nixos-config/systems/LoutreOS/services.nix

{ config, lib, pkgs, ... }:

with lib;

let
  domaine = "nyanlout.re";

  riot_port = 52345;
  pgmanage_port = 52347;
  max_port = 52348;
  musique_port = 52349;

  ekleog_matrix_0_33 = pkgs.fetchgit {
    url = "https://github.com/Ekleog/nixpkgs.git";
    rev = "fe1fa933d168faec56767a9bd1daa0d47070bdf0";
    sha256 = "02nlcs46ijjkwl8i521555gpd0w2if87p9bmdn2s5g728pz8mh27";
  };
  ekleog_matrix_0_33_pkgs = import ekleog_matrix_0_33 {};
in

{
  imports = [
    ../../services/haproxy-acme.nix
    ../../services/mail-server.nix
    ../../services/site-musique.nix
    ../../services/site-max.nix
  ];

  services.fail2ban.enable = true;

  services.smartd.enable = true;
  services.smartd.notifications.mail.enable = true;
  services.smartd.notifications.mail.recipient = "paul@nyanlout.re";

  services.haproxy-acme.enable = true;
  services.haproxy-acme.domaine = domaine;
  services.haproxy-acme.services = {
    "grafana.${domaine}" = { ip = "127.0.0.1"; port = 3000; auth = true; };
    "emby.${domaine}" = { ip = "127.0.0.1"; port = 8096; auth = false; };
    "radarr.${domaine}" = { ip = "127.0.0.1"; port = 7878; auth = true; extraAcls = "acl API url_beg /api\n"; aclBool = "!AUTH_OK !API"; };
    "sonarr.${domaine}" = { ip = "127.0.0.1"; port = 8989; auth = true; extraAcls = "acl API url_beg /api\n"; aclBool = "!AUTH_OK !API"; };
    "transmission.${domaine}" = { ip = "127.0.0.1"; port = 9091; auth = true; };
    "syncthing.${domaine}" = { ip = "127.0.0.1"; port = 8384; auth = true; };
    "jackett.${domaine}" = { ip = "127.0.0.1"; port = 9117; auth = true; };
    "searx.${domaine}" = { ip = "127.0.0.1"; port = 8888; auth = false; };
    "riot.${domaine}" = { ip = "127.0.0.1"; port = riot_port; auth = false; };
    "matrix.${domaine}" = { ip = "127.0.0.1"; port = 8008; auth = false; };
    "pgmanage.${domaine}" = { ip = "127.0.0.1"; port = pgmanage_port; auth = true; };
    "gitea.${domaine}" = { ip = "127.0.0.1"; port = 3001; auth = false; };
  };

  services.mailserver.enable = true;
  services.mailserver.domaine = domaine;

  services.influxdb.enable = true;
  services.influxdb.dataDir = "/var/db/influxdb";

  services.telegraf.enable = true;
  services.telegraf.extraConfig = {
    inputs = {
      zfs = { poolMetrics = true; };
      net = { interfaces = [ "eno1" "eno2" "eno3" "eno4" ]; };
      netstat = {};
      cpu = { totalcpu = true; };
      kernel = {};
      mem = {};
      processes = {};
      system = {};
      disk = {};
      ipmi_sensor = { path = "${pkgs.ipmitool}/bin/ipmitool"; };
      smart = {
        path = "${pkgs.writeShellScriptBin "smartctl" "/run/wrappers/bin/sudo ${pkgs.smartmontools}/bin/smartctl $@"}/bin/smartctl";
      };
      exec= [
        { commands = [
          "${pkgs.python}/bin/python ${
              pkgs.fetchgit {
                url = "https://gitea.nyanlout.re/nyanloutre/tplink-smartplug.git";
                rev = "a0996112fc451b76448589698de440ad5fd6ea79";
                sha256 = "1f1625g7rfsddgk428g76p8fr7vz5gfhq3f452q17bjni3rf2pj3";
              }
            }/tplink_smartplug.py -t 192.168.0.57 -c energy"
          ];
          data_format = "json";
          name_suffix = "_tplink-smartplug";
        }
        {
          commands = [
            "${pkgs.python3}/bin/python ${pkgs.writeText "zpool.py" ''
              import json
              from subprocess import check_output

              columns = ["NAME", "SIZE", "ALLOC", "FREE", "EXPANDSZ", "FRAG", "CAP", "DEDUP", "HEALTH", "ALTROOT"]
              health = {'ONLINE':0, 'DEGRADED':11, 'OFFLINE':21, 'UNAVAIL':22, 'FAULTED':23, 'REMOVED':24}

              stdout = check_output(["${pkgs.zfs}/bin/zpool", "list", "-Hp"],encoding='UTF-8').split('\n')
              parsed_stdout = list(map(lambda x: dict(zip(columns,x.split('\t'))), stdout))[:-1]

              for pool in parsed_stdout:
                for item in pool:
                  if item in ["SIZE", "ALLOC", "FREE", "FRAG", "CAP"]:
                    pool[item] = int(pool[item])
                  if item in ["DEDUP"]:
                    pool[item] = float(pool[item])
                  if item == "HEALTH":
                    pool[item] = health[pool[item]]

              print(json.dumps(parsed_stdout))
            ''}"
          ];
          tag_keys = [ "NAME" ];
          data_format = "json";
          name_suffix = "_python_zpool";
        }
      ];
    };
    outputs = {
      influxdb = { database = "telegraf"; urls = [ "http://localhost:8086" ]; };
    };
  };

  services.udev.extraRules = ''
    KERNEL=="ipmi*", MODE="660", OWNER="telegraf"
  '';

  security.sudo.extraRules = [
    { commands = [ { command = "${pkgs.smartmontools}/bin/smartctl"; options = [ "NOPASSWD" ]; } ]; users = [ "telegraf" ]; }
  ];

  services.grafana.enable = true;
  services.grafana.addr = "127.0.0.1";
  services.grafana.dataDir = "/var/lib/grafana";
  services.grafana.extraOptions = {
    SERVER_ROOT_URL = "https://grafana.${domaine}";
    SMTP_ENABLED = "true";
    SMTP_FROM_ADDRESS = "grafana@${domaine}";
    SMTP_SKIP_VERIFY = "true";
    AUTH_DISABLE_LOGIN_FORM = "true";
    AUTH_DISABLE_SIGNOUT_MENU = "true";
    AUTH_ANONYMOUS_ENABLED = "true";
    AUTH_ANONYMOUS_ORG_ROLE = "Admin";
    AUTH_BASIC_ENABLED = "false";
  };

  services.emby.enable = true;
  services.emby.dataDir = "/var/lib/emby/ProgramData-Server";

  services.slimserver.enable = true;
  services.slimserver.dataDir = "/var/lib/slimserver";

  services.syncthing.enable = true;
  services.syncthing.dataDir = "/var/lib/syncthing";
  services.syncthing.openDefaultPorts = true;
  
  services.nfs.server = {
    enable = true;
    exports = ''
      /mnt/medias  192.168.0.0/24(ro,no_root_squash)
      /exports/steam  192.168.0.0/24(rw,no_root_squash)
    '';
    statdPort = 4000;
    lockdPort = 4001;
    mountdPort = 4002;
  };

  services.transmission.enable = true;
  services.transmission.home = "/var/lib/transmission";
  services.transmission.settings = {
    rpc-bind-address = "127.0.0.1";
    rpc-host-whitelist = "*";
    rpc-whitelist-enabled = false;
  };

  services.radarr.enable = true;
  services.sonarr.enable = true;
  services.jackett.enable = true;

  services.searx.enable = true;

  services.nginx.enable = true;
  services.nginx.virtualHosts = {
    "riot" = {
      listen = [ { addr = "127.0.0.1"; port = riot_port; } ];
      locations = { "/" = { root = pkgs.riot-web; }; };
    };
  };

  services.postgresql.enable = true;
  services.matrix-synapse = {
    enable = true;
    package = ekleog_matrix_0_33_pkgs.matrix-synapse;
    enable_registration = true;
    server_name = "nyanlout.re";
    listeners = [
      { # federation
        bind_address = "";
        port = 8448;
        resources = [
          { compress = true; names = [ "client" "webclient" ]; }
          { compress = false; names = [ "federation" ]; }
        ];
        tls = true;
        type = "http";
        x_forwarded = false;
      }
      { # client
        bind_address = "127.0.0.1";
        port = 8008;
        resources = [
          { compress = true; names = [ "client" "webclient" ]; }
        ];
        tls = false;
        type = "http";
        x_forwarded = true;
      }
    ];
    database_type = "psycopg2";
    database_args = {
      database = "matrix-synapse";
    };
    extraConfig = ''
      max_upload_size: "100M"
    '';
    logConfig = ''
      version: 1

      formatters:
          journal_fmt:
              format: '%(name)s: [%(request)s] %(message)s'

      filters:
          context:
              (): synapse.util.logcontext.LoggingContextFilter
              request: ""

      handlers:
          journal:
              class: systemd.journal.JournalHandler
              formatter: journal_fmt
              filters: [context]
              SYSLOG_IDENTIFIER: synapse

      root:
          level: WARNING
          handlers: [journal]

      disable_existing_loggers: False
    '';
  };

  systemd.services.matrix-synapse.serviceConfig = {
    MemoryHigh = "3G";
    MemoryMax = "4G";
  };

  services.pgmanage.enable = true;
  services.pgmanage.port = pgmanage_port;
  services.pgmanage.connections = {
    localhost = "hostaddr=127.0.0.1 port=5432 dbname=postgres";
  };

  services.borgbackup.jobs = {
    loutre = {
      paths = [
        "/var/certs"
        "/var/dkim"
        "/var/lib/gitea"
        "/var/lib/grafana"
        "/var/lib/matrix-synapse"
        "/var/lib/jackett"
        "/var/lib/postgresql/.zfs/snapshot/borgsnap"
        "/var/lib/radarr"
        "/var/lib/sonarr"
        "/var/lib/syncthing"
        "/var/lib/transmission"
        "/mnt/medias/musique"
        "/mnt/medias/torrent/lidarr"
        "/mnt/medias/torrent/musique"
        "/var/sieve"
        "/var/vmail"
      ];
      repo = "/mnt/backup/borg";
      encryption = {
        mode = "repokey-blake2";
        passCommand = "cat /mnt/secrets/borgbackup_loutre_encryption_pass";
      };
      startAt = "weekly";
      prune.keep = {
        within = "1d";
        weekly = 4;
        monthly = 12;
      };
      preHook = "${pkgs.zfs}/bin/zfs snapshot loutrepool/var/postgresql@borgsnap";
      postHook = ''
        ${pkgs.zfs}/bin/zfs destroy loutrepool/var/postgresql@borgsnap
        if [[ $exitStatus == 0 ]]; then
          ${pkgs.rclone}/bin/rclone --config /mnt/secrets/rclone_loutre.conf sync -v $BORG_REPO loutre_ovh:loutre
        fi
      '';
    };
  };

  services.borgbackup.repos = {
    diskstation = {
      authorizedKeys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDllbxON66dBju7sMnhX8/E0VRo3+PDYvDsHP0/FK+h8JHol4+pouLmI7KIDKYOJmSuom283OqnyZOMqk+RShTwWIFm9hOd2R9aj45Zrd9jPW2APOCec/Epgogj0bwBnc0l2v6qxkxaBMgL5DnAQ+E00uvL1UQpK8c8j4GGiPlkWJD6Kf+pxmnfH1TIm+J2XCwl0oeCkSK/Frd8eM+wCraMSzoaGiEcfMz2jK8hxDWjDxX7epU0ELF22BVCuyN8cYRoFTnV88E38PlaqsOqD5ePkxk425gDh7j/C06f8QKgnasVH2diixo92kYSd7i/RmfeXDDwAD5xqUvODczEuIdt root@DiskStation" ];
      path = "/mnt/backup_loutre/diskstation_borg";
      user = "synology";
    };
  };

  services.gitea = {
    enable = true;
    cookieSecure = true;
    httpPort = 3001;
    rootUrl = "https://gitea.nyanlout.re/";
    database.type = "postgres";
    database.port = 5432;
    database.passwordFile = "/mnt/secrets/gitea_database_passwordFile";
  };

  services.vsftpd = {
    enable = true;
    forceLocalLoginsSSL = true;
    forceLocalDataSSL = true;
    userlistDeny = false;
    localUsers = true;
    userlist = ["claire"];
    rsaCertFile = "/var/vsftpd/vsftpd.pem";
    extraConfig = ''
      pasv_min_port=64000
      pasv_max_port=65535
    '';
  };

  services.site-musique.enable = true;
  services.site-musique.port = musique_port;
  services.site-musique.domaine = "musique-meyenheim.fr";

  services.site-max.enable = true;
  services.site-max.port = max_port;
  services.site-max.domaine = "maxspiegel.fr";

  /*
  systemd.services.dogetipbot-telegram = {
    after = [ "network.target" ];
    wantedBy = [ "multi-user.target" ];
    script = "${pkgs.dogetipbot-telegram}/bin/dogetipbot-telegram --block-io-api-key $BLOCK_IO_API_KEY --block-io-pin $BLOCK_IO_PIN --telegram-api-key $TELEGRAM_API_KEY --network DOGE";
    enable = true;
    serviceConfig = {
      EnvironmentFile = "/mnt/secrets/dogetipbot-telegram_env";
      User = "nobody";
      Group = "nogroup";
    };
  };
  */

  networking.firewall.allowedTCPPorts = [
    111 2049 4000 4001 4002 # NFS
    3483 9000 9090 # Slimserver
    51413 # Transmission
    8448 # Matrix federation
    20 21 # FTP
  ];
  networking.firewall.allowedTCPPortRanges = [
    { from = 64000; to = 65535; } # FTP
  ];
  networking.firewall.allowedUDPPorts = [
    111 2049 4000 4001 4002 # NFS
    3483 # Slimserver
    51413 # Transmission
  ];
}