql.service" ];
|
||||
};
|
||||
}
|
||||
];
|
||||
|
||||
users.groups.${groupName} = { };
|
||||
systemd.tmpfiles.settings = {
|
||||
"10-taler-${talerComponent}" = {
|
||||
"${runtimeDir}" = {
|
||||
d = {
|
||||
group = groupName;
|
||||
user = "nobody";
|
||||
mode = "070";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall = lib.mkIf cfg.openFirewall {
|
||||
allowedTCPPorts = [ cfg.settings."${talerComponent}".PORT ];
|
||||
};
|
||||
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
|
||||
services.taler.includes = [ "/etc/taler/conf.d/${talerComponent}.conf" ];
|
||||
environment.etc."taler/conf.d/${talerComponent}.conf".source = settingsFormat.generate "generated-taler.conf" cfg.settings;
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ dbName ];
|
||||
ensureUsers = map (service: { name = "taler-${talerComponent}-${service}"; }) servicesDB ++ [
|
||||
{
|
||||
name = dbName;
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,143 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
options,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = cfgTaler.exchange;
|
||||
cfgTaler = config.services.taler;
|
||||
|
||||
talerComponent = "exchange";
|
||||
|
||||
# https://docs.taler.net/taler-exchange-manual.html#services-users-groups-and-file-system-hierarchy
|
||||
servicesDB = [
|
||||
"httpd"
|
||||
"aggregator"
|
||||
"closer"
|
||||
"wirewatch"
|
||||
];
|
||||
|
||||
servicesNoDB = [
|
||||
"secmod-cs"
|
||||
"secmod-eddsa"
|
||||
"secmod-rsa"
|
||||
];
|
||||
in
|
||||
|
||||
{
|
||||
imports = [
|
||||
(import ./common.nix { inherit talerComponent servicesDB servicesNoDB; })
|
||||
];
|
||||
|
||||
options.services.taler.exchange = {
|
||||
settings = lib.mkOption {
|
||||
description = ''
|
||||
Configuration options for the taler exchange config file.
|
||||
For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html#exchange-options)
|
||||
'';
|
||||
type = lib.types.submodule {
|
||||
inherit (options.services.taler.settings.type.nestedTypes) freeformType;
|
||||
options = {
|
||||
# TODO: do we want this to be a sub-attribute or only define the exchange set of options here
|
||||
exchange = {
|
||||
AML_THRESHOLD = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${cfgTaler.settings.taler.CURRENCY}:1000000";
|
||||
defaultText = "1000000 in {option}`CURRENCY`";
|
||||
description = "Monthly transaction volume until an account is considered suspicious and flagged for AML review.";
|
||||
};
|
||||
DB = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
internal = true;
|
||||
default = "postgres";
|
||||
};
|
||||
MASTER_PUBLIC_KEY = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = throw ''
|
||||
You must provide `MASTER_PUBLIC_KEY` with the public part of your master key.
|
||||
This will be used by the auditor service to get information about the exchange.
|
||||
For more information, see https://docs.taler.net/taler-auditor-manual.html#initial-configuration
|
||||
To generate this key, you must run `taler-exchange-offline setup`. It will print the public key.
|
||||
'';
|
||||
defaultText = "None, you must set this yourself.";
|
||||
description = "Used by the exchange to verify information signed by the offline system.";
|
||||
};
|
||||
PORT = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 8081;
|
||||
description = "Port on which the HTTP server listens.";
|
||||
};
|
||||
};
|
||||
exchangedb-postgres = {
|
||||
CONFIG = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
internal = true;
|
||||
default = "postgres:///taler-exchange-httpd";
|
||||
description = "Database connection URI.";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
default = { };
|
||||
};
|
||||
denominationConfig = lib.mkOption {
|
||||
type = lib.types.lines;
|
||||
defaultText = "None, you must set this yourself.";
|
||||
example = ''
|
||||
[COIN-KUDOS-n1-t1718140083]
|
||||
VALUE = KUDOS:0.1
|
||||
DURATION_WITHDRAW = 7 days
|
||||
DURATION_SPEND = 2 years
|
||||
DURATION_LEGAL = 6 years
|
||||
FEE_WITHDRAW = KUDOS:0
|
||||
FEE_DEPOSIT = KUDOS:0.1
|
||||
FEE_REFRESH = KUDOS:0
|
||||
FEE_REFUND = KUDOS:0
|
||||
RSA_KEYSIZE = 2048
|
||||
CIPHER = RSA
|
||||
'';
|
||||
description = ''
|
||||
This option configures the cash denomination for the coins that the exchange offers.
|
||||
For more information, consult the [upstream docs](https://docs.taler.net/taler-exchange-manual.html#coins-denomination-keys).
|
||||
You can either write these manually or you can use the `taler-harness deployment gen-coin-config`
|
||||
command to generate it.
|
||||
Warning: Do not modify existing denominations after deployment.
|
||||
Please see the upstream docs for how to safely do that.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.taler.includes = [
|
||||
(pkgs.writers.writeText "exchange-denominations.conf" cfg.denominationConfig)
|
||||
];
|
||||
|
||||
systemd.services.taler-exchange-wirewatch = {
|
||||
requires = [ "taler-exchange-httpd.service" ];
|
||||
after = [ "taler-exchange-httpd.service" ];
|
||||
};
|
||||
|
||||
# Taken from https://docs.taler.net/taler-exchange-manual.html#exchange-database-setup
|
||||
# TODO: Why does aggregator need DELETE?
|
||||
systemd.services."taler-${talerComponent}-dbinit".script =
|
||||
let
|
||||
deletePerm = name: lib.optionalString (name == "aggregator") ",DELETE";
|
||||
dbScript = pkgs.writers.writeText "taler-exchange-db-permissions.sql" (
|
||||
lib.pipe servicesDB [
|
||||
(map (name: ''
|
||||
GRANT SELECT,INSERT,UPDATE${deletePerm name} ON ALL TABLES IN SCHEMA exchange TO "taler-exchange-${name}";
|
||||
GRANT USAGE ON SCHEMA exchange TO "taler-exchange-${name}";
|
||||
''))
|
||||
lib.concatStrings
|
||||
]
|
||||
);
|
||||
in
|
||||
''
|
||||
${lib.getExe' cfg.package "taler-exchange-dbinit"}
|
||||
psql -U taler-exchange-httpd -f ${dbScript}
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -1,108 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
options,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = cfgTaler.merchant;
|
||||
cfgTaler = config.services.taler;
|
||||
|
||||
talerComponent = "merchant";
|
||||
|
||||
# https://docs.taler.net/taler-merchant-manual.html#launching-the-backend
|
||||
servicesDB = [
|
||||
"httpd"
|
||||
"webhook"
|
||||
"wirewatch"
|
||||
"depositcheck"
|
||||
"exchange"
|
||||
];
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
(import ./common.nix { inherit talerComponent servicesDB; })
|
||||
];
|
||||
|
||||
options.services.taler.merchant = {
|
||||
settings = lib.mkOption {
|
||||
description = ''
|
||||
Configuration options for the taler merchant config file.
|
||||
For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html#merchant-options)
|
||||
'';
|
||||
type = lib.types.submodule {
|
||||
inherit (options.services.taler.settings.type.nestedTypes) freeformType;
|
||||
options = {
|
||||
# TODO: do we want this to be a sub-attribute or only define the merchant set of options here
|
||||
merchant = {
|
||||
DB = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
internal = true;
|
||||
default = "postgres";
|
||||
description = "Plugin to use for the database.";
|
||||
};
|
||||
PORT = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 8083;
|
||||
description = "Port on which the HTTP server listens.";
|
||||
};
|
||||
SERVE = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "tcp";
|
||||
description = ''
|
||||
Whether the HTTP server should listen on a UNIX domain socket ("unix") or on a TCP socket ("tcp").
|
||||
'';
|
||||
};
|
||||
LEGAL_PRESERVATION = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
internal = true;
|
||||
default = "10 years";
|
||||
description = "How long to keep data in the database for tax audits after the transaction has completed.";
|
||||
};
|
||||
};
|
||||
merchantdb-postgres = {
|
||||
CONFIG = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
internal = true;
|
||||
default = "postgres:///taler-${talerComponent}-httpd";
|
||||
description = "Database connection URI.";
|
||||
};
|
||||
SQL_DIR = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
internal = true;
|
||||
default = "${cfg.package}/share/taler/sql/merchant/";
|
||||
description = "The location for the SQL files to setup the database tables.";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
default = { };
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.taler-merchant-depositcheck = {
|
||||
# taler-merchant-depositcheck needs its executable is in the PATH
|
||||
# NOTE: couldn't use `lib.getExe` to only get that single executable
|
||||
path = [ cfg.package ];
|
||||
};
|
||||
|
||||
systemd.services."taler-${talerComponent}-dbinit".script =
|
||||
let
|
||||
# NOTE: not documented, but is necessary
|
||||
dbScript = pkgs.writers.writeText "taler-merchant-db-permissions.sql" (
|
||||
lib.concatStrings (
|
||||
map (name: ''
|
||||
GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA merchant TO "taler-merchant-${name}";
|
||||
GRANT USAGE ON SCHEMA merchant TO "taler-merchant-${name}";
|
||||
'') servicesDB
|
||||
)
|
||||
);
|
||||
in
|
||||
''
|
||||
${lib.getExe' cfg.package "taler-merchant-dbinit"}
|
||||
psql -U taler-${talerComponent}-httpd -f ${dbScript}
|
||||
'';
|
||||
};
|
||||
}
|
||||
@@ -1,89 +0,0 @@
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.services.taler;
|
||||
settingsFormat = pkgs.formats.ini { };
|
||||
in
|
||||
|
||||
{
|
||||
# TODO turn this into a generic taler-like service thingy?
|
||||
options.services.taler = {
|
||||
enable = lib.mkEnableOption "the GNU Taler system" // lib.mkOption { internal = true; };
|
||||
includes = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.path;
|
||||
default = [ ];
|
||||
description = ''
|
||||
Files to include into the config file using Taler's `@inline@` directive.
|
||||
This allows including arbitrary INI files, including imperatively managed ones.
|
||||
'';
|
||||
};
|
||||
settings = lib.mkOption {
|
||||
description = ''
|
||||
Global configuration options for the taler config file.
|
||||
For a list of all possible options, please see the man page [`taler.conf(5)`](https://docs.taler.net/manpages/taler.conf.5.html)
|
||||
'';
|
||||
type = lib.types.submodule {
|
||||
freeformType = settingsFormat.type;
|
||||
options = {
|
||||
taler = {
|
||||
CURRENCY = lib.mkOption {
|
||||
type = lib.types.nonEmptyStr;
|
||||
description = ''
|
||||
The currency which taler services will operate with. This cannot be changed later.
|
||||
'';
|
||||
};
|
||||
CURRENCY_ROUND_UNIT = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${cfg.settings.taler.CURRENCY}:0.01";
|
||||
defaultText = lib.literalExpression ''
|
||||
"''${config.services.taler.settings.taler.CURRENCY}:0.01"
|
||||
'';
|
||||
description = ''
|
||||
Smallest amount in this currency that can be transferred using the underlying RTGS.
|
||||
You should probably not touch this.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
default = { };
|
||||
};
|
||||
runtimeDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/run/taler-system-runtime/";
|
||||
description = ''
|
||||
Runtime directory shared between the taler services.
|
||||
Crypto helpers put their sockets here for instance and the httpd
|
||||
connects to them.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.taler.settings.PATHS = {
|
||||
TALER_DATA_HOME = "\${STATE_DIRECTORY}/";
|
||||
TALER_CACHE_HOME = "\${CACHE_DIRECTORY}/";
|
||||
TALER_RUNTIME_DIR = cfg.runtimeDir;
|
||||
};
|
||||
|
||||
environment.etc."taler/taler.conf".source =
|
||||
let
|
||||
includes = pkgs.writers.writeText "includes.conf" (
|
||||
lib.concatStringsSep "\n" (map (include: "@inline@ ${include}") cfg.includes)
|
||||
);
|
||||
generatedConfig = settingsFormat.generate "generated-taler.conf" cfg.settings;
|
||||
in
|
||||
pkgs.runCommand "taler.conf" { } ''
|
||||
cat ${includes} > $out
|
||||
echo >> $out
|
||||
echo >> $out
|
||||
cat ${generatedConfig} >> $out
|
||||
'';
|
||||
|
||||
};
|
||||
}
|
||||
@@ -1,13 +1,13 @@
|
||||
{ config, pkgs, values, ... }:
|
||||
{ config, fp, pkgs, values, ... }:
|
||||
{
|
||||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../base
|
||||
../../misc/metrics-exporters.nix
|
||||
(fp /base)
|
||||
(fp /misc/metrics-exporters.nix)
|
||||
];
|
||||
|
||||
sops.defaultSopsFile = ../../secrets/shark/shark.yaml;
|
||||
sops.defaultSopsFile = fp /secrets/shark/shark.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
||||
sops.age.generateKey = true;
|
||||
|
||||
@@ -5,6 +5,7 @@ gitea:
|
||||
database: ENC[AES256_GCM,data:UlS33IdCEyeSvT6ngpmnkBWHuSEqsB//DT+3b7C+UwbD8UXWJlsLf1X8/w==,iv:mPRW5ldyZaHP+y/0vC2JGSLZmlkhgmkvXPk4LazkSDs=,tag:gGk6Z/nbPvzE1zG+tJC8Sw==,type:str]
|
||||
email-password: ENC[AES256_GCM,data:KRwC+aL1aPvJuXt91Oq1ttATMnFTnuUy,iv:ats8TygB/2pORkaTZzPOLufZ9UmvVAKoRcWNvYF1z6w=,tag:Do0fA+4cZ3+l7JJyu8hjBg==,type:str]
|
||||
passwd-ssh-key: ENC[AES256_GCM,data:L0lF0wvpayss1NU9m3A45cH0bCMQzODTFVrq6EPd1JHx54wIcoaRBYLmxXKXASzBlCg9zlwXMUIk3OQcS3kdzMKL0iqcSL2iicAcKjFIHyrWLqXgwV5pRSP/tRPcVw8KW8gz0bh33EgESs5ReddZ3VZ0Cy1s2YupMRQvBXr89k1+Hv70OWB6P06hvxhv/zKcMGI1N/dWLroMgrQuT9imw4+/Q1RqwzTYeEU+eUn24AM9GjcBg4qf3OI+6g0nXUat/upIYE28iF5J3lbUSmDSmirBLc8xgHLdOyyJPTObWYWYxlSL78T7IqiMm9lI3rtBlpJDDcn/YxZpVqN5bg2154GISNK+uR0TVSLdJ+drdGHIfIX3G78XSxf2L9rbJyRn8MQlgStfdBIQicLavQKVMrmj+XQfvEMez23WbPLjH4oViBQFI+GrOHOGy/f16cz8Sn4n+69OcsOeTxs3tKYdfq6r1XLYSJ/fe/zvxBpaZiyGXljsuyEdIyBL2A8D6uSXe3Nd3/DAdBtceFfIdN1olCdutixzVWgxaJnrel161z5A/4w=,iv:Uy46yY3jFYSvpxrgCHxRMUksnWfhf5DViLMvCXVMMl4=,tag:wFEJ5+icFrOKkc56gY0A5g==,type:str]
|
||||
gpg-signing-key: ENC[AES256_GCM,data:y/g1rpsEgiGEJ9BGii6te166ABpg1jgsyYMT1Ji5njLbT8/juBBMc7BFEM5BcIxKpQGijymsB+Htl8CZAN4Bl3FHSRyrnXGuMCnveJfw1qTVjMa6soriHv7EdTDFPCp3TYMbs1OgY/bhGJIvp8e4hCVd4F3x8eAlFmiwHhkxr62qQNHjH7SRNIyUNibf/TTttOeEcercxOy7FeUE99D+CWG4pnJNEYyRHDdddalgpSJyZIJvPpXoKmeCDk3futnxiZ15Vr7bDS5u4dqnE+no7DKoZ5fvk38f/77JH3w/Qom7NCYSG6L+unJ3r3RKuuGMRDjdz09TPZ4APpmrlyOElfGMmm134g6mdhgXmwNCo65Z7VOd1OKFA/uyZm2b7XsT3tCgRalE8gBa0R3MBMi3JK+5KUdS6ZUvYXDt8D8C68ldM3K9E7lyeeHn775rV6L4JIXcj/NL1O23sXtjeVuUPQmsUesgYlllRaiTSTfY7K+yOIG3wqqCuCDSAeILQICkvod4iw4xdVMQzd8eQtbD6bCjOzHwvBcu+rOSN6ti+xOQ7bJ9+6xhCgJJsiADkp2q09cUu8mDbUh+YJxfu+oZhPomOJVDMSqfS4qNXcVM9mbak/L9KPR4b83GqTpmXHnDMlGe4BHGXrkIUKPsBQ5TmdckXbpRDBQFrnjVvFT+Gfx3xwHxWc9fbxcFID2wp69EzQrGC77bDPCFxBT5vAVwffGYUezPQEo25bKRpCWxTFTpiIQfACrwzZc/O9cmwDgrYN7bTZyrrp8cbyBtllZGYmXxLDkDOzIqzpLG3b0yJC2jSnw0f1DkU6M2mD/j9FRTVW1MVymyLPiZQ7T9QyZ3MekHEEY1QqmyiJMIOekSzC5+3Us6Nl32MeBrIry6NuV8ewIQF5bcZEHtSmZ0k/wBtK0fpFHUuc/vETFuRUiQw/InhN5W8iH78vFvflxBfg61Qp7PzEx0k0axwEc6VAKbEg/uFNL+fhUKKt7sYiEBmwg2Vsj3pyZgdmjPZEsOQ86+psaxv+2feH94wog47jDHFRrc4iRC5w7kZ6UJXHfZt9lkBbwl4qNwiOLlPnUUcR+CpTBpPoKD9ulidQGfcYY49+iE+PM5dAI2CtisKpLQiwmrvjOzB1a/rC9QnH679frgH5Ebb57WRL4uSAVNRdIvIGzAF5MNwQOu+cxKoiW6ZmuNJSb547XUB1UO,iv:aKzrgAV30sLfPEpgdQ26ZzdM3+gYtoSpZ9mNyqCqf/M=,tag:vjywN4qxh2zsCE3RPG6Yrw==,type:str]
|
||||
ssh-known-hosts: ENC[AES256_GCM,data:zlRLoelQeumMxGqPmgMTB69X1RVWXIs2jWwc67lk0wrdNOHUs5UzV5TUA1JnQ43RslBU92+js7DkyvE5enGzw7zZE5F1ZYdGv/eCgvkTMC9BoLfzHzP6OzayPLYEt3xJ5PRocN8JUAD55cuu4LgsuebuydHPi2oWOfpbSUBKSeCh6dvk5Pp1XRDprPS5SzGLW8Xjq98QlzmfGv50meI9CDJZVF9Wq/72gkyfgtb3YVdr,iv:AF06TBitHegfWk6w07CdkHklh4ripQCmA45vswDQgss=,tag:zKh7WVXMJN2o9ZIwIkby3Q==,type:str]
|
||||
import-user-env: ENC[AES256_GCM,data:wArFwTd0ZoB4VXHPpichfnmykxGxN8y2EQsMgOPHv7zsm6A+m2rG9BWDGskQPr5Ns9o=,iv:gPUzYFSNoALJb1N0dsbNlgHIb7+xG7E9ANpmVNZURQ0=,tag:JghfRy2OcDFWKS9zX1XJ9A==,type:str]
|
||||
runners:
|
||||
@@ -97,8 +98,8 @@ sops:
|
||||
UHpLRkdQTnhkeGlWVG9VS1hkWktyckEKAdwnA9URLYZ50lMtXrU9Q09d0L3Zfsyr
|
||||
4UsvjjdnFtsXwEZ9ZzOQrpiN0Oz24s3csw5KckDni6kslaloJZsLGg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-10-12T21:56:27Z"
|
||||
mac: ENC[AES256_GCM,data:bZ1BbVC6D+B6SFze2ReeCUcQamK/O14zH3YxCjWBwMC++w3niIiEx4Bq7Ulci5yuMld0luVsfUzHoqFN/+zvZbV2rGVk8lVRiTrpFoSZ78aUUgeHG9ROLXsR7T7rVhLWbl86y1G5LcKws7G55V0wAh6f58WjYYzwR8fnBmfW1Ko=,iv:7xtMdtXQB9uZirE/CkUSmeu0qnG++R7DUR7zn/Bo0lM=,tag:DH/BJPpAp//quDqKNXyHcg==,type:str]
|
||||
lastmodified: "2024-11-24T02:02:00Z"
|
||||
mac: ENC[AES256_GCM,data:hTye1yv7J/jEjLXtIyFPJZFuY3wol2tX1kZi7JtwTa6zs/JTg7piPL76/CkgWjVxGdv6DpSdlCt+AjIMQarbBpyKc/ux83zHrgI2BUZfYTtjwKLfoafsRjsjoz17ZRE55ozbjb6UHCCHLIJXUmHop35AeGwNcexx3UH267lpPZs=,iv:GhU0u7D9Dg/PqM4gEm7j9pPlCPGTxgWDMv0dNxr9HMk=,tag:fZHfgJdpKtT2mNaeOU7agg==,type:str]
|
||||
pgp:
|
||||
- created_at: "2024-08-04T00:03:28Z"
|
||||
enc: |-
|
||||
|
||||
@@ -60,10 +60,6 @@ in rec {
|
||||
ipv4 = pvv-ipv4 204;
|
||||
ipv6 = pvv-ipv6 "1:4f"; # Wtf øystein og daniel why
|
||||
};
|
||||
kvernberg = {
|
||||
ipv4 = pvv-ipv4 206;
|
||||
ipv6 = pvv-ipv6 "1:206";
|
||||
};
|
||||
};
|
||||
|
||||
defaultNetworkConfig = {
|
||||
|
||||
Reference in New Issue
Block a user